Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    300s
  • max time network
    299s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    22/08/2024, 22:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1dfe9d71e389b57e6b96838ab9ccab1948034fe0346ba85ca9709cea484c213c.exe
  • Size 1.9MB
  • Sample240822-2f6n8a1dpg
  • SHA256 1dfe9d71e389b57e6b96838ab9ccab1948034fe0346ba85ca9709cea484c213c
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeylummaredlinestealcxwormzharkbot14082024816fa@cloudytteamdefaultfed3aalivetrafficbotnetcredential_accessdiscoveryevasionexecutioninfostealerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.41

Botnet

  • fed3aa

C2

  • http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • LiveTraffic

C2

  • 95.179.163.21:29257

Extracted

Family

  • redline

Botnet

  • @CLOUDYTTEAM

C2

  • 65.21.18.51:45580

Extracted

Family

  • stealc

Botnet

  • default

C2

  • http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

  • redline

Botnet

  • 14082024

C2

  • 185.215.113.67:21405

Extracted

Family

  • redline

Botnet

  • 816FA

C2

  • 88.99.151.68:7200

Extracted

Family

  • xworm

C2

  • 127.0.0.1:7000

  • beshomandotestbesnd.run.place:7000

Attributes
  • Install_directory

    %Userprofile%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot2128988424:AAEkYnwvOQA95riqRZwlqBxg4GV-odRNOyo/sendMessage?chat_id=966649672

Extracted

Family

  • lumma

C2

  • https://deicedosmzj.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect Xworm Payload 4 IoCs
  • Detects ZharkBot payload 1 IoCs

    ZharkBot is a botnet written C++.

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 14 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • ZharkBot

    ZharkBot is a botnet written C++.

    botnetzharkbot
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 4 IoCs
  • Executes dropped EXE 25 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 33 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates processes with tasklist 1 TTPs 6 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 8 IoCs
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 59 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 8 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 26 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1164
      • C:\Users\Admin\AppData\Local\Temp\1dfe9d71e389b57e6b96838ab9ccab1948034fe0346ba85ca9709cea484c213c.exe
        "C:\Users\Admin\AppData\Local\Temp\1dfe9d71e389b57e6b96838ab9ccab1948034fe0346ba85ca9709cea484c213c.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2552
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2872
          • C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
            "C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1628
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2012
          • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
            "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2992
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1980
              • C:\Users\Admin\AppData\Roaming\kvAoF5FibC.exe
                "C:\Users\Admin\AppData\Roaming\kvAoF5FibC.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1704
              • C:\Users\Admin\AppData\Roaming\HCGgfuYyvU.exe
                "C:\Users\Admin\AppData\Roaming\HCGgfuYyvU.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:3040
          • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe
            "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            PID:1008
          • C:\Users\Admin\AppData\Local\Temp\1000129001\clcs.exe
            "C:\Users\Admin\AppData\Local\Temp\1000129001\clcs.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            PID:2336
          • C:\Users\Admin\AppData\Local\Temp\1000135001\14082024.exe
            "C:\Users\Admin\AppData\Local\Temp\1000135001\14082024.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2816
          • C:\Users\Admin\AppData\Local\Temp\1000147001\BattleGermany.exe
            "C:\Users\Admin\AppData\Local\Temp\1000147001\BattleGermany.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1752
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k move Cassette Cassette.cmd & Cassette.cmd & exit
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:836
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:920
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "wrsa.exe opssvc.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1584
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:952
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1840
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 177479
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2468
              • C:\Windows\SysWOW64\findstr.exe
                findstr /V "FoolBurkeRetainedWait" Drop
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2588
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b ..\Tracked + ..\Luggage + ..\Prime + ..\Involved + ..\Fluid + ..\Newport + ..\Rod + ..\Society s
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2284
              • C:\Users\Admin\AppData\Local\Temp\177479\Community.pif
                Community.pif s
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2232
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /c schtasks.exe /create /tn "Capable" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1548
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks.exe /create /tn "Capable" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                    8⤵
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:1220
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks.exe /create /tn "SkyPilot" /tr "wscript //B 'C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js'" /sc onlogon /F /RL HIGHEST
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:2640
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3008
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2132
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1876
              • C:\Windows\SysWOW64\choice.exe
                choice /d y /t 15
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2524
          • C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe
            "C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:928
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k move Continues Continues.cmd & Continues.cmd & exit
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2756
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1776
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "wrsa.exe opssvc.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2556
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1344
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2436
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 40365
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2796
              • C:\Windows\SysWOW64\findstr.exe
                findstr /V "HopeBuildersGeniusIslam" Sonic
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2688
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b ..\Mr + ..\Minister + ..\Template + ..\Dietary + ..\Speak + ..\Mobile + ..\Zinc + ..\Continue s
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2860
              • C:\Users\Admin\AppData\Local\Temp\40365\Beijing.pif
                Beijing.pif s
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:1608
              • C:\Windows\SysWOW64\choice.exe
                choice /d y /t 5
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2180
          • C:\Users\Admin\AppData\Local\Temp\1000157001\coreplugin.exe
            "C:\Users\Admin\AppData\Local\Temp\1000157001\coreplugin.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2808
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k move Anytime Anytime.cmd & Anytime.cmd & exit
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1708
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1704
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "wrsa.exe opssvc.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2152
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2024
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2732
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 297145
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1388
              • C:\Windows\SysWOW64\findstr.exe
                findstr /V "CorkBkConditionsMoon" Scary
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2820
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b ..\Dependence + ..\Nsw + ..\Developmental + ..\Shared + ..\Ranges + ..\Notify + ..\Pending + ..\Previously k
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1188
              • C:\Users\Admin\AppData\Local\Temp\297145\Cultures.pif
                Cultures.pif k
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:1852
              • C:\Windows\SysWOW64\choice.exe
                choice /d y /t 5
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1692
          • C:\Users\Admin\AppData\Local\Temp\1000162001\Indentif.exe
            "C:\Users\Admin\AppData\Local\Temp\1000162001\Indentif.exe"
            4⤵
            • Executes dropped EXE
            PID:1208
          • C:\Users\Admin\AppData\Local\Temp\1000167001\crypted8888.exe
            "C:\Users\Admin\AppData\Local\Temp\1000167001\crypted8888.exe"
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:492
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:2288
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 820
                6⤵
                • Program crash
                PID:1772
          • C:\Users\Admin\AppData\Local\Temp\1000169001\explorer.exe
            "C:\Users\Admin\AppData\Local\Temp\1000169001\explorer.exe"
            4⤵
            • Drops startup file
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious behavior: AddClipboardFormatListener
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:2428
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\1000169001\explorer.exe'
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:976
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer.exe'
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1188
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\explorer'
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1692
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'explorer'
              5⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2700
            • C:\Windows\System32\schtasks.exe
              "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "explorer" /tr "C:\Users\Admin\explorer"
              5⤵
              • Scheduled Task/Job: Scheduled Task
              PID:640
          • C:\Users\Admin\AppData\Local\Temp\1000170001\LummaC22222.exe
            "C:\Users\Admin\AppData\Local\Temp\1000170001\LummaC22222.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2032
          • C:\Users\Admin\AppData\Local\Temp\1000174001\5PHCENYBS068Y01.exe
            "C:\Users\Admin\AppData\Local\Temp\1000174001\5PHCENYBS068Y01.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2688
            • C:\Users\Admin\AppData\Local\Temp\onefile_2688_133688397259076000\stub.exe
              C:\Users\Admin\AppData\Local\Temp\1000174001\5PHCENYBS068Y01.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:684
          • C:\Users\Admin\AppData\Local\Temp\1000179001\SеtuÑ€111.exe
            "C:\Users\Admin\AppData\Local\Temp\1000179001\Sеtuр111.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            PID:2552
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 396
              5⤵
              • Loads dropped DLL
              • Program crash
              PID:392
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c schtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F
        2⤵
        • System Location Discovery: System Language Discovery
        PID:940
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks.exe /create /tn "Invitations" /tr "wscript //B 'C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js'" /sc minute /mo 5 /F
          3⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:1544
      • C:\Windows\SysWOW64\cmd.exe
        cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & echo URL="C:\Users\Admin\AppData\Local\NeuraMind Innovations\MindLynx.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MindLynx.url" & exit
        2⤵
        • Drops startup file
        • System Location Discovery: System Language Discovery
        PID:2768
      • C:\Users\Admin\AppData\Local\Temp\297145\Cultures.pif
        C:\Users\Admin\AppData\Local\Temp\297145\Cultures.pif
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1416
    • C:\Windows\system32\taskeng.exe
      taskeng.exe {132299BF-1AAC-4564-81D5-74E769171661} S-1-5-21-940600906-3464502421-4240639183-1000:MGWWAYYN\Admin:Interactive:[1]
      1⤵
        PID:2216
        • C:\Users\Admin\explorer
          C:\Users\Admin\explorer
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2140
        • C:\Users\Admin\explorer
          C:\Users\Admin\explorer
          2⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2180
        • C:\Windows\system32\wscript.EXE
          C:\Windows\system32\wscript.EXE //B "C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.js"
          2⤵
            PID:904
            • C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.pif
              "C:\Users\Admin\AppData\Local\SkyNav Technologies\SkyPilot.pif" "C:\Users\Admin\AppData\Local\SkyNav Technologies\D"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              PID:352

        Network

              MITRE ATT&CK Enterprise v15

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              2
              T1059

              JavaScript

              1
              T1059.007

              PowerShell

              1
              T1059.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Persistence

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Privilege Escalation

              Boot or Logon Autostart Execution

              1
              T1547

              Registry Run Keys / Startup Folder

              1
              T1547.001

              Scheduled Task/Job

              1
              T1053

              Scheduled Task

              1
              T1053.005

              Defense Evasion

              Modify Registry

              2
              T1112

              Subvert Trust Controls

              1
              T1553

              Install Root Certificate

              1
              T1553.004

              Virtualization/Sandbox Evasion

              2
              T1497

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              4
              T1552

              Credentials In Files

              4
              T1552.001

              Discovery

              Process Discovery

              1
              T1057

              Query Registry

              6
              T1012

              System Information Discovery

              3
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              Virtualization/Sandbox Evasion

              2
              T1497

              Lateral Movement

              Collection

              Data from Local System

              3
              T1005

              Command and Control

              Exfiltration

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              GOLD.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000002001\GOLD.exe
              • Size 323KB
              • SHA256 74e0bf30c9107fa716920c878521037db3ca4eeda5c14d745a2459eb14d1190e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              crypteda.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
              • Size 1.1MB
              • SHA256 d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              kitty.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000064001\kitty.exe
              • Size 319KB
              • SHA256 4c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              stealc_default.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default.exe
              • Size 187KB
              • SHA256 80befdb25413d68adbadd8f236a2e8c71b261d8befc04c99749e778b07bcde89
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              clcs.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000129001\clcs.exe
              • Size 6.3MB
              • SHA256 29036a1125ac5f5b8a4bfb794fa965efd1f5e24853db3fa901b17d96ba901ca8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              14082024.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000135001\14082024.exe
              • Size 304KB
              • SHA256 17b71b1895978b7aaf5a0184948e33ac3d70ce979030d5a9a195a1c256f6b368
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              BattleGermany.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000147001\BattleGermany.exe
              • Size 8.3MB
              • SHA256 7636d2367079eabd9da2bb40935df3da580affc47473fd93ed3b2e01ee6c46e5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              runtime.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000150001\runtime.exe
              • Size 1.1MB
              • SHA256 fbb957b3e36ba1dda0b65986117fd8555041d747810a100b47da4a90a1dfd693
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              coreplugin.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000157001\coreplugin.exe
              • Size 1.1MB
              • SHA256 a221b40667002cd19eece4e45e5dbb6f3c3dc1890870cf28ebcca0e4850102f5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Indentif.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000162001\Indentif.exe
              • Size 7.4MB
              • SHA256 d52015fab106cf0c3b2b290f5234e15d966a9adc779c20268789e24f715f9e84
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              crypted8888.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000167001\crypted8888.exe
              • Size 208KB
              • SHA256 bf4f27f6932ce75b1746f5364af3abacbdafa59913da513a168d86ea0ad3a3a4
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              explorer.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000169001\explorer.exe
              • Size 87KB
              • SHA256 3d8b1b6802f265ff8eb229c38ff81824f3652f271eb97b7bfef86db369902a08
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              LummaC22222.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000170001\LummaC22222.exe
              • Size 258KB
              • SHA256 7fdd7da7975da141ab5a48b856d24fba2ff35f52ad071119f6a83548494ba816
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              5PHCENYBS068Y01.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000174001\5PHCENYBS068Y01.exe
              • Size 10.5MB
              • SHA256 7870eda6f78bde1ea7c083ddf32a9aabd118b30f6b8617f4b9e6625edba0ff95
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Sеtuр111.exe
              • Path C:\Users\Admin\AppData\Local\Temp\1000179001\SеtuÑ€111.exe
              • Size 6.4MB
              • SHA256 3a79351bd8099a518ecb4258aacecc84f7ed44cf67426b482b7583ce20c17e4e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Community.pif
              • Path C:\Users\Admin\AppData\Local\Temp\177479\Community.pif
              • Size 872KB
              • SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              s
              • Path C:\Users\Admin\AppData\Local\Temp\177479\s
              • Size 550KB
              • SHA256 2dec1a0fd2bc8d3e538484d0c8914fbf3306ee9bec35afeabf9cee4104e1df8d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              s
              • Path C:\Users\Admin\AppData\Local\Temp\40365\s
              • Size 554KB
              • SHA256 ff64ae2a70b07eba7678241a8fa20f3569a03cc5cdc087306a4451acd97ee2db
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              axplong.exe
              • Path C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
              • Size 1.9MB
              • SHA256 1dfe9d71e389b57e6b96838ab9ccab1948034fe0346ba85ca9709cea484c213c
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              CabB849.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\CabB849.tmp
              • Size 70KB
              • SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Cassette
              • Path C:\Users\Admin\AppData\Local\Temp\Cassette
              • Size 6KB
              • SHA256 cd27421f2758e883e53d498e3fafba2b519688c1f482489d51ad75a4fbff3b5f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Continue
              • Path C:\Users\Admin\AppData\Local\Temp\Continue
              • Size 31KB
              • SHA256 a8181f349864c6c9a216935894392b75d0d1430d43a255ff3a9ad56c325487e7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Continues
              • Path C:\Users\Admin\AppData\Local\Temp\Continues
              • Size 14KB
              • SHA256 e04a1b86ce1a5352f7c3a5ddb8b500993f4342ef4e188ed156009e5271795af1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Corresponding
              • Path C:\Users\Admin\AppData\Local\Temp\Corresponding
              • Size 871KB
              • SHA256 fa349d460b066e9b325db200251ae35892353462c352728cfb0fa405c293f725
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Dietary
              • Path C:\Users\Admin\AppData\Local\Temp\Dietary
              • Size 89KB
              • SHA256 6d86469ced96b57db84de11f9eac77c8076a3bfa65942776f7cc50625fbd31ca
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Drop
              • Path C:\Users\Admin\AppData\Local\Temp\Drop
              • Size 241B
              • SHA256 73bdf5cf3e6b23be2ad017516c63467578798c5c9b92923ac5a85fad74687505
              • MD5 SHA1 SHA512
              Submit Download

              Fluid
              • Path C:\Users\Admin\AppData\Local\Temp\Fluid
              • Size 77KB
              • SHA256 ee0d0d10a8e626b9ba71378297dc13dd0cc1f5814d505524be75a9b4cbf2e703
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Involved
              • Path C:\Users\Admin\AppData\Local\Temp\Involved
              • Size 92KB
              • SHA256 b32582f214374b6358e389038419f16912a4812fb139492677870b7cbd0fa00e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Luggage
              • Path C:\Users\Admin\AppData\Local\Temp\Luggage
              • Size 59KB
              • SHA256 73b17516142e6f26d6eec9da8e1700268175cfacb62303fb8b3ea073afa035c5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Minister
              • Path C:\Users\Admin\AppData\Local\Temp\Minister
              • Size 98KB
              • SHA256 526b6cbf430fc40eb8d23cd2c4ee1c81e04a2c9e01167370527f19465f67c452
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Mobile
              • Path C:\Users\Admin\AppData\Local\Temp\Mobile
              • Size 76KB
              • SHA256 08e8e54417a8e7007aeedb0399f4e549fc31aaf6031416c8d30306fe350c1f84
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Mr
              • Path C:\Users\Admin\AppData\Local\Temp\Mr
              • Size 86KB
              • SHA256 5defb1b1225282e2ab46d4257416334b5344e5b0a020b4b7900436c59684de65
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Newport
              • Path C:\Users\Admin\AppData\Local\Temp\Newport
              • Size 81KB
              • SHA256 f261f507e779e7ec2b5580e7ebcc48024253f02b4478bad30020080c68241a9b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Prime
              • Path C:\Users\Admin\AppData\Local\Temp\Prime
              • Size 58KB
              • SHA256 a93408df366ea9bb432d6ee58b995b829193acad7790b4e2c7714aa4cf7676bb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Rod
              • Path C:\Users\Admin\AppData\Local\Temp\Rod
              • Size 78KB
              • SHA256 2933796e3bee9cea7fcce9a06adc6260b02a1b6e2822e631d1a8cbe3c9948ede
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Society
              • Path C:\Users\Admin\AppData\Local\Temp\Society
              • Size 32KB
              • SHA256 169770a72d10369cc74decc8f5b9730f533772675021d17b66f62b9180f40aea
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Sonic
              • Path C:\Users\Admin\AppData\Local\Temp\Sonic
              • Size 982B
              • SHA256 fc6ba37a8bfe546d8186e92c2f729080b00d4371ef2e8e3a18ec66acc1cf199e
              • MD5 SHA1 SHA512
              Submit Download

              Speak
              • Path C:\Users\Admin\AppData\Local\Temp\Speak
              • Size 55KB
              • SHA256 93ddbcd9109129656049162e3f6a8d9fffdc5a3da262e0a2bf2bc4624014f7b0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Strikes
              • Path C:\Users\Admin\AppData\Local\Temp\Strikes
              • Size 872KB
              • SHA256 f1de84e03842252e12584bb031466ddc3070291fdac398ca0f8d000421d34311
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              TarB8C9.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\TarB8C9.tmp
              • Size 181KB
              • SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Template
              • Path C:\Users\Admin\AppData\Local\Temp\Template
              • Size 56KB
              • SHA256 4734d4d0626e140398a788226a5985e814bbd674f4218b60a89fd2da8f4ceb94
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Tmp9CFC.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\Tmp9CFC.tmp
              • Size 2KB
              • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
              • MD5 SHA1 SHA512
              Submit Download

              Tracked
              • Path C:\Users\Admin\AppData\Local\Temp\Tracked
              • Size 73KB
              • SHA256 7f946ec102576eaadf519bed523deec5fe92a69ae849711f446c23b4ae36e886
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Zinc
              • Path C:\Users\Admin\AppData\Local\Temp\Zinc
              • Size 63KB
              • SHA256 dc4aac8b9eb62788bd04316293cde7e3d839e828e3e3082a2d81922ca8a94c81
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              76b53b3ec448f7ccdda2063b15d2bfc3_c13b6b87-25b1-4e34-a420-7feacfe0b8db
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940600906-3464502421-4240639183-1000\76b53b3ec448f7ccdda2063b15d2bfc3_c13b6b87-25b1-4e34-a420-7feacfe0b8db
              • Size 2KB
              • SHA256 513257326e783a862909a2a0f0941d6ff899c403e104fbd1dbc10443c41d9f9a
              • MD5 SHA1 SHA512
              Submit Download

              76b53b3ec448f7ccdda2063b15d2bfc3_c13b6b87-25b1-4e34-a420-7feacfe0b8db
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-940600906-3464502421-4240639183-1000\76b53b3ec448f7ccdda2063b15d2bfc3_c13b6b87-25b1-4e34-a420-7feacfe0b8db
              • Size 2KB
              • SHA256 f23235672cf569431ec7c28ddeeacbef4a573e1bbbab7e84c3c7ac753ede4031
              • MD5 SHA1 SHA512
              Submit Download

              R4YJLDYWSFK7MD6ZXYHV.temp
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\R4YJLDYWSFK7MD6ZXYHV.temp
              • Size 7KB
              • SHA256 b152725d552760e447ee753ad0a923a06286da642e1c5e93f1ce512bc9cbb841
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              kvAoF5FibC.exe
              • Path C:\Users\Admin\AppData\Roaming\kvAoF5FibC.exe
              • Size 544KB
              • SHA256 c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Google Chrome.lnk
              • Path C:\Users\Public\Desktop\Google Chrome.lnk
              • Size 2KB
              • SHA256 c05bedefb25c3049260c7623e41d81b7f8c22cee295b3d99aded27faa52b9cf3
              • MD5 SHA1 SHA512
              Submit Download

              mozglue.dll
              • Path \ProgramData\mozglue.dll
              • Size 593KB
              • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              nss3.dll
              • Path \ProgramData\nss3.dll
              • Size 2.0MB
              • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              HCGgfuYyvU.exe
              • Path \Users\Admin\AppData\Roaming\HCGgfuYyvU.exe
              • Size 304KB
              • SHA256 3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/492-499-0x0000000000B40000-0x0000000000B78000-memory.dmp
              Download

              memory/976-548-0x000000001B5C0000-0x000000001B8A2000-memory.dmp
              Download

              memory/976-549-0x0000000001D20000-0x0000000001D28000-memory.dmp
              Download

              memory/1008-242-0x0000000000A50000-0x0000000000C93000-memory.dmp
              Download

              memory/1008-180-0x0000000000A50000-0x0000000000C93000-memory.dmp
              Download

              memory/1008-181-0x0000000061E00000-0x0000000061EF3000-memory.dmp
              Download

              memory/1188-554-0x000000001B5D0000-0x000000001B8B2000-memory.dmp
              Download

              memory/1188-555-0x0000000002250000-0x0000000002258000-memory.dmp
              Download

              memory/1628-37-0x0000000000B30000-0x0000000000B84000-memory.dmp
              Download

              memory/1704-114-0x0000000000220000-0x00000000002AE000-memory.dmp
              Download

              memory/1876-748-0x00000000000C0000-0x0000000000112000-memory.dmp
              Download

              memory/1980-94-0x0000000000400000-0x000000000050D000-memory.dmp
              Download

              memory/1980-85-0x0000000000400000-0x000000000050D000-memory.dmp
              Download

              memory/1980-98-0x0000000000400000-0x000000000050D000-memory.dmp
              Download

              memory/1980-97-0x0000000000400000-0x000000000050D000-memory.dmp
              Download

              memory/1980-87-0x0000000000400000-0x000000000050D000-memory.dmp
              Download

              memory/1980-84-0x0000000000400000-0x000000000050D000-memory.dmp
              Download

              memory/1980-95-0x0000000000400000-0x000000000050D000-memory.dmp
              Download

              memory/1980-93-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
              Download

              memory/1980-91-0x0000000000400000-0x000000000050D000-memory.dmp
              Download

              memory/1980-89-0x0000000000400000-0x000000000050D000-memory.dmp
              Download

              memory/1980-81-0x0000000000400000-0x000000000050D000-memory.dmp
              Download

              memory/1980-111-0x0000000000400000-0x000000000050D000-memory.dmp
              Download

              memory/2012-39-0x0000000000400000-0x0000000000452000-memory.dmp
              Download

              memory/2012-43-0x0000000000400000-0x0000000000452000-memory.dmp
              Download

              memory/2012-41-0x0000000000400000-0x0000000000452000-memory.dmp
              Download

              memory/2012-48-0x0000000000400000-0x0000000000452000-memory.dmp
              Download

              memory/2012-45-0x0000000000400000-0x0000000000452000-memory.dmp
              Download

              memory/2012-49-0x0000000000400000-0x0000000000452000-memory.dmp
              Download

              memory/2012-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
              Download

              memory/2012-50-0x0000000000400000-0x0000000000452000-memory.dmp
              Download

              memory/2132-715-0x00000000000C0000-0x0000000000112000-memory.dmp
              Download

              memory/2140-709-0x0000000000D50000-0x0000000000D6C000-memory.dmp
              Download

              memory/2180-742-0x0000000000170000-0x000000000018C000-memory.dmp
              Download

              memory/2336-294-0x0000000000400000-0x000000000106A000-memory.dmp
              Download

              memory/2336-296-0x0000000000400000-0x000000000106A000-memory.dmp
              Download

              memory/2428-528-0x00000000012A0000-0x00000000012BC000-memory.dmp
              Download

              memory/2552-2-0x0000000000DF1000-0x0000000000E1F000-memory.dmp
              Download

              memory/2552-5-0x0000000000DF0000-0x00000000012C6000-memory.dmp
              Download

              memory/2552-3-0x0000000000DF0000-0x00000000012C6000-memory.dmp
              Download

              memory/2552-10-0x0000000000DF0000-0x00000000012C6000-memory.dmp
              Download

              memory/2552-0-0x0000000000DF0000-0x00000000012C6000-memory.dmp
              Download

              memory/2552-16-0x0000000000DF0000-0x00000000012C6000-memory.dmp
              Download

              memory/2552-1-0x00000000777C0000-0x00000000777C2000-memory.dmp
              Download

              memory/2552-18-0x0000000006D70000-0x0000000007246000-memory.dmp
              Download

              memory/2816-276-0x00000000009D0000-0x0000000000A22000-memory.dmp
              Download

              memory/2872-261-0x0000000006170000-0x00000000063B3000-memory.dmp
              Download

              memory/2872-219-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-177-0x0000000006170000-0x00000000063B3000-memory.dmp
              Download

              memory/2872-346-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-178-0x0000000006170000-0x00000000063B3000-memory.dmp
              Download

              memory/2872-22-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-20-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-425-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-210-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-214-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-215-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-442-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-19-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-295-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-17-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-291-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-131-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-161-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-132-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-244-0x0000000006170000-0x00000000063B3000-memory.dmp
              Download

              memory/2872-243-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-133-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-64-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-218-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-217-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2872-216-0x00000000009D0000-0x0000000000EA6000-memory.dmp
              Download

              memory/2992-79-0x00000000002C0000-0x00000000003D2000-memory.dmp
              Download

              memory/3008-427-0x0000000000080000-0x00000000000D2000-memory.dmp
              Download

              memory/3008-428-0x0000000000080000-0x00000000000D2000-memory.dmp
              Download

              memory/3008-426-0x0000000000080000-0x00000000000D2000-memory.dmp
              Download

              memory/3040-115-0x0000000000050000-0x00000000000A2000-memory.dmp
              Download