Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    31/08/2024, 23:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2a6948cded36ed003e139d47d55bb2d9993ab5b367e5ab21e28bde3686982588.exe
  • Size 1.8MB
  • Sample240831-23da7a1bmf
  • SHA256 2a6948cded36ed003e139d47d55bb2d9993ab5b367e5ab21e28bde3686982588
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeyasyncratredlinestealczharkbot@cloudytteamdefaultdefault2fed3aalivetrafficbotnetcredential_accessdefense_evasiondiscoveryevasionexecutioninfostealerpersistencepyinstallerratspywarestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 4.41

Botnet

  • fed3aa

C2

  • http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

  • redline

Botnet

  • LiveTraffic

C2

  • 95.179.250.45:26212

Extracted

Family

  • redline

Botnet

  • @CLOUDYTTEAM

C2

  • 65.21.18.51:45580

Extracted

Family

  • stealc

Botnet

  • default2

C2

  • http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

  • asyncrat

Version

  • 0.5.8

Botnet

  • Default

C2

  • 45.200.149.147:4782

Mutex

  • uXnIs7mA0Z5R

Attributes
  • delay

    3

  • install

    false

  • install_file

    javaupdate.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat
  • Detects ZharkBot payload 1 IoCs

    ZharkBot is a botnet written C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • ZharkBot

    ZharkBot is a botnet written C++.

    botnetzharkbot
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 9 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 29 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Indirect Command Execution 1 TTPs 6 IoCs

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

    defense_evasion
  • Loads dropped DLL 18 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Windows directory 3 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2a6948cded36ed003e139d47d55bb2d9993ab5b367e5ab21e28bde3686982588.exe
    "C:\Users\Admin\AppData\Local\Temp\2a6948cded36ed003e139d47d55bb2d9993ab5b367e5ab21e28bde3686982588.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3568
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe
        "C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2740
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:896
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4508
        • C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1304
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3300
            • C:\Users\Admin\AppData\Roaming\WGAP6ASxFm.exe
              "C:\Users\Admin\AppData\Roaming\WGAP6ASxFm.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3396
            • C:\Users\Admin\AppData\Roaming\rV23zx4Zky.exe
              "C:\Users\Admin\AppData\Roaming\rV23zx4Zky.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4920
        • C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
          "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
          3⤵
          • Executes dropped EXE
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1680
          • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
            "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4768
        • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
          "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:4040
        • C:\Users\Admin\AppData\Local\Temp\1000129001\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\1000129001\Setup.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:5024
          • C:\Users\Admin\AppData\Local\Temp\service123.exe
            "C:\Users\Admin\AppData\Local\Temp\service123.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2928
        • C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe
          "C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe"
          3⤵
          • Executes dropped EXE
          PID:3124
        • C:\Users\Admin\AppData\Local\Temp\1000228001\PureSyncInst.exe
          "C:\Users\Admin\AppData\Local\Temp\1000228001\PureSyncInst.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4944
          • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
            "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4936
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4936 -s 1228
              5⤵
              • Program crash
              PID:4420
        • C:\Users\Admin\1000238002\Amadeus.exe
          "C:\Users\Admin\1000238002\Amadeus.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:952
          • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
            "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:3024
        • C:\Users\Admin\AppData\Local\Temp\1000239001\runtime.exe
          "C:\Users\Admin\AppData\Local\Temp\1000239001\runtime.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          PID:4192
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4048
            • C:\Users\Admin\AppData\Local\Temp\1000255001\channel2.exe
              "C:\Users\Admin\AppData\Local\Temp\1000255001\channel2.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:4940
            • C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe
              "C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe"
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:3128
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:576
            • C:\Users\Admin\AppData\Local\Temp\1000260001\Channel1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000260001\Channel1.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:1536
            • C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe
              "C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1580
              • C:\Users\Admin\AppData\Local\Temp\7zS816B.tmp\Install.exe
                .\Install.exe
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3004
                • C:\Users\Admin\AppData\Local\Temp\7zS83AD.tmp\Install.exe
                  .\Install.exe /CtlLXdidO "385107" /S
                  7⤵
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Enumerates system info in registry
                  PID:1840
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    8⤵
                    • System Location Discovery: System Language Discovery
                    PID:2996
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                      9⤵
                      • Indirect Command Execution
                      • System Location Discovery: System Language Discovery
                      PID:4628
                      • C:\Windows\SysWOW64\cmd.exe
                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:2552
                        • \??\c:\windows\SysWOW64\reg.exe
                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                          11⤵
                          • System Location Discovery: System Language Discovery
                          PID:5104
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                      9⤵
                      • Indirect Command Execution
                      • System Location Discovery: System Language Discovery
                      PID:1408
                      • C:\Windows\SysWOW64\cmd.exe
                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:2108
                        • \??\c:\windows\SysWOW64\reg.exe
                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                          11⤵
                          • System Location Discovery: System Language Discovery
                          PID:3756
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                      9⤵
                      • Indirect Command Execution
                      • System Location Discovery: System Language Discovery
                      PID:2340
                      • C:\Windows\SysWOW64\cmd.exe
                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:2376
                        • \??\c:\windows\SysWOW64\reg.exe
                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                          11⤵
                          • System Location Discovery: System Language Discovery
                          PID:224
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                      9⤵
                      • Indirect Command Execution
                      • System Location Discovery: System Language Discovery
                      PID:1460
                      • C:\Windows\SysWOW64\cmd.exe
                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:3712
                        • \??\c:\windows\SysWOW64\reg.exe
                          reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                          11⤵
                          • System Location Discovery: System Language Discovery
                          PID:3584
                    • C:\Windows\SysWOW64\forfiles.exe
                      forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                      9⤵
                      • Indirect Command Execution
                      • System Location Discovery: System Language Discovery
                      PID:4288
                      • C:\Windows\SysWOW64\cmd.exe
                        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                        10⤵
                        • System Location Discovery: System Language Discovery
                        PID:3900
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                          11⤵
                          • Command and Scripting Interpreter: PowerShell
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3448
                          • C:\Windows\SysWOW64\gpupdate.exe
                            "C:\Windows\system32\gpupdate.exe" /force
                            12⤵
                            • System Location Discovery: System Language Discovery
                            PID:3468
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    8⤵
                    • Indirect Command Execution
                    • System Location Discovery: System Language Discovery
                    PID:1816
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      9⤵
                      • System Location Discovery: System Language Discovery
                      PID:5100
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                        10⤵
                        • Command and Scripting Interpreter: PowerShell
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3476
                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          11⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3408
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "bISIDNXXYteSJEZXLD" /SC once /ST 23:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS83AD.tmp\Install.exe\" W7 /kFhqdidCBs 385107 /S" /V1 /F
                    8⤵
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Scheduled Task/Job: Scheduled Task
                    PID:4896
            • C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe
              "C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:764
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 764 -s 508
                6⤵
                • Program crash
                PID:1936
            • C:\Users\Admin\AppData\Local\Temp\1000277001\ovrflw.exe
              "C:\Users\Admin\AppData\Local\Temp\1000277001\ovrflw.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:3492
              • C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
                "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:4712
            • C:\Users\Admin\AppData\Local\Temp\1000278001\dropper.exe
              "C:\Users\Admin\AppData\Local\Temp\1000278001\dropper.exe"
              5⤵
              • Executes dropped EXE
              PID:2036
              • C:\Users\Admin\AppData\Local\Temp\1000278001\dropper.exe
                "C:\Users\Admin\AppData\Local\Temp\1000278001\dropper.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2376
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\tmpsii0ucsd.bat"
                  7⤵
                    PID:4832
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic diskdrive get Model
                      8⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4588
                    • C:\Windows\system32\findstr.exe
                      findstr /i "DADY HARDDISK QEMU HARDDISK WDC WDS100T2B0A"
                      8⤵
                        PID:1992
            • C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe
              "C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4964
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          PID:3656
        • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
          1⤵
          • Executes dropped EXE
          PID:5008
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4936 -ip 4936
          1⤵
            PID:800
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3024 -ip 3024
            1⤵
              PID:4636
            • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
              C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
              1⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:3264
            • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              1⤵
              • Executes dropped EXE
              PID:1400
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 764 -ip 764
              1⤵
                PID:3464

              Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Indirect Command Execution

                    1
                    T1202

                    Modify Registry

                    2
                    T1112

                    Subvert Trust Controls

                    1
                    T1553

                    Install Root Certificate

                    1
                    T1553.004

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Unsecured Credentials

                    4
                    T1552

                    Credentials In Files

                    4
                    T1552.001

                    Discovery

                    Query Registry

                    6
                    T1012

                    System Information Discovery

                    4
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Lateral Movement

                    Collection

                    Data from Local System

                    3
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    mozglue.dll
                    • Path C:\ProgramData\mozglue.dll
                    • Size 593KB
                    • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    nss3.dll
                    • Path C:\ProgramData\nss3.dll
                    • Size 2.0MB
                    • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Amadeus.exe
                    • Path C:\Users\Admin\1000238002\Amadeus.exe
                    • Size 5.3MB
                    • SHA256 a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    powershell.exe.log
                    • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                    • Size 1KB
                    • SHA256 6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425
                    • MD5 SHA1 SHA512
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 15KB
                    • SHA256 73d7626e51011353fc476476ee3417df207701d6363ce685aaad368b61054d27
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    crypted.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe
                    • Size 314KB
                    • SHA256 414becb8aabd4e8c406e84df062bee1a45cffa334ae30022078cfa71da9e330d
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    crypteda.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
                    • Size 1.1MB
                    • SHA256 d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Nework.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
                    • Size 416KB
                    • SHA256 2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    stealc_default2.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                    • Size 187KB
                    • SHA256 836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Setup.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000129001\Setup.exe
                    • Size 6.4MB
                    • SHA256 33a7fabaceac3e73239ced3eec7c67fa0f17987e4d03fef30161b06564f6d8f9
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    BitcoinCore.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe
                    • Size 13.0MB
                    • SHA256 f1ecef25154188e919750404135580041edd3b9e608ff8ca311199e1fa11c912
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    PureSyncInst.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000228001\PureSyncInst.exe
                    • Size 9.2MB
                    • SHA256 33d866c385c3d05981986f7e3d56eac4966821813d216670d37aa7af7c30d62c
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    runtime.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000239001\runtime.exe
                    • Size 539KB
                    • SHA256 ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    build.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000241001\build.exe
                    • Size 413KB
                    • SHA256 9998d38b192309056d5109ac27a8b13f2b36fc27bac9ebdf5385452b2c1b0cdb
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    channel2.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000255001\channel2.exe
                    • Size 6.3MB
                    • SHA256 0309d52f0c55715859aab3552dff19bc8529cb48e95576ad3d979b0154390609
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    BowExpert.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000256001\BowExpert.exe
                    • Size 2.4MB
                    • SHA256 62919dc688726421395003025abf1bbcd405048fb5b7c544139a538e5bdc45b0
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Channel1.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000260001\Channel1.exe
                    • Size 6.3MB
                    • SHA256 ed8342a9e176e5aad2554216077fc94b9bf541acfb518736bdc1883630da159e
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    385107.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000262001\385107.exe
                    • Size 7.3MB
                    • SHA256 cafae0c470a14a3290a2fcd8dfd923ea474b877c236cf84eba1eecf39e458b2f
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    kitty.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe
                    • Size 319KB
                    • SHA256 4c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    dropper.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\1000278001\dropper.exe
                    • Size 8.1MB
                    • SHA256 39be0d9e62066bd79cbce3416f41776c8e36146cf8f729af61bbb49c800c13f4
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    axplong.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                    • Size 1.8MB
                    • SHA256 2a6948cded36ed003e139d47d55bb2d9993ab5b367e5ab21e28bde3686982588
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    761892313337
                    • Path C:\Users\Admin\AppData\Local\Temp\761892313337
                    • Size 78KB
                    • SHA256 acc97767d9598a83752b91117c3fa9bfc9b5d96de13f9026b2ec901eb573f272
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Install.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\7zS816B.tmp\Install.exe
                    • Size 6.4MB
                    • SHA256 e14b223c0d62833c0a4c4c136fd3b75a9a6a76d7f1b52f3efc6042c38fa7b0b5
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Install.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\7zS83AD.tmp\Install.exe
                    • Size 6.7MB
                    • SHA256 26f9eafb7869a2bfa9af2ede0363c2a41af6839c4263f6c107ab723de9dd2e37
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    TmpB277.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\TmpB277.tmp
                    • Size 2KB
                    • SHA256 f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9
                    • MD5 SHA1 SHA512
                    Submit Download

                    VCRUNTIME140.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\VCRUNTIME140.dll
                    • Size 116KB
                    • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    python312.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\_MEI20362\python312.dll
                    • Size 6.6MB
                    • SHA256 8ad53c67c2b4db4387d5f72ee2a3ca80c40af444b22bf41a6cfda2225a27bb93
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    __PSScriptPolicyTest_sdog2b2c.ylx.ps1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sdog2b2c.ylx.ps1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512
                    Submit Download

                    76b53b3ec448f7ccdda2063b15d2bfc3_1a4dc33f-c784-4d28-8db2-389663d94aeb
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3761892313-3378554128-2287991803-1000\76b53b3ec448f7ccdda2063b15d2bfc3_1a4dc33f-c784-4d28-8db2-389663d94aeb
                    • Size 2KB
                    • SHA256 f9b3b7b440faef68ffebcb49aac02d6fd4d4824da430c893d5b43ef552279a36
                    • MD5 SHA1 SHA512
                    Submit Download

                    WGAP6ASxFm.exe
                    • Path C:\Users\Admin\AppData\Roaming\WGAP6ASxFm.exe
                    • Size 544KB
                    • SHA256 c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    rV23zx4Zky.exe
                    • Path C:\Users\Admin\AppData\Roaming\rV23zx4Zky.exe
                    • Size 304KB
                    • SHA256 3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0
                    • MD5 SHA1 SHA512 SSDEEP
                    Submit Download

                    Microsoft Edge.lnk
                    • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
                    • Size 2KB
                    • SHA256 4dc3c62597461ffcf8ba29dc8ec65361b4ceb86a004ba03a5cabab724d117c5c
                    • MD5 SHA1 SHA512
                    Submit Download

                    Google Chrome.lnk
                    • Path C:\Users\Public\Desktop\Google Chrome.lnk
                    • Size 2KB
                    • SHA256 036f1cf1929d43398566c74ff519b4b378201f9d1b455f33a00f761ed9e1da11
                    • MD5 SHA1 SHA512
                    Submit Download

                    memory/576-628-0x0000000000390000-0x00000000003A2000-memory.dmp
                    Download

                    memory/576-652-0x0000000005010000-0x00000000050AC000-memory.dmp
                    Download

                    memory/1304-93-0x0000000000260000-0x0000000000372000-memory.dmp
                    Download

                    memory/1840-593-0x00000000002D0000-0x0000000000981000-memory.dmp
                    Download

                    memory/1840-723-0x00000000002D0000-0x0000000000981000-memory.dmp
                    Download

                    memory/2620-323-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/2620-19-0x0000000000AE1000-0x0000000000B0F000-memory.dmp
                    Download

                    memory/2620-21-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/2620-20-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/2620-186-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/2620-377-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/2620-188-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/2620-261-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/2620-344-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/2620-16-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/2620-197-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/2620-288-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/2740-43-0x0000000000790000-0x00000000007E4000-memory.dmp
                    Download

                    memory/2740-42-0x000000007278E000-0x000000007278F000-memory.dmp
                    Download

                    memory/2928-378-0x0000000000090000-0x00000000000A1000-memory.dmp
                    Download

                    memory/2928-379-0x0000000072F00000-0x000000007303C000-memory.dmp
                    Download

                    memory/3124-316-0x0000000140000000-0x00000001402B1000-memory.dmp
                    Download

                    memory/3124-321-0x0000000140000000-0x00000001402B1000-memory.dmp
                    Download

                    memory/3124-313-0x0000000140000000-0x00000001402B1000-memory.dmp
                    Download

                    memory/3124-314-0x0000000140000000-0x00000001402B1000-memory.dmp
                    Download

                    memory/3124-333-0x0000000000400000-0x0000000001121000-memory.dmp
                    Download

                    memory/3124-307-0x0000000140000000-0x00000001402B1000-memory.dmp
                    Download

                    memory/3124-345-0x0000000140000000-0x00000001402B1000-memory.dmp
                    Download

                    memory/3124-325-0x0000000140000000-0x00000001402B1000-memory.dmp
                    Download

                    memory/3124-320-0x0000000140000000-0x00000001402B1000-memory.dmp
                    Download

                    memory/3124-319-0x0000000140000000-0x00000001402B1000-memory.dmp
                    Download

                    memory/3124-318-0x0000000140000000-0x00000001402B1000-memory.dmp
                    Download

                    memory/3124-317-0x0000000140000000-0x00000001402B1000-memory.dmp
                    Download

                    memory/3124-315-0x0000000140000000-0x00000001402B1000-memory.dmp
                    Download

                    memory/3264-529-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/3264-531-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/3300-99-0x0000000000400000-0x000000000050D000-memory.dmp
                    Download

                    memory/3300-97-0x0000000000400000-0x000000000050D000-memory.dmp
                    Download

                    memory/3300-100-0x0000000000400000-0x000000000050D000-memory.dmp
                    Download

                    memory/3300-95-0x0000000000400000-0x000000000050D000-memory.dmp
                    Download

                    memory/3300-120-0x0000000000400000-0x000000000050D000-memory.dmp
                    Download

                    memory/3396-125-0x0000000000390000-0x000000000041E000-memory.dmp
                    Download

                    memory/3448-614-0x0000000005510000-0x0000000005532000-memory.dmp
                    Download

                    memory/3448-624-0x0000000005700000-0x0000000005A57000-memory.dmp
                    Download

                    memory/3448-630-0x0000000006070000-0x000000000608A000-memory.dmp
                    Download

                    memory/3448-631-0x00000000060C0000-0x00000000060E2000-memory.dmp
                    Download

                    memory/3448-613-0x0000000004D70000-0x000000000539A000-memory.dmp
                    Download

                    memory/3448-615-0x00000000055B0000-0x0000000005616000-memory.dmp
                    Download

                    memory/3448-626-0x0000000005C80000-0x0000000005CCC000-memory.dmp
                    Download

                    memory/3448-612-0x0000000004700000-0x0000000004736000-memory.dmp
                    Download

                    memory/3448-625-0x0000000005B90000-0x0000000005BAE000-memory.dmp
                    Download

                    memory/3448-629-0x0000000006B60000-0x0000000006BF6000-memory.dmp
                    Download

                    memory/3476-648-0x0000000006470000-0x00000000064BC000-memory.dmp
                    Download

                    memory/3568-4-0x0000000000840000-0x0000000000CD8000-memory.dmp
                    Download

                    memory/3568-3-0x0000000000840000-0x0000000000CD8000-memory.dmp
                    Download

                    memory/3568-18-0x0000000000840000-0x0000000000CD8000-memory.dmp
                    Download

                    memory/3568-0-0x0000000000840000-0x0000000000CD8000-memory.dmp
                    Download

                    memory/3568-2-0x0000000000841000-0x000000000086F000-memory.dmp
                    Download

                    memory/3568-1-0x0000000076EE6000-0x0000000076EE8000-memory.dmp
                    Download

                    memory/3656-335-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/3656-342-0x0000000000AE0000-0x0000000000F78000-memory.dmp
                    Download

                    memory/4040-202-0x0000000061E00000-0x0000000061EF3000-memory.dmp
                    Download

                    memory/4040-287-0x0000000000EE0000-0x0000000001123000-memory.dmp
                    Download

                    memory/4040-187-0x0000000000EE0000-0x0000000001123000-memory.dmp
                    Download

                    memory/4192-432-0x000000001CF40000-0x000000001CFB0000-memory.dmp
                    Download

                    memory/4192-431-0x000000001CD80000-0x000000001CE02000-memory.dmp
                    Download

                    memory/4192-430-0x0000000000ED0000-0x0000000000F5E000-memory.dmp
                    Download

                    memory/4508-50-0x0000000004E10000-0x0000000004EA2000-memory.dmp
                    Download

                    memory/4508-200-0x0000000009030000-0x0000000009080000-memory.dmp
                    Download

                    memory/4508-67-0x00000000060F0000-0x000000000610E000-memory.dmp
                    Download

                    memory/4508-189-0x00000000064E0000-0x0000000006546000-memory.dmp
                    Download

                    memory/4508-51-0x0000000004EB0000-0x0000000004EBA000-memory.dmp
                    Download

                    memory/4508-70-0x0000000006A80000-0x0000000007098000-memory.dmp
                    Download

                    memory/4508-71-0x0000000008240000-0x000000000834A000-memory.dmp
                    Download

                    memory/4508-72-0x00000000069B0000-0x00000000069C2000-memory.dmp
                    Download

                    memory/4508-73-0x0000000006A10000-0x0000000006A4C000-memory.dmp
                    Download

                    memory/4508-192-0x00000000090C0000-0x0000000009282000-memory.dmp
                    Download

                    memory/4508-74-0x0000000008350000-0x000000000839C000-memory.dmp
                    Download

                    memory/4508-66-0x0000000005380000-0x00000000053F6000-memory.dmp
                    Download

                    memory/4508-193-0x00000000097C0000-0x0000000009CEC000-memory.dmp
                    Download

                    memory/4508-49-0x0000000005490000-0x0000000005A36000-memory.dmp
                    Download

                    memory/4508-46-0x0000000000400000-0x0000000000452000-memory.dmp
                    Download

                    memory/4920-124-0x0000000000100000-0x0000000000152000-memory.dmp
                    Download

                    memory/4964-466-0x0000000000970000-0x00000000009DE000-memory.dmp
                    Download

                    memory/4964-472-0x0000000008760000-0x00000000087AC000-memory.dmp
                    Download

                    memory/5024-322-0x0000000000400000-0x000000000106C000-memory.dmp
                    Download

                    memory/5024-286-0x0000000000400000-0x000000000106C000-memory.dmp
                    Download

                    memory/5024-356-0x0000000000400000-0x000000000106C000-memory.dmp
                    Download