amadey | 4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
31-08-2024 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe
Size

1.9MB
MD5

c2f02a32a9117e64de874c5faad5d8a2
SHA1

a6c458a38de8b2d717378e210e94bad516b7a851
SHA256

4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b
SHA512

a78c4987d43f899d0272be31c7148daa1aa6f3e72ca1cff6a6a158b17cd91fde401d2a10085c2d5f57bfe77c3d80182f9ab3394738460620e5ed094117fc38c8
SSDEEP

49152:rF0t7qvgKmmsKQ8zTHz9DPFOsQt0mnSsXp:rWqoEhQAz3Ott0YSsZ

Score

10^/10

amadey redline stealc zharkbot @cloudytteam default2 fed3aa livetraffic botnet credential_access discovery evasion execution infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

95.179.250.45:26212

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects ZharkBot payload 1 IoCs

ZharkBot is a botnet written C++.

resource	yara_rule
behavioral1/files/0x000600000001a062-4425.dat	zharkcore

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 7 IoCs

resource	yara_rule
behavioral1/memory/1444-45-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/1444-50-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/1444-47-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/1444-52-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/1444-53-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/files/0x0006000000018bb0-114.dat	family_redline
behavioral1/memory/824-115-0x0000000001010000-0x0000000001062000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc
ZharkBot
ZharkBot is a botnet written C++.
botnet zharkbot
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
904	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Executes dropped EXE 18 IoCs

pid	Process
2752	axplong.exe
1940	crypted.exe
2796	crypteda.exe
780	BITD0CpGo8.exe
824	8jaWFM5q5r.exe
308	Nework.exe
3064	Hkbsse.exe
844	stealc_default2.exe
1600	joffer2.exe
2036	caesium-image-compressor.exe
2368	BitcoinCore.exe
940	service123.exe
2840	PureSyncInst.exe
2220	Amadeus.exe
2772	52i.exe
5048	runtime.exe
1460	kitty.exe
3688	TypeId.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Wine	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Wine	axplong.exe

Loads dropped DLL 30 IoCs

pid	Process
2956	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe
2752	axplong.exe
2752	axplong.exe
584	RegAsm.exe
584	RegAsm.exe
2752	axplong.exe
308	Nework.exe
2752	axplong.exe
2752	axplong.exe
3064	Hkbsse.exe
3064	Hkbsse.exe
2752	axplong.exe
844	stealc_default2.exe
844	stealc_default2.exe
2752	axplong.exe
2752	axplong.exe
1600	joffer2.exe
1600	joffer2.exe
940	service123.exe
2752	axplong.exe
2752	axplong.exe
2220	Amadeus.exe
2752	axplong.exe
2220	Amadeus.exe
2220	Amadeus.exe
1368	WerFault.exe
1368	WerFault.exe
1368	WerFault.exe
1368	WerFault.exe
3612	taskeng.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Amadeus.exe = "C:\\Users\\Admin\\1000238002\\Amadeus.exe"	axplong.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2956	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe
2752	axplong.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1940 set thread context of 1444	1940	crypted.exe	35
PID 2796 set thread context of 584	2796	crypteda.exe	39

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1368	1460	WerFault.exe	57

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypted.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BITD0CpGo8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PureSyncInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypteda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8jaWFM5q5r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Amadeus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kitty.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	joffer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	caesium-image-compressor.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	joffer2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	joffer2.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	BITD0CpGo8.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	BITD0CpGo8.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	TypeId.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000020000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	BITD0CpGo8.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 190000000100000010000000dbd91ea86008fd8536f2b37529666c7b0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	BITD0CpGo8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	TypeId.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	TypeId.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2956	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe
2752	axplong.exe
780	BITD0CpGo8.exe
844	stealc_default2.exe
1444	RegAsm.exe
824	8jaWFM5q5r.exe
824	8jaWFM5q5r.exe
1444	RegAsm.exe
1444	RegAsm.exe
824	8jaWFM5q5r.exe
844	stealc_default2.exe
904	powershell.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe
3688	TypeId.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	780	BITD0CpGo8.exe
Token: SeBackupPrivilege	780	BITD0CpGo8.exe
Token: SeSecurityPrivilege	780	BITD0CpGo8.exe
Token: SeSecurityPrivilege	780	BITD0CpGo8.exe
Token: SeSecurityPrivilege	780	BITD0CpGo8.exe
Token: SeSecurityPrivilege	780	BITD0CpGo8.exe
Token: SeDebugPrivilege	1444	RegAsm.exe
Token: SeDebugPrivilege	824	8jaWFM5q5r.exe
Token: SeDebugPrivilege	2772	52i.exe
Token: SeDebugPrivilege	904	powershell.exe
Token: SeDebugPrivilege	3688	TypeId.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2956	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe
308	Nework.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 2752	2956	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe	31
PID 2956 wrote to memory of 2752	2956	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe	31
PID 2956 wrote to memory of 2752	2956	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe	31
PID 2956 wrote to memory of 2752	2956	4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe	31
PID 2752 wrote to memory of 1940	2752	axplong.exe	33
PID 2752 wrote to memory of 1940	2752	axplong.exe	33
PID 2752 wrote to memory of 1940	2752	axplong.exe	33
PID 2752 wrote to memory of 1940	2752	axplong.exe	33
PID 1940 wrote to memory of 1444	1940	crypted.exe	35
PID 1940 wrote to memory of 1444	1940	crypted.exe	35
PID 1940 wrote to memory of 1444	1940	crypted.exe	35
PID 1940 wrote to memory of 1444	1940	crypted.exe	35
PID 1940 wrote to memory of 1444	1940	crypted.exe	35
PID 1940 wrote to memory of 1444	1940	crypted.exe	35
PID 1940 wrote to memory of 1444	1940	crypted.exe	35
PID 1940 wrote to memory of 1444	1940	crypted.exe	35
PID 1940 wrote to memory of 1444	1940	crypted.exe	35
PID 1940 wrote to memory of 1444	1940	crypted.exe	35
PID 1940 wrote to memory of 1444	1940	crypted.exe	35
PID 1940 wrote to memory of 1444	1940	crypted.exe	35
PID 2752 wrote to memory of 2796	2752	axplong.exe	37
PID 2752 wrote to memory of 2796	2752	axplong.exe	37
PID 2752 wrote to memory of 2796	2752	axplong.exe	37
PID 2752 wrote to memory of 2796	2752	axplong.exe	37
PID 2796 wrote to memory of 1420	2796	crypteda.exe	38
PID 2796 wrote to memory of 1420	2796	crypteda.exe	38
PID 2796 wrote to memory of 1420	2796	crypteda.exe	38
PID 2796 wrote to memory of 1420	2796	crypteda.exe	38
PID 2796 wrote to memory of 1420	2796	crypteda.exe	38
PID 2796 wrote to memory of 1420	2796	crypteda.exe	38
PID 2796 wrote to memory of 1420	2796	crypteda.exe	38
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 2796 wrote to memory of 584	2796	crypteda.exe	39
PID 584 wrote to memory of 780	584	RegAsm.exe	40
PID 584 wrote to memory of 780	584	RegAsm.exe	40
PID 584 wrote to memory of 780	584	RegAsm.exe	40
PID 584 wrote to memory of 780	584	RegAsm.exe	40
PID 584 wrote to memory of 824	584	RegAsm.exe	42
PID 584 wrote to memory of 824	584	RegAsm.exe	42
PID 584 wrote to memory of 824	584	RegAsm.exe	42
PID 584 wrote to memory of 824	584	RegAsm.exe	42
PID 2752 wrote to memory of 308	2752	axplong.exe	43
PID 2752 wrote to memory of 308	2752	axplong.exe	43
PID 2752 wrote to memory of 308	2752	axplong.exe	43
PID 2752 wrote to memory of 308	2752	axplong.exe	43
PID 308 wrote to memory of 3064	308	Nework.exe	44
PID 308 wrote to memory of 3064	308	Nework.exe	44
PID 308 wrote to memory of 3064	308	Nework.exe	44
PID 308 wrote to memory of 3064	308	Nework.exe	44
PID 2752 wrote to memory of 844	2752	axplong.exe	45
PID 2752 wrote to memory of 844	2752	axplong.exe	45
PID 2752 wrote to memory of 844	2752	axplong.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe
"C:\Users\Admin\AppData\Local\Temp\4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe
    "C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1940
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1444
- - C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1420
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:584
    - - C:\Users\Admin\AppData\Roaming\BITD0CpGo8.exe
        
        "C:\Users\Admin\AppData\Roaming\BITD0CpGo8.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:780
    - - C:\Users\Admin\AppData\Roaming\8jaWFM5q5r.exe
        
        "C:\Users\Admin\AppData\Roaming\8jaWFM5q5r.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:824
- - C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:308
  - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3064
    - - C:\Users\Admin\AppData\Local\Temp\1000011001\joffer2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000011001\joffer2.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:940
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:844
- - C:\Users\Admin\AppData\Local\Temp\1000129001\caesium-image-compressor.exe
    "C:\Users\Admin\AppData\Local\Temp\1000129001\caesium-image-compressor.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe
    "C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe"
    3⤵
    - Executes dropped EXE
    PID:2368
- - C:\Users\Admin\AppData\Local\Temp\1000228001\PureSyncInst.exe
    "C:\Users\Admin\AppData\Local\Temp\1000228001\PureSyncInst.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2840
- - C:\Users\Admin\1000238002\Amadeus.exe
    "C:\Users\Admin\1000238002\Amadeus.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\1000267001\52i.exe
      "C:\Users\Admin\AppData\Local\Temp\1000267001\52i.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe
      "C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1460
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 188
        5⤵
        Loads dropped DLL
        Program crash
        
        PID:1368
- - C:\Users\Admin\AppData\Local\Temp\1000239001\runtime.exe
    "C:\Users\Admin\AppData\Local\Temp\1000239001\runtime.exe"
    3⤵
    - Executes dropped EXE
    PID:5048

C:\Windows\system32\taskeng.exe
taskeng.exe {3DF001FE-A5DF-45C9-9364-F79A3F68BF62} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:S4U:
1⤵
PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARwB1AGkAZABcAFQAeQBwAGUASQBkAC4AZQB4AGUALABDADoAXABXAGkAbgBkAG8AdwBzAFwATQBpAGMAcgBvAHMAbwBmAHQALgBOAEUAVABcAEYAcgBhAG0AZQB3AG8AcgBrADYANABcAHYANAAuADAALgAzADAAMwAxADkAXABBAGQAZABJAG4AUAByAG8AYwBlAHMAcwAuAGUAeABlACwAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAgAC0ARgBvAHIAYwBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVwBpAG4AZABvAHcAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AC4ATgBFAFQAXABGAHIAYQBtAGUAdwBvAHIAawA2ADQAXAB2ADQALgAwAC4AMwAwADMAMQA5AFwAQQBkAGQASQBuAFAAcgBvAGMAZQBzAHMALgBlAHgAZQAsAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABSAG8AYQBtAGkAbgBnAFwARwB1AGkAZABcAFQAeQBwAGUASQBkAC4AZQB4AGUA
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:904

C:\Windows\system32\taskeng.exe
taskeng.exe {661CBFDD-25AB-4B88-B77C-D1904EE3AF58} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]
1⤵
- Loads dropped DLL
PID:3612
- C:\Users\Admin\AppData\Roaming\Guid\TypeId.exe
  C:\Users\Admin\AppData\Roaming\Guid\TypeId.exe
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3688
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    3⤵
    PID:2620
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    3⤵
    PID:4824
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    3⤵
    PID:4856
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    3⤵
    PID:4884
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    3⤵
    PID:4896
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    3⤵
    PID:4904
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    3⤵
    PID:4924
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    3⤵
    PID:4940
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    3⤵
    PID:4948
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
    3⤵
    PID:4956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\1000238002\Amadeus.exe

Filesize
425KB

MD5
ced97d60021d4a0bfa03ee14ec384c12

SHA1
7af327df2a2d1e0e09034c2bdf6a47f788cec4e4

SHA256
9e06eed4e1237ffdc84f0ff666fbe4b39e1bd2c60bd542870f7e1bfb10555951

SHA512
af0a02daa759010a1edfc78f14c5fe321c10802d0b9df55b515fe501114af0835a05bbd5dd5e2167b4b1f39bb6da787343bf9141d5f811113f71749741b47811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab668247df7137aa687132198e564e84

SHA1
8ea64606047a1e81e68ce54544ce9bea56f098b5

SHA256
677a02c2f3c9ffac53a4b1319b1bfbcf574cf9c2699c8f684de2f17bdc4b83c3

SHA512
99b8b5a760935889c2a15590376de717ef490b52c10468cc034ba6fb9e7972244f38d1346ee5f12cfe19945dfa33817091b04cfb1920aa6a8966220393351a8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bac5f4d48bf3179c8649ae6400240995

SHA1
60dbc21fb0585bbf122253cf29c3caa41b9b762f

SHA256
b843b07fe1c64b1af83452fd274728d206bf6edb4c1d54efe0eba873d026bfcd

SHA512
6ea265376c2196963e6d966bc377a051c334df029d61f1ddc88c5e9c10117194fbbbceb40a1b7cdf5da39d6cabd6ee0565843ceb240f61e184dbae0f0c768962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c10c391bd5df0d4484262c177b610802

SHA1
fda47528fc03fab80064b9d16fa3672391315a11

SHA256
a0a2e7a6f9a36d1f770b75f7232986056f2253becb78483fdc89ffa84cb9b8f8

SHA512
ec5d51ffd8c2068d337d2db6767de8a879b58201e435705103f8dfb7b0d3229484b4a445eff95d1ccf81c1dd96336ee7345fe27ce288dd850f9720fbe9b6556c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
fe05ae3ebd5dba36a652323d65861a11

SHA1
a50a85ca3ced580006f8a88da6745e597022b538

SHA256
cc619ac168ce1bc0c00fbe94516dac192bbea5c9719e9fcd0ef6b58a18eb0b47

SHA512
5ee856299b255da061074ac8a20bb2338d4f4bf01c565d8cfc480d4698e9fd7cb0ed9d34bf4aa68055d42e30ff34bbfa2377a9bc6a09151c409d7ad6cf60c050

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002001\crypted.exe

Filesize
314KB

MD5
6134586375c01f97f8777bae1bf5ed98

SHA1
4787fa996b75dbc54632cc321725ee62666868a1

SHA256
414becb8aabd4e8c406e84df062bee1a45cffa334ae30022078cfa71da9e330d

SHA512
652ed16d96b5700f105c2bab8e7258f167bc1615b6397be7340c08df7c977842844326e07fdef677aecfaf07263f99bb7968c9fc926e90e5a33d2ed793f8436b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

Filesize
1.1MB

MD5
8e74497aff3b9d2ddb7e7f819dfc69ba

SHA1
1d18154c206083ead2d30995ce2847cbeb6cdbc1

SHA256
d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66

SHA512
9aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

Filesize
416KB

MD5
f5d7b79ee6b6da6b50e536030bcc3b59

SHA1
751b555a8eede96d55395290f60adc43b28ba5e2

SHA256
2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

SHA512
532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000011001\joffer2.exe

Filesize
6.3MB

MD5
243fc7bd91c9718a35f0d32303055695

SHA1
ddf2e207fff8a46d38da26231086203e546bb866

SHA256
c73f243b6866c04921ce7849a391cb62326908f6f894550a6ea8234e5776703c

SHA512
dbbf7dcfc69341be5413ab441fcd57458ed3154cd0b1015cc2e4ca2a710cadf196b7d02eb1a735918df87ece35075ed95c3bf396e18afa3723d85671fe5245a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
187KB

MD5
7a02aa17200aeac25a375f290a4b4c95

SHA1
7cc94ca64268a9a9451fb6b682be42374afc22fd

SHA256
836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

SHA512
f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000129001\caesium-image-compressor.exe

Filesize
6.5MB

MD5
297fa8c27084d876f6699d121f9c06fa

SHA1
2ce4110ebd75d61111a7bc1674f9e2d95b48571e

SHA256
ab42e51949918d17a582fb5a4c614c335616703f41ab8e71ad1ece652e33f521

SHA512
d4319da7596224bc9a62ad3a27907fb57a36bef210916120e51cefc31aa5bacb2aba852c0e6a9188632377139704c92329e6d628789491976175a5d6dced02b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000191001\BitcoinCore.exe

Filesize
10.0MB

MD5
304a5a222857d412cdd4effbb1ec170e

SHA1
34924c42524ca8e7fcc1fc604626d9c5f277dba2

SHA256
d67fb52973c445a3488a9d6a9a9ff3ebebb05b1c0e853cebfa8bba1a5953f0d6

SHA512
208b39436b520e909eb8262f68314dcb93852ea5f00a1d4ce8bd682dd5e20ad313e65ff293c8062bfed95ffe101f6ead3d7da4886e779031101329a3764b855f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000209001\whiteheroin.exe

Filesize
15B

MD5
d5ed74dc7d1bea716c32ed5efaa8f625

SHA1
69b28bac3fdb3dd6cf7748af00fc433391e8aeb9

SHA256
5458848903d44a7340933dd519e21a8305bd6f78bd9a98fb1e79c7395255b9f7

SHA512
05d5d3feb3c27360f5f1e2fc4fc8ab8f98d1db1824f609f763d78c3b5d360335bd1a715fc27bef13ebe3c3b8323b601e99ccf7d1b404de25951849f9b436061d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000228001\PureSyncInst.exe

Filesize
9.2MB

MD5
366eb232ccb1d3d063e8074f8c4b529f

SHA1
13e30ac58cfc74cb05edaf0074eb09927ab5a9fa

SHA256
33d866c385c3d05981986f7e3d56eac4966821813d216670d37aa7af7c30d62c

SHA512
0a9c2acbf9ef27345efeadda579fea582b3299f96078b9a2959bad5e87a0e7840949518fd905c82cb49b8ed604d93b404fdf85a11d71de1e1ba3dba9c0abab6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000239001\runtime.exe

Filesize
539KB

MD5
4d40ebb93aa34bf94d303c07c6a7e5e5

SHA1
9333bc5b3f78f0a3cca32e1f6a90af8064bf8a81

SHA256
ef46ced1cea1c98722dc71aa0cf640bdc38d8677d92026b6fde6ce6ee2d623b5

SHA512
9cdce881809159ad07d99e9691c1457e7888aa96cf0ea93a19eea105b9db928f8f61c8de98c3b9179556b528fde4eb790d59e954db8a86799aecb38461741d3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000267001\52i.exe

Filesize
715KB

MD5
4d190c235680b3e4481e4d7685e9a118

SHA1
17c5654e4077f9e0dd8e17e92e36696bed55557a

SHA256
4083f1ea732fd45abe2f648f824be39e3e511a59179fa7c8349d7f7f75e3d3b4

SHA512
517807dd7345c926cfc2e58d883764368c723900871ab358949a09bb6b23dcaef1a8db8096ebb2df08112e6914f893cdcc0b5fa8b78bc70008390598353ba771

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000268001\kitty.exe

Filesize
319KB

MD5
0ec1f7cc17b6402cd2df150e0e5e92ca

SHA1
8405b9bf28accb6f1907fbe28d2536da4fba9fc9

SHA256
4c5ca5701285337a96298ebf994f8ba013d290c63afa65b5c2b05771fbbb9ed4

SHA512
7caa2416bc7878493b62a184ddc844d201a9ab5282abfa77a616316af39ff65309e37bb566b3e29d9e764e08f4eda43a06464acaf9962f911b33e6dbc60c1861

Download Submit
C:\Users\Admin\AppData\Local\Temp\506706701124

Filesize
70KB

MD5
1d0459fae58449a1746b81edb8de6896

SHA1
66080e0e792ce647efdc9d99e9c24071de61bb19

SHA256
cfdb3de2eb3ffa793c86831346c90de86d1f5cef5bec2651b68834e75f15e9fc

SHA512
5edd5e5fb59e56e1ebb5abb66149ff7f3b6244f8553d04ca007953f0a061a173982317baf1c4f09de3b402ec2e98b5d0067063733da9bc98d73b84d7ba9c50e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBE5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCA3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpF92F.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Roaming\8jaWFM5q5r.exe

Filesize
304KB

MD5
30f46f4476cdc27691c7fdad1c255037

SHA1
b53415af5d01f8500881c06867a49a5825172e36

SHA256
3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0

SHA512
271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f

Download Submit
C:\Users\Admin\AppData\Roaming\BITD0CpGo8.exe

Filesize
544KB

MD5
88367533c12315805c059e688e7cdfe9

SHA1
64a107adcbac381c10bd9c5271c2087b7aa369ec

SHA256
c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9

SHA512
7a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1506706701-1246725540-2219210854-1000\76b53b3ec448f7ccdda2063b15d2bfc3_62dc4f69-4699-4b35-9f5c-cc69254f52a3

Filesize
2KB

MD5
421416b22ee3c0e7001b194ef81cea7d

SHA1
62f942cfbb13425a96035dcc5a7065edc136d132

SHA256
66cd174b2136d2a763bd14f7fd1674e36b310b69b699b0191e3d41ae9c3c1e0e

SHA512
053ca00b0ae0f5e140d839ac59ef4e262f44a42045560d4455ebc672652a05c6e9b7726664f7ce0249a93b5a41c05ad2ace1fb11c373e450cf86eaf4f89a7b27

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
39fb20ef7c3bc1023428dec5650bc879

SHA1
1db41cefdf921b424e3b108edb25c35007c666c5

SHA256
bb157fd2a365dd7f24bac59796458be72603e0b6ebce4f8dbff090696fb04ee0

SHA512
52551ac48f3b69a05a63e45d91f7eb84729f0ddabe33d2adc9193f6cd02329e1e8e8dc08059c0288a42527de6278e19d7336b6da1f04a1ef2ab5d513a001876c

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.9MB

MD5
c2f02a32a9117e64de874c5faad5d8a2

SHA1
a6c458a38de8b2d717378e210e94bad516b7a851

SHA256
4aac8eb6ddaa80532f39a15deea7b86989546dfe18c6c1687417c882f0ca022b

SHA512
a78c4987d43f899d0272be31c7148daa1aa6f3e72ca1cff6a6a158b17cd91fde401d2a10085c2d5f57bfe77c3d80182f9ab3394738460620e5ed094117fc38c8

Download Submit
memory/584-89-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/584-83-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/584-100-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/584-87-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/584-112-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/584-91-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/584-85-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/584-99-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/584-97-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/584-93-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/584-96-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/584-95-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/780-130-0x0000000000FC0000-0x000000000104E000-memory.dmp

Filesize
568KB

Download
memory/824-115-0x0000000001010000-0x0000000001062000-memory.dmp

Filesize
328KB

Download
memory/844-295-0x0000000001170000-0x00000000013B3000-memory.dmp

Filesize
2.3MB

Download
memory/844-225-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/844-178-0x0000000001170000-0x00000000013B3000-memory.dmp

Filesize
2.3MB

Download
memory/904-4450-0x0000000001370000-0x0000000001378000-memory.dmp

Filesize
32KB

Download
memory/904-4449-0x000000001A130000-0x000000001A412000-memory.dmp

Filesize
2.9MB

Download
memory/1444-52-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1444-45-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1444-41-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1444-50-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1444-43-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1444-49-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1444-47-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1444-53-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1600-294-0x0000000000400000-0x000000000106A000-memory.dmp

Filesize
12.4MB

Download
memory/1600-267-0x0000000000400000-0x000000000106A000-memory.dmp

Filesize
12.4MB

Download
memory/1940-38-0x0000000000B20000-0x0000000000B74000-memory.dmp

Filesize
336KB

Download
memory/2368-320-0x0000000140000000-0x0000000140278000-memory.dmp

Filesize
2.5MB

Download
memory/2368-326-0x0000000140000000-0x0000000140278000-memory.dmp

Filesize
2.5MB

Download
memory/2368-313-0x0000000140000000-0x0000000140278000-memory.dmp

Filesize
2.5MB

Download
memory/2368-319-0x0000000140000000-0x0000000140278000-memory.dmp

Filesize
2.5MB

Download
memory/2368-321-0x0000000140000000-0x0000000140278000-memory.dmp

Filesize
2.5MB

Download
memory/2368-322-0x0000000140000000-0x0000000140278000-memory.dmp

Filesize
2.5MB

Download
memory/2368-323-0x0000000140000000-0x0000000140278000-memory.dmp

Filesize
2.5MB

Download
memory/2368-324-0x0000000140000000-0x0000000140278000-memory.dmp

Filesize
2.5MB

Download
memory/2368-325-0x0000000140000000-0x0000000140278000-memory.dmp

Filesize
2.5MB

Download
memory/2752-22-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2752-19-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2752-297-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2752-176-0x0000000006620000-0x0000000006863000-memory.dmp

Filesize
2.3MB

Download
memory/2752-175-0x0000000006620000-0x0000000006863000-memory.dmp

Filesize
2.3MB

Download
memory/2752-174-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2752-202-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2752-16-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2752-271-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2752-203-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2752-152-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2752-4444-0x0000000006620000-0x0000000006863000-memory.dmp

Filesize
2.3MB

Download
memory/2752-247-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2752-23-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2752-20-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2752-4443-0x0000000006620000-0x0000000006863000-memory.dmp

Filesize
2.3MB

Download
memory/2752-177-0x0000000001000000-0x00000000014D9000-memory.dmp

Filesize
4.8MB

Download
memory/2772-441-0x0000000000AF0000-0x0000000000BA8000-memory.dmp

Filesize
736KB

Download
memory/2772-4417-0x0000000000C70000-0x0000000000CC6000-memory.dmp

Filesize
344KB

Download
memory/2772-442-0x000000001BD70000-0x000000001BE7A000-memory.dmp

Filesize
1.0MB

Download
memory/2772-4441-0x0000000000CD0000-0x0000000000D24000-memory.dmp

Filesize
336KB

Download
memory/2772-4418-0x0000000000AA0000-0x0000000000AEC000-memory.dmp

Filesize
304KB

Download
memory/2796-81-0x0000000000240000-0x0000000000352000-memory.dmp

Filesize
1.1MB

Download
memory/2956-15-0x0000000001210000-0x00000000016E9000-memory.dmp

Filesize
4.8MB

Download
memory/2956-0-0x0000000001210000-0x00000000016E9000-memory.dmp

Filesize
4.8MB

Download
memory/2956-10-0x0000000001210000-0x00000000016E9000-memory.dmp

Filesize
4.8MB

Download
memory/2956-17-0x0000000006A50000-0x0000000006F29000-memory.dmp

Filesize
4.8MB

Download
memory/2956-5-0x0000000001210000-0x00000000016E9000-memory.dmp

Filesize
4.8MB

Download
memory/2956-3-0x0000000001210000-0x00000000016E9000-memory.dmp

Filesize
4.8MB

Download
memory/2956-2-0x0000000001211000-0x000000000123F000-memory.dmp

Filesize
184KB

Download
memory/2956-1-0x0000000077B00000-0x0000000077B02000-memory.dmp

Filesize
8KB

Download
memory/3688-4463-0x0000000000C50000-0x0000000000D08000-memory.dmp

Filesize
736KB

Download
memory/5048-4415-0x00000000009B0000-0x0000000000A3E000-memory.dmp

Filesize
568KB

Download
memory/5048-4416-0x0000000002050000-0x00000000020D2000-memory.dmp

Filesize
520KB

Download