amadey | d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994

Analysis

max time kernel
296s
max time network
298s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe
Size

1.8MB
MD5

f005e9e79e6612060e1bc6eae1464d67
SHA1

7228dc896a4d86e6b44942eff7e6c082d8d0d195
SHA256

d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994
SHA512

609cbe54d3d760cad30fb0710d5d77f8368a385b489ba481bda5ab7458d54546877ce238951f0c3cdbb76a2e0ab926d014d52709f98113c9dd3fb25adffa59ea
SSDEEP

49152:lYJLqFonJmv5RtbfryR4zK4AteN9tGJ/xSL8:2kF9Xjzj8MoEL8

Score

10^/10

amadey cryptbot redline stealc @cloudytteam bundle default default2 fed3aa livetraffic credential_access discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

redline

Botnet

LiveTraffic

95.179.250.45:26212

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

65.21.18.51:45580

Extracted

Family

stealc

Botnet

default2

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

cryptbot

fivev5sb.top

Attributes

url_path
/v1/upload.php

Extracted

Family

stealc

Botnet

default

http://91.202.233.158

Attributes

url_path
/e96ea2db21fa9a1b.php

Extracted

Family

redline

Botnet

bundle

185.215.113.67:15206

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/264-49-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/264-50-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/264-48-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/264-45-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
behavioral1/memory/264-43-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline
\Users\Admin\AppData\Roaming\6m9EmHYQtd.exe	family_redline
behavioral1/memory/2184-112-0x0000000000D20000-0x0000000000D72000-memory.dmp	family_redline
C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe	family_redline
behavioral1/memory/1032-355-0x00000000003C0000-0x0000000000412000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exeaxplong.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exeaxplong.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Executes dropped EXE 22 IoCs

Processes:

axplong.exegold.execrypteda.exenSzI9JbeYj.exe6m9EmHYQtd.exeNework.exeHkbsse.exestealc_default2.exeSÐµtup.exeneedmoney.exesvchost015.exepenis.exejoffer2.exebundle.exeacentric.exeRMS1.exeservice123.exeservice123.exefilename.exeservice123.exeservice123.exeservice123.exe

pid	process
2700	axplong.exe
1620	gold.exe
2400	crypteda.exe
1352	nSzI9JbeYj.exe
2184	6m9EmHYQtd.exe
3060	Nework.exe
1040	Hkbsse.exe
1252	stealc_default2.exe
2628	SÐµtup.exe
288	needmoney.exe
2856	svchost015.exe
2940	penis.exe
2564	joffer2.exe
1032	bundle.exe
2852	acentric.exe
2788	RMS1.exe
2140	service123.exe
3172	service123.exe
3352	filename.exe
4408	service123.exe
1720	service123.exe
1508	service123.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

axplong.exed4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Wine	d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe

Loads dropped DLL 35 IoCs

Processes:

d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exeaxplong.exeRegAsm.exeNework.exeneedmoney.exeHkbsse.exestealc_default2.exeSÐµtup.exeservice123.exeservice123.exebundle.exeWerFault.exeservice123.exeservice123.exeservice123.exe

pid	process
1308	d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe
2700	axplong.exe
2700	axplong.exe
2084	RegAsm.exe
2084	RegAsm.exe
2700	axplong.exe
3060	Nework.exe
2700	axplong.exe
2700	axplong.exe
2700	axplong.exe
2700	axplong.exe
2700	axplong.exe
2700	axplong.exe
288	needmoney.exe
2700	axplong.exe
1040	Hkbsse.exe
1040	Hkbsse.exe
2700	axplong.exe
2700	axplong.exe
1252	stealc_default2.exe
1252	stealc_default2.exe
2700	axplong.exe
2628	SÐµtup.exe
2628	SÐµtup.exe
2140	service123.exe
3172	service123.exe
1032	bundle.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
3696	WerFault.exe
4408	service123.exe
1720	service123.exe
1508	service123.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

acentric.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\acentric = "\"C:\\Users\\Admin\\Pictures\\Opportunistic Telegraph\\acentric.exe\" /update"	acentric.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exeaxplong.exe

pid process

1308 d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe
2700 axplong.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

gold.execrypteda.exeneedmoney.exe

description	pid	process	target process
PID 1620 set thread context of 264	1620	gold.exe	RegAsm.exe
PID 2400 set thread context of 2084	2400	crypteda.exe	RegAsm.exe
PID 288 set thread context of 2856	288	needmoney.exe	svchost015.exe

Drops file in Windows directory 2 IoCs

Processes:

d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exeNework.exe

description	ioc	process
File created	C:\Windows\Tasks\axplong.job	d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe
File created	C:\Windows\Tasks\Hkbsse.job	Nework.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

penis.exebundle.exed4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exegold.exeRegAsm.exe6m9EmHYQtd.exenSzI9JbeYj.exeNework.exeschtasks.exefilename.exeaxplong.exeneedmoney.exeHkbsse.exeSÐµtup.exeacentric.execrypteda.exeRegAsm.exestealc_default2.exejoffer2.exesvchost015.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	penis.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bundle.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gold.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6m9EmHYQtd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nSzI9JbeYj.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nework.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	filename.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	needmoney.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SÐµtup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acentric.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	crypteda.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	joffer2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost015.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

SÐµtup.exejoffer2.exestealc_default2.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	SÐµtup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	joffer2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	joffer2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SÐµtup.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

nSzI9JbeYj.exebundle.exeRegAsm.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	nSzI9JbeYj.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 190000000100000010000000dbd91ea86008fd8536f2b37529666c7b0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079000000140000000100000014000000f352eacf816860c1097c4b852f4332dd93eb5d4f20000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	nSzI9JbeYj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	bundle.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	bundle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	nSzI9JbeYj.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0f000000010000002000000020d814fd5fc477ce74425e441d8f5b48d38db6f1dd119441bc35777689bd094c030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b0640200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900000020000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	nSzI9JbeYj.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

1572 schtasks.exe

pid	process
1572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exeaxplong.exeRegAsm.exe6m9EmHYQtd.exenSzI9JbeYj.exestealc_default2.exepenis.exebundle.exeRMS1.exe

pid	process
1308	d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe
2700	axplong.exe
264	RegAsm.exe
264	RegAsm.exe
2184	6m9EmHYQtd.exe
2184	6m9EmHYQtd.exe
1352	nSzI9JbeYj.exe
1252	stealc_default2.exe
2184	6m9EmHYQtd.exe
264	RegAsm.exe
2940	penis.exe
1032	bundle.exe
1252	stealc_default2.exe
1032	bundle.exe
1032	bundle.exe
2788	RMS1.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

Processes:

nSzI9JbeYj.exe6m9EmHYQtd.exeRegAsm.exepenis.exebundle.exeRMS1.exeacentric.exe

description	pid	process
Token: SeDebugPrivilege	1352	nSzI9JbeYj.exe
Token: SeBackupPrivilege	1352	nSzI9JbeYj.exe
Token: SeSecurityPrivilege	1352	nSzI9JbeYj.exe
Token: SeSecurityPrivilege	1352	nSzI9JbeYj.exe
Token: SeSecurityPrivilege	1352	nSzI9JbeYj.exe
Token: SeSecurityPrivilege	1352	nSzI9JbeYj.exe
Token: SeDebugPrivilege	2184	6m9EmHYQtd.exe
Token: SeDebugPrivilege	264	RegAsm.exe
Token: SeDebugPrivilege	2940	penis.exe
Token: SeBackupPrivilege	2940	penis.exe
Token: SeSecurityPrivilege	2940	penis.exe
Token: SeSecurityPrivilege	2940	penis.exe
Token: SeSecurityPrivilege	2940	penis.exe
Token: SeSecurityPrivilege	2940	penis.exe
Token: SeDebugPrivilege	1032	bundle.exe
Token: SeDebugPrivilege	2788	RMS1.exe
Token: SeDebugPrivilege	2852	acentric.exe
Token: SeDebugPrivilege	2788	RMS1.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exeNework.exe

pid process

1308 d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe
3060 Nework.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exeaxplong.exegold.execrypteda.exeRegAsm.exeNework.exe

description	pid	process	target process
PID 1308 wrote to memory of 2700	1308	d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe	axplong.exe
PID 1308 wrote to memory of 2700	1308	d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe	axplong.exe
PID 1308 wrote to memory of 2700	1308	d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe	axplong.exe
PID 1308 wrote to memory of 2700	1308	d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe	axplong.exe
PID 2700 wrote to memory of 1620	2700	axplong.exe	gold.exe
PID 2700 wrote to memory of 1620	2700	axplong.exe	gold.exe
PID 2700 wrote to memory of 1620	2700	axplong.exe	gold.exe
PID 2700 wrote to memory of 1620	2700	axplong.exe	gold.exe
PID 1620 wrote to memory of 264	1620	gold.exe	RegAsm.exe
PID 1620 wrote to memory of 264	1620	gold.exe	RegAsm.exe
PID 1620 wrote to memory of 264	1620	gold.exe	RegAsm.exe
PID 1620 wrote to memory of 264	1620	gold.exe	RegAsm.exe
PID 1620 wrote to memory of 264	1620	gold.exe	RegAsm.exe
PID 1620 wrote to memory of 264	1620	gold.exe	RegAsm.exe
PID 1620 wrote to memory of 264	1620	gold.exe	RegAsm.exe
PID 1620 wrote to memory of 264	1620	gold.exe	RegAsm.exe
PID 1620 wrote to memory of 264	1620	gold.exe	RegAsm.exe
PID 1620 wrote to memory of 264	1620	gold.exe	RegAsm.exe
PID 1620 wrote to memory of 264	1620	gold.exe	RegAsm.exe
PID 1620 wrote to memory of 264	1620	gold.exe	RegAsm.exe
PID 2700 wrote to memory of 2400	2700	axplong.exe	crypteda.exe
PID 2700 wrote to memory of 2400	2700	axplong.exe	crypteda.exe
PID 2700 wrote to memory of 2400	2700	axplong.exe	crypteda.exe
PID 2700 wrote to memory of 2400	2700	axplong.exe	crypteda.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2400 wrote to memory of 2084	2400	crypteda.exe	RegAsm.exe
PID 2084 wrote to memory of 1352	2084	RegAsm.exe	nSzI9JbeYj.exe
PID 2084 wrote to memory of 1352	2084	RegAsm.exe	nSzI9JbeYj.exe
PID 2084 wrote to memory of 1352	2084	RegAsm.exe	nSzI9JbeYj.exe
PID 2084 wrote to memory of 1352	2084	RegAsm.exe	nSzI9JbeYj.exe
PID 2084 wrote to memory of 2184	2084	RegAsm.exe	6m9EmHYQtd.exe
PID 2084 wrote to memory of 2184	2084	RegAsm.exe	6m9EmHYQtd.exe
PID 2084 wrote to memory of 2184	2084	RegAsm.exe	6m9EmHYQtd.exe
PID 2084 wrote to memory of 2184	2084	RegAsm.exe	6m9EmHYQtd.exe
PID 2700 wrote to memory of 3060	2700	axplong.exe	Nework.exe
PID 2700 wrote to memory of 3060	2700	axplong.exe	Nework.exe
PID 2700 wrote to memory of 3060	2700	axplong.exe	Nework.exe
PID 2700 wrote to memory of 3060	2700	axplong.exe	Nework.exe
PID 3060 wrote to memory of 1040	3060	Nework.exe	Hkbsse.exe
PID 3060 wrote to memory of 1040	3060	Nework.exe	Hkbsse.exe
PID 3060 wrote to memory of 1040	3060	Nework.exe	Hkbsse.exe
PID 3060 wrote to memory of 1040	3060	Nework.exe	Hkbsse.exe
PID 2700 wrote to memory of 1252	2700	axplong.exe	stealc_default2.exe
PID 2700 wrote to memory of 1252	2700	axplong.exe	stealc_default2.exe
PID 2700 wrote to memory of 1252	2700	axplong.exe	stealc_default2.exe
PID 2700 wrote to memory of 1252	2700	axplong.exe	stealc_default2.exe
PID 2700 wrote to memory of 2628	2700	axplong.exe	SÐµtup.exe
PID 2700 wrote to memory of 2628	2700	axplong.exe	SÐµtup.exe
PID 2700 wrote to memory of 2628	2700	axplong.exe	SÐµtup.exe
PID 2700 wrote to memory of 2628	2700	axplong.exe	SÐµtup.exe
PID 2700 wrote to memory of 288	2700	axplong.exe	needmoney.exe
PID 2700 wrote to memory of 288	2700	axplong.exe	needmoney.exe

C:\Users\Admin\AppData\Local\Temp\d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe
"C:\Users\Admin\AppData\Local\Temp\d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1620
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:264
- - C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2400
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2084
    - - C:\Users\Admin\AppData\Roaming\nSzI9JbeYj.exe
        
        "C:\Users\Admin\AppData\Roaming\nSzI9JbeYj.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1352
    - - C:\Users\Admin\AppData\Roaming\6m9EmHYQtd.exe
        
        "C:\Users\Admin\AppData\Roaming\6m9EmHYQtd.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2184
- - C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1040
    - - C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2564
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1252
- - C:\Users\Admin\AppData\Local\Temp\1000129001\SÐµtup.exe
    "C:\Users\Admin\AppData\Local\Temp\1000129001\SÐµtup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\service123.exe
      "C:\Users\Admin\AppData\Local\Temp\service123.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2140
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1572
- - C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe
    "C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:288
  - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      C:\Users\Admin\AppData\Local\Temp\svchost015.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2856
- - C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe
    "C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe
    "C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\filename.exe
      "C:\Users\Admin\AppData\Local\Temp\filename.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3352
- - C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe
    "C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe
    "C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2788
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2788 -s 604
      4⤵
      Loads dropped DLL
      PID:3696

C:\Windows\system32\taskeng.exe
taskeng.exe {EE52D984-27C3-4989-A4A7-2D9A980BAD47} S-1-5-21-1506706701-1246725540-2219210854-1000:MUYDDIIS\Admin:Interactive:[1]
1⤵
PID:3080
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  C:\Users\Admin\AppData\Local\Temp\/service123.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3172
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  C:\Users\Admin\AppData\Local\Temp\/service123.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4408
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  C:\Users\Admin\AppData\Local\Temp\/service123.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1720
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  C:\Users\Admin\AppData\Local\Temp\/service123.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17a3f3285f36ced9f65d80d28c42a185

SHA1
059e4f4796df1b5d3290e6b4d084a07d1adeac01

SHA256
44a7bc8b151e410954fd07db0c232053d86a6d64acfd2bbc62bf563f82816cde

SHA512
fd125f9d2b257e2675d6f5e59c06b1ad2aab80b48ce74567de0fcf4fa784e66b0934beda9117d177e513cf79337d411a6829c0426da28352eba307ec930108f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe

Filesize
313KB

MD5
2d647cf43622ed10b6d733bb5f048fc3

SHA1
6b9c5f77a9ef064a23e5018178f982570cbc64c6

SHA256
41426dd54fcabbf30a68b2aa11aa4f61f3862bea83109d3e3c50cfebed1359e6

SHA512
62400f1e9646268f0326aab5b95efacb0303f4c5879cccf0cbb24d1f66d0db40d0fdfebb09ba785b5dfd54df2d32e8aab48c1f5f333956b606112de68635ac3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\crypteda.exe

Filesize
1.1MB

MD5
8e74497aff3b9d2ddb7e7f819dfc69ba

SHA1
1d18154c206083ead2d30995ce2847cbeb6cdbc1

SHA256
d8e81d9e336ef37a37cae212e72b6f4ef915db4b0f2a8df73eb584bd25f21e66

SHA512
9aacc5c130290a72f1087daa9e79984565ccab6dbcad5114bfed0919812b9ba5f8dee9c37d230eeca4df3cca47ba0b355fbf49353e53f10f0ebc266e93f49f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\Nework.exe

Filesize
416KB

MD5
f5d7b79ee6b6da6b50e536030bcc3b59

SHA1
751b555a8eede96d55395290f60adc43b28ba5e2

SHA256
2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

SHA512
532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000026001\joffer2.exe

Filesize
6.3MB

MD5
5f1dffeff8714e88b493506256db8f8a

SHA1
d554da350b41da8556ce83ed851b975d2325a3d2

SHA256
e372a2d6ea5d76b0ffbccfa5b6574b910826fb5b5998e8e5cc4dcd49f6dffff0

SHA512
4bf57a4af1514111e301f8a1c8f3e2c145d078ba45a94edb71af6b1f9ca6dcfb3bd35d5114936f5c97ab4b1561b7b5afd4bfcc6d37b2f39b3aca0c96e0b28960

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
187KB

MD5
7a02aa17200aeac25a375f290a4b4c95

SHA1
7cc94ca64268a9a9451fb6b682be42374afc22fd

SHA256
836799fd760eba25e15a55c75c50b977945c557065a708317e00f2c8f965339e

SHA512
f6ebfe7e087aa354722cea3fddd99b1883a862fb92bb5a5a86782ea846a1bff022ab7db4397930bcabaa05cb3d817de3a89331d41a565bc1da737f2c5e3720b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000129001\SÐµtup.exe

Filesize
6.3MB

MD5
45b55d1e5d2bf60cc572f541ae6fa7d1

SHA1
2329f56147a299bcdbf20520e626cc8253e49a8d

SHA256
039f5c692ba1c67c6e9b475738f40f4311e5e5625e4390d5e51685f6b4e548b8

SHA512
5483964e050b2be073d3cf966b6dd6271556d4adfb420fb9ecf81f42f27cd06727016292dceb9a282f9fdcb451507309d1a78f58dd5d84e3022c0ea20c58dbe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000191001\needmoney.exe

Filesize
3.6MB

MD5
7e6a519688246fe1180f35fe0d25d370

SHA1
8e8719ac897dfef7305311dc216f570af40709af

SHA256
32a927e9b33371b82bae9f02b5ebf07c19ae5a3a7e3c0cd3fcbee7cfff7f257a

SHA512
a751e911eb254749a3c8c98740f455a5be32ce1af94dc90eba8fc677d6d7379303f80247748dfcfe9c8570edb3488a5af97fa7ff29c815bec6824dd491e27972

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000254001\penis.exe

Filesize
402KB

MD5
62eab4110407c75c3f17b9d40a41462c

SHA1
ee0e876f23db4fd5c9b7fc02b51d9ae9f2daa49e

SHA256
e71efcdf203c7da30c32b3f42dc7f04587dc071a71d4e007d6b3424421da197c

SHA512
0ec379ce8f1aa55648d53aa9dec014b8dcdf9782c6547caceaa9eb7c6e0780c35e6f7eec4789fa73258b78425f3314c8bf940d68e8fa925d437a2fdb49a396fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000259001\bundle.exe

Filesize
304KB

MD5
30daa686c1f31cc4833bd3d7283d8cdc

SHA1
70f74571fafe1b359cfe9ce739c3752e35d16cf5

SHA256
504518e3b4f3abc7f1ae1bf205fdc4a9f739e05b5e84618bae9c7e66bdc19822

SHA512
9f6c0eea9f03f9aa35ebf27ce8264e41d9072d273d1b8a35415ae4666d31013d895d1108dd67e36910200e2ac4fc45a4a9d761a1aadf02b0fd29ef93cd20a4d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000269001\acentric.exe

Filesize
454KB

MD5
37d198ad751d31a71acc9cb28ed0c64e

SHA1
8eb519b7a6df66d84c566605da9a0946717a921d

SHA256
1ed4a8b4c74aab435ea5cd459d5ac961e5a8ca28924801bd84d336135f30efde

SHA512
60923c0a8ce5fd397d49749ccee68ca3fe294d7323551ce9755410ac16bfff56a35bee3e6b9a67d57cdfcb43e4f164712f33cd255b76689174dcf4c475976c96

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000270001\RMS1.exe

Filesize
1.4MB

MD5
03b1ed4c105e5f473357dad1df17cf98

SHA1
faf5046ff19eafd3a59dcf85be30496f90b5b6b1

SHA256
6be5916900ffda93154db8c2c5dd28b9150f4c3aef74dbd4fd86390bc72845ba

SHA512
3f6f8a12d000b913dc8240542be6a64f991dc0802313782d038b971219308e7d381d4d96c25d98ee1b05bca127a9bbc69e3bd54f1722d8381f8060bb506a9765

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
f005e9e79e6612060e1bc6eae1464d67

SHA1
7228dc896a4d86e6b44942eff7e6c082d8d0d195

SHA256
d4102afb18acfe85569592a9d132bfe37b7081ab4d4deb6d99c3e5c739139994

SHA512
609cbe54d3d760cad30fb0710d5d77f8368a385b489ba481bda5ab7458d54546877ce238951f0c3cdbb76a2e0ab926d014d52709f98113c9dd3fb25adffa59ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2CEC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2D5C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp144D.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1506706701-1246725540-2219210854-1000\76b53b3ec448f7ccdda2063b15d2bfc3_62dc4f69-4699-4b35-9f5c-cc69254f52a3

Filesize
2KB

MD5
1b22b0e6ae91ee8acb22f12e142c1f29

SHA1
121e3bc0f689b235015f77b90a4192f44db31a9d

SHA256
e154e474bc61bee5f149be38c1372f32e13a4e91a6ddbf64923a611f98eaa5d1

SHA512
f1aadd33dead7948e71d163e1f69a6be13a59421770760933fd24ab5919420a27993bb0b77fe81d2cd6ace30ea1af85800763deffa57e13b185644ccd3c395a9

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
39fb20ef7c3bc1023428dec5650bc879

SHA1
1db41cefdf921b424e3b108edb25c35007c666c5

SHA256
bb157fd2a365dd7f24bac59796458be72603e0b6ebce4f8dbff090696fb04ee0

SHA512
52551ac48f3b69a05a63e45d91f7eb84729f0ddabe33d2adc9193f6cd02329e1e8e8dc08059c0288a42527de6278e19d7336b6da1f04a1ef2ab5d513a001876c

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
\Users\Admin\AppData\Local\Temp\filename.exe

Filesize
5.3MB

MD5
36a627b26fae167e6009b4950ff15805

SHA1
f3cb255ab3a524ee05c8bab7b4c01c202906b801

SHA256
a2389de50f83a11d6fe99639fc5c644f6d4dcea6834ecbf90a4ead3d5f36274a

SHA512
2133aba3e2a41475b2694c23a9532c238abab0cbae7771de83f9d14a8b2c0905d44b1ba0b1f7aae501052f4eba0b6c74018d66c3cbc8e8e3443158438a621094

Download Submit
\Users\Admin\AppData\Local\Temp\svchost015.exe

Filesize
2.9MB

MD5
b826dd92d78ea2526e465a34324ebeea

SHA1
bf8a0093acfd2eb93c102e1a5745fb080575372e

SHA256
7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

SHA512
1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

Download Submit
\Users\Admin\AppData\Roaming\6m9EmHYQtd.exe

Filesize
304KB

MD5
30f46f4476cdc27691c7fdad1c255037

SHA1
b53415af5d01f8500881c06867a49a5825172e36

SHA256
3a8f5f6951dad3ba415b23b35422d3c93f865146da3ccf7849b75806e0b67ce0

SHA512
271aadb524e94ed1019656868a133c9e490cc6f8e4608c8a41c29eff7c12de972895a01f171e8f625d07994ff3b723bb308d362266f96cb20dff82689454c78f

Download Submit
\Users\Admin\AppData\Roaming\nSzI9JbeYj.exe

Filesize
544KB

MD5
88367533c12315805c059e688e7cdfe9

SHA1
64a107adcbac381c10bd9c5271c2087b7aa369ec

SHA256
c6fc5c06ad442526a787989bae6ce0d32a2b15a12a41f78baca336b6560997a9

SHA512
7a8c3d767d19395ce9ffef964b0347a148e517982afcf2fc5e45b4c524fd44ec20857f6be722f57ff57722b952ef7b88f6249339551949b9e89cf60260f0a714

Download Submit
memory/264-50-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/264-42-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/264-49-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/264-48-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/264-47-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/264-45-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/264-43-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/264-39-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/288-295-0x0000000000400000-0x000000000079D000-memory.dmp

Filesize
3.6MB

Download
memory/1032-355-0x00000000003C0000-0x0000000000412000-memory.dmp

Filesize
328KB

Download
memory/1252-234-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1252-213-0x00000000010B0000-0x00000000012F3000-memory.dmp

Filesize
2.3MB

Download
memory/1252-908-0x00000000010B0000-0x00000000012F3000-memory.dmp

Filesize
2.3MB

Download
memory/1308-10-0x0000000000CA0000-0x000000000115E000-memory.dmp

Filesize
4.7MB

Download
memory/1308-3-0x0000000000CA0000-0x000000000115E000-memory.dmp

Filesize
4.7MB

Download
memory/1308-1-0x0000000077D20000-0x0000000077D22000-memory.dmp

Filesize
8KB

Download
memory/1308-2-0x0000000000CA1000-0x0000000000CCF000-memory.dmp

Filesize
184KB

Download
memory/1308-4-0x0000000000CA0000-0x000000000115E000-memory.dmp

Filesize
4.7MB

Download
memory/1308-16-0x0000000006FC0000-0x000000000747E000-memory.dmp

Filesize
4.7MB

Download
memory/1308-15-0x0000000000CA0000-0x000000000115E000-memory.dmp

Filesize
4.7MB

Download
memory/1308-0-0x0000000000CA0000-0x000000000115E000-memory.dmp

Filesize
4.7MB

Download
memory/1352-126-0x0000000000AA0000-0x0000000000B2E000-memory.dmp

Filesize
568KB

Download
memory/1620-37-0x0000000000360000-0x00000000003B4000-memory.dmp

Filesize
336KB

Download
memory/2084-96-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-97-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-94-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-86-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-84-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-109-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-90-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-80-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-93-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-82-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2084-88-0x0000000000400000-0x000000000050D000-memory.dmp

Filesize
1.1MB

Download
memory/2184-112-0x0000000000D20000-0x0000000000D72000-memory.dmp

Filesize
328KB

Download
memory/2400-78-0x0000000000140000-0x0000000000252000-memory.dmp

Filesize
1.1MB

Download
memory/2628-332-0x0000000000400000-0x0000000001069000-memory.dmp

Filesize
12.4MB

Download
memory/2628-258-0x0000000000400000-0x0000000001069000-memory.dmp

Filesize
12.4MB

Download
memory/2700-192-0x0000000000CE0000-0x000000000119E000-memory.dmp

Filesize
4.7MB

Download
memory/2700-193-0x0000000000CE0000-0x000000000119E000-memory.dmp

Filesize
4.7MB

Download
memory/2700-257-0x0000000000CE0000-0x000000000119E000-memory.dmp

Filesize
4.7MB

Download
memory/2700-1560-0x0000000006C80000-0x0000000006EC3000-memory.dmp

Filesize
2.3MB

Download
memory/2700-1559-0x0000000006C80000-0x0000000006EC3000-memory.dmp

Filesize
2.3MB

Download
memory/2700-18-0x0000000000CE0000-0x000000000119E000-memory.dmp

Filesize
4.7MB

Download
memory/2700-19-0x0000000000CE1000-0x0000000000D0F000-memory.dmp

Filesize
184KB

Download
memory/2700-20-0x0000000000CE0000-0x000000000119E000-memory.dmp

Filesize
4.7MB

Download
memory/2700-22-0x0000000000CE0000-0x000000000119E000-memory.dmp

Filesize
4.7MB

Download
memory/2700-154-0x0000000000CE0000-0x000000000119E000-memory.dmp

Filesize
4.7MB

Download
memory/2700-233-0x0000000000CE0000-0x000000000119E000-memory.dmp

Filesize
4.7MB

Download
memory/2700-164-0x0000000000CE0000-0x000000000119E000-memory.dmp

Filesize
4.7MB

Download
memory/2700-216-0x0000000000CE0000-0x000000000119E000-memory.dmp

Filesize
4.7MB

Download
memory/2700-331-0x0000000000CE0000-0x000000000119E000-memory.dmp

Filesize
4.7MB

Download
memory/2700-212-0x0000000006C80000-0x0000000006EC3000-memory.dmp

Filesize
2.3MB

Download
memory/2700-214-0x0000000000CE0000-0x000000000119E000-memory.dmp

Filesize
4.7MB

Download
memory/2700-215-0x0000000006C80000-0x0000000006EC3000-memory.dmp

Filesize
2.3MB

Download
memory/2788-441-0x000000001C130000-0x000000001C25A000-memory.dmp

Filesize
1.2MB

Download
memory/2788-440-0x0000000000E60000-0x0000000000FC0000-memory.dmp

Filesize
1.4MB

Download
memory/2788-1556-0x000000001B4E0000-0x000000001B534000-memory.dmp

Filesize
336KB

Download
memory/2788-1532-0x0000000000D50000-0x0000000000D9C000-memory.dmp

Filesize
304KB

Download
memory/2788-1531-0x000000001AD50000-0x000000001ADF4000-memory.dmp

Filesize
656KB

Download
memory/2788-442-0x000000001C6C0000-0x000000001C7EC000-memory.dmp

Filesize
1.2MB

Download
memory/2852-426-0x0000000000340000-0x000000000035A000-memory.dmp

Filesize
104KB

Download
memory/2852-396-0x0000000000380000-0x00000000003F8000-memory.dmp

Filesize
480KB

Download
memory/2856-288-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2856-282-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2856-290-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2856-286-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2856-284-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2856-1535-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2856-292-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2856-294-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2856-296-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2940-314-0x0000000000CE0000-0x0000000000D4A000-memory.dmp

Filesize
424KB

Download