lumma | de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89

Analysis

max time kernel
36s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 14:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe
Size

404KB
MD5

38dabc7063c0a175a12c30bd44cf3dbc
SHA1

6d7aabebd8a417168e220c7497f4bc38c314da3b
SHA256

de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89
SHA512

674760ad37cf7886ca4cd786e4d1966d3827fdad008a85a125e18bd474d073dae8d4296427253bb86e78d3173a300611ee5eb2e01c1f968700679350fc17a24d
SSDEEP

12288:XY1HgTKqPXxbx28l1ukOy325R4RQMJnJ9w6EO:XY1AtPB0KwkU5GRnJnxt

Score

10^/10

lumma vidar 8b4d47586874b08947203f03e4db3962 a669a86f8433a1e88901711c0f772c97 credential_access discovery spyware stealer

Malware Config

Extracted

Family

vidar

Version

Botnet

a669a86f8433a1e88901711c0f772c97

https://t.me/jamsemlg

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

lumma

Extracted

Family

vidar

Version

Botnet

8b4d47586874b08947203f03e4db3962

https://steamcommunity.com/profiles/76561199780418869

https://t.me/ae5ed

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:130.0) Gecko/20100101 Firefox/130.0

Extracted

Family

lumma

https://chorusarorp.site/api

https://questionsmw.store/api

https://soldiefieop.site/api

https://abnomalrkmu.site/api

https://treatynreit.site/api

https://snarlypagowo.site/api

https://mysterisop.site/api

https://absorptioniw.site/api

https://gravvitywio.store/api

Signatures

Detect Vidar Stealer 20 IoCs

stealer

resource	yara_rule
behavioral1/memory/2340-8-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-7-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-6-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-13-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-11-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-17-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-163-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-182-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-212-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-231-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-362-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-381-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-424-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/2340-443-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1424-582-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1424-578-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1424-584-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1424-581-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1424-576-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7
behavioral1/memory/1424-574-0x0000000000400000-0x0000000000676000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 5 IoCs

pid	Process
1112	FHIECBAFBF.exe
2396	BGIIEGIDHC.exe
2320	CBAFIDAECB.exe
1348	AdminGDAAKFIDGI.exe
868	AdminDBFHDBGIEB.exe

Loads dropped DLL 15 IoCs

pid	Process
2340	RegAsm.exe
2340	RegAsm.exe
2340	RegAsm.exe
2340	RegAsm.exe
2340	RegAsm.exe
2340	RegAsm.exe
2340	RegAsm.exe
2340	RegAsm.exe
2340	RegAsm.exe
2340	RegAsm.exe
2340	RegAsm.exe
2236	RegAsm.exe
2236	RegAsm.exe
3056	cmd.exe
1732	cmd.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2816 set thread context of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 1112 set thread context of 1864	1112	FHIECBAFBF.exe	39
PID 2396 set thread context of 1424	2396	BGIIEGIDHC.exe	42
PID 2320 set thread context of 2236	2320	CBAFIDAECB.exe	45
PID 1348 set thread context of 1576	1348	AdminGDAAKFIDGI.exe	56

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FHIECBAFBF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CBAFIDAECB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminDBFHDBGIEB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdminGDAAKFIDGI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BGIIEGIDHC.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2556	timeout.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	RegAsm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2340	RegAsm.exe
2340	RegAsm.exe
2340	RegAsm.exe
2340	RegAsm.exe
2236	RegAsm.exe
1424	RegAsm.exe
2236	RegAsm.exe
1424	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2816 wrote to memory of 2340	2816	de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe	32
PID 2340 wrote to memory of 1112	2340	RegAsm.exe	35
PID 2340 wrote to memory of 1112	2340	RegAsm.exe	35
PID 2340 wrote to memory of 1112	2340	RegAsm.exe	35
PID 2340 wrote to memory of 1112	2340	RegAsm.exe	35
PID 1112 wrote to memory of 916	1112	FHIECBAFBF.exe	37
PID 1112 wrote to memory of 916	1112	FHIECBAFBF.exe	37
PID 1112 wrote to memory of 916	1112	FHIECBAFBF.exe	37
PID 1112 wrote to memory of 916	1112	FHIECBAFBF.exe	37
PID 1112 wrote to memory of 916	1112	FHIECBAFBF.exe	37
PID 1112 wrote to memory of 916	1112	FHIECBAFBF.exe	37
PID 1112 wrote to memory of 916	1112	FHIECBAFBF.exe	37
PID 1112 wrote to memory of 2580	1112	FHIECBAFBF.exe	38
PID 1112 wrote to memory of 2580	1112	FHIECBAFBF.exe	38
PID 1112 wrote to memory of 2580	1112	FHIECBAFBF.exe	38
PID 1112 wrote to memory of 2580	1112	FHIECBAFBF.exe	38
PID 1112 wrote to memory of 2580	1112	FHIECBAFBF.exe	38
PID 1112 wrote to memory of 2580	1112	FHIECBAFBF.exe	38
PID 1112 wrote to memory of 2580	1112	FHIECBAFBF.exe	38
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 1112 wrote to memory of 1864	1112	FHIECBAFBF.exe	39
PID 2340 wrote to memory of 2396	2340	RegAsm.exe	40
PID 2340 wrote to memory of 2396	2340	RegAsm.exe	40
PID 2340 wrote to memory of 2396	2340	RegAsm.exe	40
PID 2340 wrote to memory of 2396	2340	RegAsm.exe	40
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2396 wrote to memory of 1424	2396	BGIIEGIDHC.exe	42
PID 2340 wrote to memory of 2320	2340	RegAsm.exe	43

C:\Users\Admin\AppData\Local\Temp\de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe
"C:\Users\Admin\AppData\Local\Temp\de664956d799e59e1cca0788d545922ee420e3afdcf277442f148f52bc78df89.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\ProgramData\FHIECBAFBF.exe
    "C:\ProgramData\FHIECBAFBF.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:916
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2580
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      PID:1864
- - C:\ProgramData\BGIIEGIDHC.exe
    "C:\ProgramData\BGIIEGIDHC.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:1424
- - C:\ProgramData\CBAFIDAECB.exe
    "C:\ProgramData\CBAFIDAECB.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:2320
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:2236
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminGDAAKFIDGI.exe"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3056
      - C:\Users\AdminGDAAKFIDGI.exe
        
        "C:\Users\AdminGDAAKFIDGI.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1348
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1576
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\AdminDBFHDBGIEB.exe"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1732
      - C:\Users\AdminDBFHDBGIEB.exe
        
        "C:\Users\AdminDBFHDBGIEB.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:868
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        7⤵
        
        PID:2644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c timeout /t 10 & rd /s /q "C:\ProgramData\AFBAFBKEGCFB" & exit
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3012
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 10
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\AKJKFBAFIDAE\DAKFID

Filesize
46KB

MD5
02d2c46697e3714e49f46b680b9a6b83

SHA1
84f98b56d49f01e9b6b76a4e21accf64fd319140

SHA256
522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9

SHA512
60348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac

Download Submit
C:\ProgramData\AKJKFBAFIDAE\GIIDBG

Filesize
20KB

MD5
c9ff7748d8fcef4cf84a5501e996a641

SHA1
02867e5010f62f97ebb0cfb32cb3ede9449fe0c9

SHA256
4d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988

SHA512
d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73

Download Submit
C:\ProgramData\CBAFIDAECB.exe

Filesize
336KB

MD5
022cc85ed0f56a3f3e8aec4ae3b80a71

SHA1
a89b9c39c5f6fcb6e770cea9491bf7a97f0f012d

SHA256
bb28bb63ed34a3b4f97a0a26bda8a7a7c60f961010c795007edc52576b89e4d3

SHA512
ac549b9cf50e631bae01152db4523fdab55f426ee77177af900b088244665e28de03c10784fe9db33a2478bee0d96bd50e5a668d2a2bfdff3e8706aa8f5d71a2

Download Submit
C:\ProgramData\JJEGCBGIDHCAKEBGIIDB

Filesize
6KB

MD5
74d05eaf787c50c126d5021853b530f4

SHA1
80295af1fc52734e327564f98bf6f111c73d9954

SHA256
46e2b5e5428ab2d652ed4942b2ca9cb8aa8b7a93b8ba17fff43831f6e7e92507

SHA512
650b4fb7ddd47e061a988e2fad8f4fda44bbc525b4531f04a3a8c360c65971a4aff3a16d792787dd5385b2bdbbfb73bbe60a4ed240afd8eb03098e32764fc0bc

Download Submit
C:\ProgramData\KJKJJJEC

Filesize
92KB

MD5
2cd7a684788f438d7a7ae3946df2e26f

SHA1
3e5a60f38395f3c10d9243ba696468d2bb698a14

SHA256
2ebed8dd3531958e857c87ddbf46376b8a10ea2f364d2399d9fcc604da0bee1d

SHA512
0fec4b36e2173d1ad5eca880e1be1d0c7093d459aeb612d371e4ac92fbeaea55beb36e9228d36d57fe1851bd4d57b26dd5b8edb4620fb17b91441e840669c7d1

Download Submit
C:\ProgramData\freebl3.dll

Filesize
13KB

MD5
bb1dcddc7b08e7b683da9426d2895d3a

SHA1
69ce635788997b1ee4b7d69fa70765a66cd6a71f

SHA256
cb46725d09ec7238ed21005d54c6e89c680cf0877953f6c9856833133f935867

SHA512
3c64779607766e09594294510b597c06ce750698918ad8aa1f811b54d736d9ddeb6ce362490b3b91e28cb0cc9a3aef177699812440374b34d5aa1afd10e5f1e3

Download Submit
C:\ProgramData\mozglue.dll

Filesize
34KB

MD5
f9b7f2d733b3f13de1fcd73668b0d2b6

SHA1
0f1d0c90f22c3bfd4ce21383c1416876b5bb8848

SHA256
83f0860892332266f22cf019c1c12334e0e38134f9f169b7fe6fd16f829965ea

SHA512
3bc8c9d27c6a320b4a1ff51e2e45571e40112e01e0e0bac7f4aa184ad878740e3445d99d27b3bee919a504578d0ac453e0201bbfe2e763c73291feb326ff712a

Download Submit
C:\ProgramData\msvcp140.dll

Filesize
150KB

MD5
cf252101f4591f302071cee43ad7fe4f

SHA1
e7cfff62ae71dff4e3ca7a8d639175aed9d9b3e1

SHA256
1cacaec630c05abc70f81faa7c01f7ff90c2a3ba68e7b177619b2dd14de8c3a7

SHA512
dd597b2c1da26e4d87f9593dc9c55c3b892c35a5326a58c9bb0f194aa3e036c74f59245bd04aa7f2b5b50fac8968eb944835999f4122014e97d938211c0861f3

Download Submit
C:\ProgramData\nss3.dll

Filesize
344KB

MD5
4b7119224125da1991ae19129638aedb

SHA1
7de5e425cafcbecabde86bc18edacd5746056dea

SHA256
258e14acacbbe66cacdc5ed47d9c32de42c45d66280da02117f868c4f9077503

SHA512
c04008ec946511d5a8ae7d882113b32075d22a527445c1acb2c30811f4bf3db3eaa41ac8b85e598e9d7dd00ad5276e5c0a917e60ea5e580db2a97146d4594907

Download Submit
C:\ProgramData\softokn3.dll

Filesize
39KB

MD5
1f1aa00a2d160ce959e0ac0c004abfcd

SHA1
d362ea0a7c66195f99a22b8e9a450be1618e0127

SHA256
83e5cea6e50f2a2f5aa6b9b3e09bdbf43e259126561959675e971f2a39fd27da

SHA512
718f5b6009a40dac032ccb656e639d01765537e7994983fe2daf6328f7a90af98e72723eb4f5fd7e3a472cba8cbca25705075d9ab3e8a2b542dfca7d07f2e3aa

Download Submit
C:\ProgramData\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
471B

MD5
53531d3b1632c42fbb5282b61f41eb70

SHA1
3e57dd0a3966162c6bf62d02cef4abcff03c1159

SHA256
b949b4e92e2803878a2b71476a58d2cbfd53c95ab7bb1583ce4e77398f135105

SHA512
60d25185037c526ac8a8c928891c2ea5fe3a5d8d24fd536b36bdaea07953350aa25c45038c5b0db4166912da3ea502a959dd4de7dd6f602d2d6cdd1d349c73b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec8a875beb7619b58ee8b5b59e0c2b0b

SHA1
59b08dbce54361d419aa181b2864ab00475793a3

SHA256
03fcb1b939aaf104772c8def33116474e5a4743fa52ae16a4c84ddde721dc9fe

SHA512
a02525025f1ea16d445548ebca72faa8f1f2008c5200bced605cafed808fc018947a38d02e674e24d296e902b99d4069bee8d1b5d995704ad87709bcb3f04459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d3d6ec1e5be0f042c8f47e02af0e3de

SHA1
8fd19eb40e8cdb80f78d74596faefaa95761d405

SHA256
f7b8885a469ab96fc6705fc3983615160abd3266704f5208651b8ccd98d7c311

SHA512
8968e2694e9b35765672a19674569f6ff9ebe385e7f1ad9750a9ba0b895f8f588de5df8daa5192fb7cad855629ac2ea8cdf36707f86a060b58968a331cebb14a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619

Filesize
400B

MD5
80aeba81dcc6e10840cf3e73ba0a7d44

SHA1
6826e4017361effee06ed0959fa0368c096013a0

SHA256
11ff0868198321e3049623bd22ff8c1a8addf86e9a7f1be7b9a2b8d90915b08a

SHA512
9e11cc329626c8c144a692fbd744c491b5508fc7b387a583e3b8799be4385303f112583982e644a18888611b9f6df3c6a60e64cf44306b59eda933437fc8b313

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\76561199780418869[1].htm

Filesize
33KB

MD5
6c30db37218f0f2b6125f0049ac198af

SHA1
53107507acdac54a25c8485384620943b80e6c08

SHA256
23f36f73216b9ed6b16a765b3f73daa5328d52f383d78d56b2e2a30dd328778f

SHA512
47406c1b4e71256c8471495fcf0ba6231645db3b4e1f06a6628ce6675f54e86d8f89044113e5568a2e30f8145f041d43c972ed8ad8efba2879c28ce316f86fe5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\76561199780418869[1].htm

Filesize
33KB

MD5
53a56997bd4003232be8eec590929925

SHA1
48afdd66b9f47c75cc9ede3ed3f3af5b5620d37f

SHA256
7677e16e7dae93c56ed274580f666bcd99dc59e43f4e4c4da2f201d77451f534

SHA512
28183b02807d271be634481a658db6f81673f7621a0d2d06d214aa36ca3957df9524326eedd750b0e10e41be907cf3a30f0058e11e079afd6b55f7ca9edc7061

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE9C5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE9E7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\ProgramData\BGIIEGIDHC.exe

Filesize
413KB

MD5
237af39f8b579aad0205f6174bb96239

SHA1
7aad40783be4f593a2883b6a66f66f5f624d4550

SHA256
836ce1411f26919f8fb95548d03c2f4dfd658fc525dfe21c7be8ed65f81a5957

SHA512
df46993a2029b22cbc88b289398265494c5a8f54ea803e15b7b12f4a7bc98152df298916d341e3c3590329b35a806788ae294bae2e6832f2a2ac426d0145504d

Download Submit
\ProgramData\FHIECBAFBF.exe

Filesize
381KB

MD5
c7e7cfc3ed17aef6c67c265389593ee3

SHA1
44aaea45a59f194f33ff435a430fcbd9e7434ad5

SHA256
0ddebb36beb37631df17f68a14c90519f93ba7c200c62003527273119442e1ff

SHA512
6c5f7a6626aac4b583d1165c4ea3bc69e315cdce94d3e1d3442dc9643e0983f2a80e0495bac79d4aa0e4db309f0aab373d917e6af12ffaad333aba21e16249d2

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/868-870-0x0000000000E20000-0x0000000000E80000-memory.dmp

Filesize
384KB

Download
memory/1112-530-0x0000000073550000-0x0000000073C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1112-497-0x0000000073550000-0x0000000073C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1112-532-0x0000000073550000-0x0000000073C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1112-496-0x00000000013C0000-0x0000000001420000-memory.dmp

Filesize
384KB

Download
memory/1112-495-0x000000007355E000-0x000000007355F000-memory.dmp

Filesize
4KB

Download
memory/1348-824-0x0000000000E20000-0x0000000000E88000-memory.dmp

Filesize
416KB

Download
memory/1424-574-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1424-570-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1424-581-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1424-578-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1424-584-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1424-572-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1424-582-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1424-576-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/1864-523-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1864-521-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1864-519-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1864-522-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1864-517-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1864-531-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1864-528-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/1864-526-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/2236-632-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/2236-630-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/2236-634-0x0000000000400000-0x0000000000661000-memory.dmp

Filesize
2.4MB

Download
memory/2320-602-0x0000000000CE0000-0x0000000000D36000-memory.dmp

Filesize
344KB

Download
memory/2340-182-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-17-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-381-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-424-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-8-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-443-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-231-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-212-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-202-0x0000000020500000-0x000000002075F000-memory.dmp

Filesize
2.4MB

Download
memory/2340-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2340-163-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-362-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-3-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-4-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-11-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-7-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-6-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-13-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2340-5-0x0000000000400000-0x0000000000676000-memory.dmp

Filesize
2.5MB

Download
memory/2396-548-0x0000000000E90000-0x0000000000EF8000-memory.dmp

Filesize
416KB

Download
memory/2816-15-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/2816-14-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/2816-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmp

Filesize
4KB

Download
memory/2816-1-0x0000000000880000-0x00000000008EA000-memory.dmp

Filesize
424KB

Download