Overview

overview

10

Static

static

3

a5bd7899aa...3b.exe

windows7-x64

10

a5bd7899aa...3b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-10-2024 00:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a5bd7899aa10cbdc6fe54d890f2be4fc6f5397f1231cc51fd5cdeecc5992d33b.exe

  • Size

    1.8MB

  • MD5

    a359113458b37da999c3dd72d1933391

  • SHA1

    de4c51dd690c8a227336a1044a9025fb330c51f0

  • SHA256

    a5bd7899aa10cbdc6fe54d890f2be4fc6f5397f1231cc51fd5cdeecc5992d33b

  • SHA512

    c30fa98fe8773426e7c14cc73816c5c42c46ffb88dd5a174d9c7be12e2b684fbb02e1a79f4c89d3645c0d1859509b35edd9040d5d9f9d203605db04f644ca6db

  • SSDEEP

    49152:zkXoTqjw/3mkB/JkYq0e+YfsjuVcXDn9sARtKX:ybjw/3mkB/JkHkccXDn9rR

Score
10/10
amadeycryptbotlummaredlinestealc1176f29c9aa5default_valencigadomafed3aatg cloud @rlreborn admin @fatherofcarderscredential_accessdiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

lumma

C2

https://drawwyobstacw.sbs

https://condifendteu.sbs

https://ehticsprocw.sbs

https://vennurviot.sbs

https://resinedyw.sbs

https://enlargkiw.sbs

https://allocatinow.sbs

https://mathcucom.sbs

https://clearancek.site

https://licendfilteo.site

https://spirittunek.store

https://bathdoomgaz.store

https://studennotediw.store

https://dissapoiznw.store

https://eaglepawnoy.store

https://mobbipenju.store

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

89.105.223.196:29862

Extracted

Family

stealc

Botnet

doma

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

C2

http://185.215.113.19

Attributes
  • install_dir

    417fd29867

  • install_file

    ednfoki.exe

  • strings_key

    183201dc3defc4394182b4bff63c4065

  • url_paths

    /CoreOPT/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 13 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 26 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 9 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Executes dropped EXE 31 IoCs
  • Identifies Wine through registry keys 2 TTPs 13 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 5 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 63 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5bd7899aa10cbdc6fe54d890f2be4fc6f5397f1231cc51fd5cdeecc5992d33b.exe
    "C:\Users\Admin\AppData\Local\Temp\a5bd7899aa10cbdc6fe54d890f2be4fc6f5397f1231cc51fd5cdeecc5992d33b.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:400
      • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
        "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:696
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:396
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 696 -s 296
          4⤵
          • Program crash
          PID:1300
      • C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
        "C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3260
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          4⤵
            PID:536
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5072
            • C:\Users\Admin\AppData\Roaming\VUlkg9gNpJ.exe
              "C:\Users\Admin\AppData\Roaming\VUlkg9gNpJ.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4820
            • C:\Users\Admin\AppData\Roaming\GHU2dhddba.exe
              "C:\Users\Admin\AppData\Roaming\GHU2dhddba.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:908
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 260
            4⤵
            • Program crash
            PID:3488
        • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
          "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          PID:4200
        • C:\Users\Admin\AppData\Local\Temp\1000354001\a9cc8cfbfe.exe
          "C:\Users\Admin\AppData\Local\Temp\1000354001\a9cc8cfbfe.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1912
        • C:\Users\Admin\AppData\Local\Temp\1000355001\2ddc41737b.exe
          "C:\Users\Admin\AppData\Local\Temp\1000355001\2ddc41737b.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4400
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4716
            • C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
              "C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1820
            • C:\Users\Admin\AppData\Local\Temp\1000349001\9494e54a71.exe
              "C:\Users\Admin\AppData\Local\Temp\1000349001\9494e54a71.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3488
            • C:\Users\Admin\1000350002\3f792ae61c.exe
              "C:\Users\Admin\1000350002\3f792ae61c.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3264
            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
              5⤵
                PID:636
              • C:\Users\Admin\AppData\Local\Temp\1000357001\c228bc242f.exe
                "C:\Users\Admin\AppData\Local\Temp\1000357001\c228bc242f.exe"
                5⤵
                • Modifies Windows Defender Real-time Protection settings
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Windows security modification
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:448
          • C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
            "C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1420
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • System Location Discovery: System Language Discovery
              • Modifies system certificate store
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2732
          • C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
            "C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3724
            • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
              "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
              4⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:452
              • C:\Users\Admin\AppData\Local\Temp\1000084001\JavUmar.exe
                "C:\Users\Admin\AppData\Local\Temp\1000084001\JavUmar.exe"
                5⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                PID:3676
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:3292
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  6⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:6140
          • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
            "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            PID:1400
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c start context.exe
              4⤵
                PID:4420
                • C:\Users\Admin\AppData\Local\Temp\context.exe
                  context.exe
                  5⤵
                  • Drops startup file
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4676
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    PID:536
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
                      7⤵
                      • System Location Discovery: System Language Discovery
                      PID:1424
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im "InstallUtil.exe"
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Kills process with taskkill
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5880
                      • C:\Windows\SysWOW64\timeout.exe
                        timeout 1
                        8⤵
                        • System Location Discovery: System Language Discovery
                        • Delays execution with timeout.exe
                        PID:6064
            • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
              "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
              3⤵
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:4172
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2856
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:3640
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im "InstallUtil.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3316
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Delays execution with timeout.exe
                    PID:3776
            • C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe
              "C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe"
              3⤵
              • Checks computer location settings
              • Drops startup file
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3500
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADAAMAA0ADIANAAwADAAMQBcAGEAcABwAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADEAMAAwADAANAAyADQAMAAwADEAXABhAHAAcAAuAGUAeABlADsAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABzAHEAZABxAHMAZAAuAGUAeABlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAHMAcQBkAHEAcwBkAC4AZQB4AGUA
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5376
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5668
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                    PID:2648
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    5⤵
                      PID:4360
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      5⤵
                        PID:3228
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        5⤵
                          PID:1876
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          5⤵
                            PID:1436
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            5⤵
                              PID:2168
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              5⤵
                                PID:2188
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                5⤵
                                  PID:3572
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  5⤵
                                    PID:4696
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    5⤵
                                      PID:4340
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 696 -ip 696
                              1⤵
                                PID:452
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3260 -ip 3260
                                1⤵
                                  PID:2796
                                • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                  C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1052
                                • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                  C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:5480
                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5464
                                • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                  C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:5424
                                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                  C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:2560
                                • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4472
                                • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                  C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                  1⤵
                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                  • Checks BIOS information in registry
                                  • Executes dropped EXE
                                  • Identifies Wine through registry keys
                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2832
                                • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                  C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
                                  1⤵
                                  • Executes dropped EXE
                                  PID:2432
                                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                  C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                  1⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:3708

                                Network

                                MITRE ATT&CK Enterprise v15

                                Reconnaissance

                                Resource Development

                                Initial Access

                                Execution

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Persistence

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Privilege Escalation

                                Boot or Logon Autostart Execution

                                1
                                T1547

                                Registry Run Keys / Startup Folder

                                1
                                T1547.001

                                Create or Modify System Process

                                1
                                T1543

                                Windows Service

                                1
                                T1543.003

                                Scheduled Task/Job

                                1
                                T1053

                                Scheduled Task

                                1
                                T1053.005

                                Defense Evasion

                                Impair Defenses

                                2
                                T1562

                                Disable or Modify Tools

                                2
                                T1562.001

                                Modify Registry

                                4
                                T1112

                                Subvert Trust Controls

                                1
                                T1553

                                Install Root Certificate

                                1
                                T1553.004

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Credential Access

                                Credentials from Password Stores

                                1
                                T1555

                                Credentials from Web Browsers

                                1
                                T1555.003

                                Unsecured Credentials

                                4
                                T1552

                                Credentials In Files

                                4
                                T1552.001

                                Discovery

                                Query Registry

                                6
                                T1012

                                System Information Discovery

                                4
                                T1082

                                System Location Discovery

                                1
                                T1614

                                System Language Discovery

                                1
                                T1614.001

                                Virtualization/Sandbox Evasion

                                2
                                T1497

                                Lateral Movement

                                Collection

                                Data from Local System

                                3
                                T1005

                                Command and Control

                                Exfiltration

                                Impact

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\mozglue.dll
                                  Filesize

                                  593KB

                                  MD5

                                  c8fd9be83bc728cc04beffafc2907fe9

                                  SHA1

                                  95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                                  SHA256

                                  ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                                  SHA512

                                  fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                                  Download Submit

                                • C:\ProgramData\nss3.dll
                                  Filesize

                                  2.0MB

                                  MD5

                                  1cc453cdf74f31e4d913ff9c10acdde2

                                  SHA1

                                  6e85eae544d6e965f15fa5c39700fa7202f3aafe

                                  SHA256

                                  ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                                  SHA512

                                  dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
                                  Filesize

                                  566KB

                                  MD5

                                  049b6fe48a8cfb927648ad626aba5551

                                  SHA1

                                  9555d23104167e4fad5a178b4352831ce620b374

                                  SHA256

                                  b78402483c46cd37e2c204d95690aa2a213616a1f904d779ceec0e22fcdd6531

                                  SHA512

                                  ed787f90966ca1ea4b1e67c4026dd44393c7d312cd52e376f4ba5e5c49616938ec9e913044def29b40b441eb4c913a5134bb78317a179f62067bef3f9d913c7e

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
                                  Filesize

                                  1.4MB

                                  MD5

                                  e6d27b60afe69ac02b1eaec864c882ae

                                  SHA1

                                  a72b881867b7eaa9187398bd0e9e144af02ffff4

                                  SHA256

                                  aac36ff20ea7bfc0591c1d6b145b456bad394ee8e619343ec10d1809188edd75

                                  SHA512

                                  4f11fc2b36589fc9ff7dc5afd27cb91614f6a89bfd60942baebef025f53cb56ed7413abeff57fc7c85b3a2a4b0feec2649d5c5a856d3e2e9c13f6a0d8c777764

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                                  Filesize

                                  307KB

                                  MD5

                                  68a99cf42959dc6406af26e91d39f523

                                  SHA1

                                  f11db933a83400136dc992820f485e0b73f1b933

                                  SHA256

                                  c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

                                  SHA512

                                  7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000084001\JavUmar.exe
                                  Filesize

                                  6.5MB

                                  MD5

                                  3394808f2d5c141b86e33a51ace8a577

                                  SHA1

                                  2bb0408fff0e02cbe8bd35cf0fe12e63d5bd08e1

                                  SHA256

                                  277eafa55c929bc4c805bd1d540d2385922ddcc26ad360af7b947987ca45e758

                                  SHA512

                                  b125c00020afdf9ea17f49e01120bafff27cd10752a018dcdf3d064fa371991654a18d86cbe1accbec67e3f05ff0d6d0b2f4237c093acea43cef4fd206b7ad6a

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
                                  Filesize

                                  307KB

                                  MD5

                                  791fcee57312d4a20cc86ae1cea8dfc4

                                  SHA1

                                  04a88c60ae1539a63411fe4765e9b931e8d2d992

                                  SHA256

                                  27e4a3627d7df2b22189dd4bebc559ae1986d49a8f4e35980b428fadb66cf23d

                                  SHA512

                                  2771d4e7b272bf770efad22c9fb1dfafe10cbbf009df931f091fb543e3132c0efda16acb5b515452e9e67e8b1fc8fe8aedd1376c236061385f026865cdc28d2c

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000349001\9494e54a71.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  c835b3829e2ad7dc5328fef966de774d

                                  SHA1

                                  1875535dfaa2b37c1f79e78119fd7884825d3cfc

                                  SHA256

                                  a51b56091167bcddcaa9a742391d5bd9df1ebbfd6b0453bc13de9022173b067f

                                  SHA512

                                  2f941c9ab363333a5ea77f865363baf6a27a9cb3fa118732dbf04ab62ede0d58a7b89ef7a47253dbd6bd5fa7a845b800b35e17d5735fdd879b92c8a25ca07bf0

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000354001\a9cc8cfbfe.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  db621dfa3fbe8d0eef863a6f8a098a22

                                  SHA1

                                  71161861bbf2ba5bc3fbbcbb7d9249d7bc5d9483

                                  SHA256

                                  590e62aee1fe727034148ad4ef00b8ee7e27310065f5b5fe41ba21d503e2abe4

                                  SHA512

                                  ad651d9e9ee79a4113c990cefc18b280b4150d0071e7be3cfd102beec46b97c216af96c3bde923822e7be58633ff5c87fc50060f198c430c93a15dea5b40a802

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000355001\2ddc41737b.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  71c580d3178541cae696bf7201f86967

                                  SHA1

                                  32d3dbb64fbd806f9c596a15f3f78675c8614a06

                                  SHA256

                                  cb05ee3354e709d37ae5d53f64026bdcb809ecd3063b75a0fbe2acc2206b21aa

                                  SHA512

                                  736a07dc82c915f62b8482058d8f3754f5dbf21192b209102196c48e063909facfc58b416edffe94927fbb09311930720ff706aafce91d5b4a683cdcbd3b19ae

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000357001\c228bc242f.exe
                                  Filesize

                                  1.6MB

                                  MD5

                                  9f875cd80ee26b55a71c2f795eb01c33

                                  SHA1

                                  e71f7e13477c83c59c50cb975c3d893dae12d2ff

                                  SHA256

                                  a599f8e501bc4a1a7f1ed10b05b5b6fe4c6f13c40c1065af952740880123bfb9

                                  SHA512

                                  811ab159ef2868b6458f53784e639020eff3411f5063d76497d91a519ed78976e139d9deb726aef6acf2c6cc06838abf302875905dc9d4c1ef4f5e8802602394

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
                                  Filesize

                                  314KB

                                  MD5

                                  ff5afed0a8b802d74af1c1422c720446

                                  SHA1

                                  7135acfa641a873cb0c4c37afc49266bfeec91d8

                                  SHA256

                                  17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10

                                  SHA512

                                  11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
                                  Filesize

                                  416KB

                                  MD5

                                  f5d7b79ee6b6da6b50e536030bcc3b59

                                  SHA1

                                  751b555a8eede96d55395290f60adc43b28ba5e2

                                  SHA256

                                  2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                                  SHA512

                                  532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
                                  Filesize

                                  6KB

                                  MD5

                                  c042782226565f89ce3954489075e516

                                  SHA1

                                  256dd5ba42837a33c7aa6cb71cef33d5617117ee

                                  SHA256

                                  a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

                                  SHA512

                                  9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
                                  Filesize

                                  1.1MB

                                  MD5

                                  ed9393d5765529c845c623e35c1b1a34

                                  SHA1

                                  d3eca07f5ce0df847070d2d7fe5253067f624285

                                  SHA256

                                  53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a

                                  SHA512

                                  565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\1000424001\app.exe
                                  Filesize

                                  20.4MB

                                  MD5

                                  7172ee8de6490094d4a5112eceaaaa90

                                  SHA1

                                  46a82d7628f31d91fb883056dfbd4d15d26bbd77

                                  SHA256

                                  11cabbb368deb30bc1f45feb6509b222c2b360707ff31c8b1e056c617477f28e

                                  SHA512

                                  91e2da0921f8d2596ac2e99e91b108e4d7dba6a97800c775bc9d9b4411fae3b7f0d811f48b107054664aff69c7cdd2c052220960cec9c525470f7266de5780d8

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\409013623608
                                  Filesize

                                  79KB

                                  MD5

                                  682fe57b91ddb52d6abc52f8df35ce28

                                  SHA1

                                  9e6f726515782d8773cd641e653ec3bbe9df8d33

                                  SHA256

                                  6314671a0ddc1bda270b4e13d0f7e0d44c8b10c26c478da7a4aeb43e3b3a9794

                                  SHA512

                                  16969bfc654a2d5cc0b27b8185203df22f6cd4ac62b8f43b10230d3b9c162d16d5bce831bff4ec297cf6a5b47c55f9ef1331269c8738b92e4208ac3a861838db

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                                  Filesize

                                  1.8MB

                                  MD5

                                  a359113458b37da999c3dd72d1933391

                                  SHA1

                                  de4c51dd690c8a227336a1044a9025fb330c51f0

                                  SHA256

                                  a5bd7899aa10cbdc6fe54d890f2be4fc6f5397f1231cc51fd5cdeecc5992d33b

                                  SHA512

                                  c30fa98fe8773426e7c14cc73816c5c42c46ffb88dd5a174d9c7be12e2b684fbb02e1a79f4c89d3645c0d1859509b35edd9040d5d9f9d203605db04f644ca6db

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\TmpB769.tmp
                                  Filesize

                                  2KB

                                  MD5

                                  1420d30f964eac2c85b2ccfe968eebce

                                  SHA1

                                  bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                                  SHA256

                                  f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                                  SHA512

                                  6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ymli3ij3.kha.ps1
                                  Filesize

                                  60B

                                  MD5

                                  d17fe0a3f47be24a6453e9ef58c94641

                                  SHA1

                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                  SHA256

                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                  SHA512

                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\GHU2dhddba.exe
                                  Filesize

                                  393KB

                                  MD5

                                  7d7366ab79d6d3d8d83d13a8b30de999

                                  SHA1

                                  75c6c49a6701d254c3ce184054a4a01329c1a6f3

                                  SHA256

                                  3d66fed04c76d055c6149b33dcfda544b509c57087c57a861e1d6256b59f8465

                                  SHA512

                                  64f4551b3be1c21ce7c2d49608463e5aec4166e3e6893883c33a5b7d1109ef0fc8ab6bd15c70d9d606e2706f12a937c2d90d5bc8f6c629ad6f30f212dc25f022

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url
                                  Filesize

                                  70B

                                  MD5

                                  1c5c0d2105718982915d88e1e34b7c24

                                  SHA1

                                  ecb11df5274a3a37c81fc19b95ec316d39bb6f03

                                  SHA256

                                  b5fd05a1a23d90dee32a1f61158a1e0859fde6882b289267c90845bb995b0c09

                                  SHA512

                                  9e1f86ca561c034078acbce22e6b3b2dc938a883f4897167c96ad7c61f28d30075d66557335825c18a00f96467fbd1dee067bb756388ba60b21443ba964ba331

                                  Download Submit

                                • C:\Users\Admin\AppData\Roaming\VUlkg9gNpJ.exe
                                  Filesize

                                  602KB

                                  MD5

                                  e4fc58d334930a9d6572c344e5129f6b

                                  SHA1

                                  d38fbd0c4c86eee14722f40cc607e2128c01b00f

                                  SHA256

                                  973a9056040af402d6f92f436a287ea164fae09c263f80aba0b8d5366ed9957a

                                  SHA512

                                  a69f5da8de8c9782769cca2e2fc5b28bbeba0c0d0027954dbe47b15610d82277abbe912f0e5921a18000f1a3a3c54eb5922f70c773537a22f4b35ff926d17a59

                                  Download Submit

                                • memory/396-43-0x0000000000400000-0x0000000000463000-memory.dmp

                                  Filesize

                                  396KB

                                  Download

                                • memory/396-46-0x0000000000400000-0x0000000000463000-memory.dmp

                                  Filesize

                                  396KB

                                  Download

                                • memory/396-45-0x0000000000400000-0x0000000000463000-memory.dmp

                                  Filesize

                                  396KB

                                  Download

                                • memory/400-512-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/400-130-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/400-21-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/400-20-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/400-19-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/400-16-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/400-486-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/400-202-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/400-129-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/400-401-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/400-448-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/400-132-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/400-107-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/448-492-0x0000000000480000-0x00000000008D0000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/448-475-0x0000000000480000-0x00000000008D0000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/448-477-0x0000000000480000-0x00000000008D0000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/448-470-0x0000000000480000-0x00000000008D0000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/448-496-0x0000000000480000-0x00000000008D0000-memory.dmp

                                  Filesize

                                  4.3MB

                                  Download

                                • memory/696-42-0x0000000000D77000-0x0000000000D78000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/908-89-0x0000000000430000-0x0000000000498000-memory.dmp

                                  Filesize

                                  416KB

                                  Download

                                • memory/908-154-0x000000001F390000-0x000000001F8B8000-memory.dmp

                                  Filesize

                                  5.2MB

                                  Download

                                • memory/908-153-0x000000001EC90000-0x000000001EE52000-memory.dmp

                                  Filesize

                                  1.8MB

                                  Download

                                • memory/908-134-0x000000001B3B0000-0x000000001B3CE000-memory.dmp

                                  Filesize

                                  120KB

                                  Download

                                • memory/908-112-0x000000001BE20000-0x000000001BE32000-memory.dmp

                                  Filesize

                                  72KB

                                  Download

                                • memory/908-111-0x000000001D640000-0x000000001D74A000-memory.dmp

                                  Filesize

                                  1.0MB

                                  Download

                                • memory/1052-110-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/1052-108-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/1400-323-0x0000000000400000-0x0000000000408000-memory.dmp

                                  Filesize

                                  32KB

                                  Download

                                • memory/1404-4-0x0000000000470000-0x0000000000924000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/1404-0-0x0000000000470000-0x0000000000924000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/1404-18-0x0000000000470000-0x0000000000924000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/1404-1-0x0000000077194000-0x0000000077196000-memory.dmp

                                  Filesize

                                  8KB

                                  Download

                                • memory/1404-2-0x0000000000471000-0x000000000049F000-memory.dmp

                                  Filesize

                                  184KB

                                  Download

                                • memory/1404-3-0x0000000000470000-0x0000000000924000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/1420-228-0x0000000000D80000-0x0000000000DD4000-memory.dmp

                                  Filesize

                                  336KB

                                  Download

                                • memory/1420-229-0x0000000005CB0000-0x0000000006254000-memory.dmp

                                  Filesize

                                  5.6MB

                                  Download

                                • memory/1820-404-0x0000000000730000-0x0000000000991000-memory.dmp

                                  Filesize

                                  2.4MB

                                  Download

                                • memory/1820-344-0x0000000000730000-0x0000000000991000-memory.dmp

                                  Filesize

                                  2.4MB

                                  Download

                                • memory/1912-349-0x00000000007C0000-0x0000000000E5D000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/1912-348-0x00000000007C0000-0x0000000000E5D000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/1912-400-0x00000000007C0000-0x0000000000E5D000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/1912-131-0x00000000007C0000-0x0000000000E5D000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/2732-233-0x0000000005330000-0x00000000053C2000-memory.dmp

                                  Filesize

                                  584KB

                                  Download

                                • memory/2732-258-0x00000000071B0000-0x00000000077C8000-memory.dmp

                                  Filesize

                                  6.1MB

                                  Download

                                • memory/2732-231-0x0000000000400000-0x0000000000452000-memory.dmp

                                  Filesize

                                  328KB

                                  Download

                                • memory/2732-254-0x0000000006170000-0x00000000061E6000-memory.dmp

                                  Filesize

                                  472KB

                                  Download

                                • memory/2732-270-0x0000000007140000-0x000000000718C000-memory.dmp

                                  Filesize

                                  304KB

                                  Download

                                • memory/2732-255-0x0000000006820000-0x000000000683E000-memory.dmp

                                  Filesize

                                  120KB

                                  Download

                                • memory/2732-369-0x0000000006C30000-0x0000000006C96000-memory.dmp

                                  Filesize

                                  408KB

                                  Download

                                • memory/2732-268-0x00000000070A0000-0x00000000070B2000-memory.dmp

                                  Filesize

                                  72KB

                                  Download

                                • memory/2732-373-0x0000000009370000-0x00000000093C0000-memory.dmp

                                  Filesize

                                  320KB

                                  Download

                                • memory/2732-269-0x0000000007100000-0x000000000713C000-memory.dmp

                                  Filesize

                                  240KB

                                  Download

                                • memory/2732-267-0x0000000008A30000-0x0000000008B3A000-memory.dmp

                                  Filesize

                                  1.0MB

                                  Download

                                • memory/2732-234-0x0000000005310000-0x000000000531A000-memory.dmp

                                  Filesize

                                  40KB

                                  Download

                                • memory/2732-397-0x000000000A530000-0x000000000A6F2000-memory.dmp

                                  Filesize

                                  1.8MB

                                  Download

                                • memory/2732-398-0x000000000AC30000-0x000000000B15C000-memory.dmp

                                  Filesize

                                  5.2MB

                                  Download

                                • memory/2856-488-0x0000000000400000-0x0000000000471000-memory.dmp

                                  Filesize

                                  452KB

                                  Download

                                • memory/2856-478-0x0000000000400000-0x0000000000471000-memory.dmp

                                  Filesize

                                  452KB

                                  Download

                                • memory/2856-480-0x0000000000400000-0x0000000000471000-memory.dmp

                                  Filesize

                                  452KB

                                  Download

                                • memory/2856-479-0x0000000000400000-0x0000000000471000-memory.dmp

                                  Filesize

                                  452KB

                                  Download

                                • memory/3264-446-0x00000000002B0000-0x000000000094D000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/3264-420-0x00000000002B0000-0x000000000094D000-memory.dmp

                                  Filesize

                                  6.6MB

                                  Download

                                • memory/3488-403-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3488-396-0x0000000000650000-0x0000000000AFC000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/3500-524-0x00000000078A0000-0x00000000079C5000-memory.dmp

                                  Filesize

                                  1.1MB

                                  Download

                                • memory/3500-1594-0x0000000007A90000-0x0000000007B36000-memory.dmp

                                  Filesize

                                  664KB

                                  Download

                                • memory/3500-1669-0x0000000003E80000-0x0000000003ED4000-memory.dmp

                                  Filesize

                                  336KB

                                  Download

                                • memory/3500-518-0x00000000078A0000-0x00000000079CC000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/3500-528-0x00000000078A0000-0x00000000079C5000-memory.dmp

                                  Filesize

                                  1.1MB

                                  Download

                                • memory/3500-1595-0x0000000007CA0000-0x0000000007CEC000-memory.dmp

                                  Filesize

                                  304KB

                                  Download

                                • memory/3500-526-0x00000000078A0000-0x00000000079C5000-memory.dmp

                                  Filesize

                                  1.1MB

                                  Download

                                • memory/3500-522-0x00000000078A0000-0x00000000079C5000-memory.dmp

                                  Filesize

                                  1.1MB

                                  Download

                                • memory/3500-520-0x00000000078A0000-0x00000000079C5000-memory.dmp

                                  Filesize

                                  1.1MB

                                  Download

                                • memory/3500-516-0x00000000008A0000-0x0000000001D06000-memory.dmp

                                  Filesize

                                  20.4MB

                                  Download

                                • memory/3500-519-0x00000000078A0000-0x00000000079C5000-memory.dmp

                                  Filesize

                                  1.1MB

                                  Download

                                • memory/3676-436-0x0000000069CC0000-0x000000006A377000-memory.dmp

                                  Filesize

                                  6.7MB

                                  Download

                                • memory/3676-450-0x0000000000F60000-0x00000000015E5000-memory.dmp

                                  Filesize

                                  6.5MB

                                  Download

                                • memory/4172-368-0x0000000000610000-0x0000000000728000-memory.dmp

                                  Filesize

                                  1.1MB

                                  Download

                                • memory/4172-372-0x000000000B3A0000-0x000000000B424000-memory.dmp

                                  Filesize

                                  528KB

                                  Download

                                • memory/4200-346-0x0000000000E40000-0x00000000010A1000-memory.dmp

                                  Filesize

                                  2.4MB

                                  Download

                                • memory/4200-135-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                  Filesize

                                  972KB

                                  Download

                                • memory/4200-105-0x0000000000E40000-0x00000000010A1000-memory.dmp

                                  Filesize

                                  2.4MB

                                  Download

                                • memory/4400-201-0x0000000000BF0000-0x00000000010B8000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/4400-179-0x0000000000BF0000-0x00000000010B8000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/4716-395-0x00000000001C0000-0x0000000000688000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/4716-489-0x00000000001C0000-0x0000000000688000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/4716-203-0x00000000001C0000-0x0000000000688000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/4716-517-0x00000000001C0000-0x0000000000688000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/4716-402-0x00000000001C0000-0x0000000000688000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/4716-449-0x00000000001C0000-0x0000000000688000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/4820-113-0x000000001DE90000-0x000000001DECC000-memory.dmp

                                  Filesize

                                  240KB

                                  Download

                                • memory/4820-133-0x000000001EBB0000-0x000000001EC26000-memory.dmp

                                  Filesize

                                  472KB

                                  Download

                                • memory/4820-88-0x0000000000A30000-0x0000000000ACC000-memory.dmp

                                  Filesize

                                  624KB

                                  Download

                                • memory/5072-85-0x0000000000400000-0x0000000000531000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/5072-64-0x0000000000400000-0x0000000000531000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/5072-62-0x0000000000400000-0x0000000000531000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/5072-63-0x0000000000400000-0x0000000000531000-memory.dmp

                                  Filesize

                                  1.2MB

                                  Download

                                • memory/5376-1599-0x0000000002F80000-0x0000000002FB6000-memory.dmp

                                  Filesize

                                  216KB

                                  Download

                                • memory/5376-1647-0x0000000007DD0000-0x0000000007DE1000-memory.dmp

                                  Filesize

                                  68KB

                                  Download

                                • memory/5376-1613-0x0000000006890000-0x00000000068AE000-memory.dmp

                                  Filesize

                                  120KB

                                  Download

                                • memory/5376-1614-0x00000000068F0000-0x000000000693C000-memory.dmp

                                  Filesize

                                  304KB

                                  Download

                                • memory/5376-1616-0x000000006F280000-0x000000006F2CC000-memory.dmp

                                  Filesize

                                  304KB

                                  Download

                                • memory/5376-1615-0x0000000007840000-0x0000000007872000-memory.dmp

                                  Filesize

                                  200KB

                                  Download

                                • memory/5376-1627-0x0000000006E70000-0x0000000006E8E000-memory.dmp

                                  Filesize

                                  120KB

                                  Download

                                • memory/5376-1628-0x0000000007A90000-0x0000000007B33000-memory.dmp

                                  Filesize

                                  652KB

                                  Download

                                • memory/5376-1635-0x0000000008210000-0x000000000888A000-memory.dmp

                                  Filesize

                                  6.5MB

                                  Download

                                • memory/5376-1636-0x0000000007BD0000-0x0000000007BEA000-memory.dmp

                                  Filesize

                                  104KB

                                  Download

                                • memory/5376-1607-0x00000000061F0000-0x0000000006256000-memory.dmp

                                  Filesize

                                  408KB

                                  Download

                                • memory/5376-1640-0x0000000007C40000-0x0000000007C4A000-memory.dmp

                                  Filesize

                                  40KB

                                  Download

                                • memory/5376-1646-0x0000000007E50000-0x0000000007EE6000-memory.dmp

                                  Filesize

                                  600KB

                                  Download

                                • memory/5376-1612-0x0000000006420000-0x0000000006774000-memory.dmp

                                  Filesize

                                  3.3MB

                                  Download

                                • memory/5376-1649-0x0000000007E00000-0x0000000007E0E000-memory.dmp

                                  Filesize

                                  56KB

                                  Download

                                • memory/5376-1655-0x0000000007E10000-0x0000000007E24000-memory.dmp

                                  Filesize

                                  80KB

                                  Download

                                • memory/5376-1656-0x0000000007F10000-0x0000000007F2A000-memory.dmp

                                  Filesize

                                  104KB

                                  Download

                                • memory/5376-1657-0x0000000007EF0000-0x0000000007EF8000-memory.dmp

                                  Filesize

                                  32KB

                                  Download

                                • memory/5376-1601-0x00000000059E0000-0x0000000005A02000-memory.dmp

                                  Filesize

                                  136KB

                                  Download

                                • memory/5376-1600-0x0000000005B50000-0x0000000006178000-memory.dmp

                                  Filesize

                                  6.2MB

                                  Download

                                • memory/5424-1679-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5424-1683-0x0000000000380000-0x0000000000834000-memory.dmp

                                  Filesize

                                  4.7MB

                                  Download

                                • memory/5464-1677-0x00000000001C0000-0x0000000000688000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/5464-1681-0x00000000001C0000-0x0000000000688000-memory.dmp

                                  Filesize

                                  4.8MB

                                  Download

                                • memory/5668-1674-0x0000000005120000-0x00000000051DC000-memory.dmp

                                  Filesize

                                  752KB

                                  Download

                                • memory/5668-1692-0x0000000006A20000-0x0000000006B0A000-memory.dmp

                                  Filesize

                                  936KB

                                  Download

                                • memory/5668-1673-0x0000000000400000-0x000000000045E000-memory.dmp

                                  Filesize

                                  376KB

                                  Download