Overview

overview

10

Static

static

3

7b1f4d77a4...9N.exe

windows7-x64

10

7b1f4d77a4...9N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    96s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    22-10-2024 05:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe

  • Size

    1.8MB

  • MD5

    73d71ec379a8f5978f4d1eaee373e5b0

  • SHA1

    32c309bc28ecf5a1bbcdd8f68af4c7f2679cc90c

  • SHA256

    7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79

  • SHA512

    00829c741b1c8a14dfb3fd49b401924d9b907915c9be4576355c6f5ce895e6ee8a62fb1cb9b5f6626c17b09530a97ab3b5b9e82560b3f7d47f663b8ef3efc202

  • SSDEEP

    49152:4FCqIhjny2gD4deftUZzmPujFmGM0+OpNljjG:4FCqIRy7D3tEu83DF

Score
10/10
amadeylummaredlinestealc1176f2default_valencigafed3aatg cloud @rlreborn admin @fatherofcarderscredential_accessdiscoveryevasioninfostealerspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

lumma

C2

https://snailyeductyi.sbs

https://ferrycheatyk.sbs

https://deepymouthi.sbs

https://wrigglesight.sbs

https://captaitwik.sbs

https://sidercotay.sbs

https://heroicmint.sbs

https://monstourtu.sbs

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

89.105.223.196:29155

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

C2

http://185.215.113.19

Attributes
  • install_dir

    417fd29867

  • install_file

    ednfoki.exe

  • strings_key

    183201dc3defc4394182b4bff63c4065

  • url_paths

    /CoreOPT/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 5 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 19 IoCs
  • Identifies Wine through registry keys 2 TTPs 2 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 38 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 15 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
    "C:\Users\Admin\AppData\Local\Temp\7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2320
      • C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
        "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1112
        • C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
          4⤵
          • Executes dropped EXE
          PID:2932
        • C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2432
          • C:\Users\Admin\AppData\Roaming\Apgng2zULb.exe
            "C:\Users\Admin\AppData\Roaming\Apgng2zULb.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:740
          • C:\Users\Admin\AppData\Roaming\6qmp2N3aM1.exe
            "C:\Users\Admin\AppData\Roaming\6qmp2N3aM1.exe"
            5⤵
            • Executes dropped EXE
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1036
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 60
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:1756
      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:304
      • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
        "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:576
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start context.exe
          4⤵
            PID:2996
            • C:\Users\Admin\AppData\Local\Temp\context.exe
              context.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2592
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 728
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2156
        • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
          "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:1768
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2800
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2588
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im "InstallUtil.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2928
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                6⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:2712
        • C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
          "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:556
          • C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
            "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
            4⤵
            • Executes dropped EXE
            PID:1956
          • C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
            "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:1920
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 556 -s 60
            4⤵
            • Loads dropped DLL
            • Program crash
            PID:2360
        • C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe
          "C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          PID:2556
          • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
            "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            PID:2844
            • C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:3064
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
                6⤵
                • Uses browser remote debugging
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                PID:2864
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6e79758,0x7fef6e79768,0x7fef6e79778
                  7⤵
                    PID:3004
                  • C:\Windows\system32\ctfmon.exe
                    ctfmon.exe
                    7⤵
                      PID:1480
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1116 --field-trial-handle=1288,i,12695363728438877570,12960697126133017658,131072 /prefetch:2
                      7⤵
                        PID:884
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1288,i,12695363728438877570,12960697126133017658,131072 /prefetch:8
                        7⤵
                          PID:1748
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1288,i,12695363728438877570,12960697126133017658,131072 /prefetch:8
                          7⤵
                            PID:1780
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2144 --field-trial-handle=1288,i,12695363728438877570,12960697126133017658,131072 /prefetch:1
                            7⤵
                            • Uses browser remote debugging
                            PID:2268
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2152 --field-trial-handle=1288,i,12695363728438877570,12960697126133017658,131072 /prefetch:1
                            7⤵
                            • Uses browser remote debugging
                            PID:936
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1388 --field-trial-handle=1288,i,12695363728438877570,12960697126133017658,131072 /prefetch:2
                            7⤵
                              PID:2132
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3332 --field-trial-handle=1288,i,12695363728438877570,12960697126133017658,131072 /prefetch:1
                              7⤵
                              • Uses browser remote debugging
                              PID:2532
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3532 --field-trial-handle=1288,i,12695363728438877570,12960697126133017658,131072 /prefetch:8
                              7⤵
                                PID:1764
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3484 --field-trial-handle=1288,i,12695363728438877570,12960697126133017658,131072 /prefetch:8
                                7⤵
                                  PID:1684
                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                                6⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:1500
                              • C:\Windows\SysWOW64\schtasks.exe
                                "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                                6⤵
                                • System Location Discovery: System Language Discovery
                                • Scheduled Task/Job: Scheduled Task
                                PID:1712
                        • C:\Users\Admin\AppData\Local\Temp\1000478001\black123.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000478001\black123.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • System Location Discovery: System Language Discovery
                          PID:1764
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                            4⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:288
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1764 -s 52
                            4⤵
                            • Loads dropped DLL
                            • Program crash
                            PID:2904
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:856
                      • C:\Windows\system32\taskeng.exe
                        taskeng.exe {8C485CD0-6844-4580-8301-EE03A54F10E5} S-1-5-21-2872745919-2748461613-2989606286-1000:CCJBVTGQ\Admin:Interactive:[1]
                        1⤵
                          PID:1716
                          • C:\Users\Admin\AppData\Local\Temp\service123.exe
                            C:\Users\Admin\AppData\Local\Temp\/service123.exe
                            2⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:2624

                        Network

                        MITRE ATT&CK Enterprise v15

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Persistence

                        Modify Authentication Process

                        1
                        T1556

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Modify Authentication Process

                        1
                        T1556

                        Modify Registry

                        1
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Modify Authentication Process

                        1
                        T1556

                        Steal Web Session Cookie

                        1
                        T1539

                        Unsecured Credentials

                        4
                        T1552

                        Credentials In Files

                        4
                        T1552.001

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Query Registry

                        6
                        T1012

                        System Information Discovery

                        4
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Lateral Movement

                        Collection

                        Data from Local System

                        3
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          342B

                          MD5

                          6ae9d44eeb99c5a0c59e3dd62804137d

                          SHA1

                          d8aa4a50f09d56aae3dfada37c769b786323b9f4

                          SHA256

                          3ba7878207c8f5e77f5fea29f45a6fc0d6f9d71d352644e2bf35eb05fc943b41

                          SHA512

                          f3a513a88b7ee1d66aa8914261d8820486dbad2fa0ae68a8744ad8e9d52f84abdf3bd8062f2a7aafc7249a01b3b5f96adfc441801337ade770e1ea5fd7dc2a02

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          342B

                          MD5

                          c1bd8545c4505172e00d2c5f1fd9d464

                          SHA1

                          e9393ca5da33913d9f1f22615c4e9466fad1d4af

                          SHA256

                          6c9a69c21b83c25eb8dff25453874621a2ff7b845a4a1dce4ea7d357f68dca13

                          SHA512

                          b978916b9dd4244b9f2ade6b12b4932eea710fb3580867d90dd5714013b09500306ad0e89bff0add6fe3228cc9bf13dfc2332ddc9e5cb450ede263a2c0d12374

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          342B

                          MD5

                          329508598c6fb666b3132d14afe0b00e

                          SHA1

                          47d5e4ea04af8da67d4b2dfd921c040ac843e850

                          SHA256

                          9d7ef8e2fae7b6ae1a39bd1e6c1ea6efa58469a24160638c2fecf55ea7ba9b69

                          SHA512

                          da59e40b13b416f8cca9fa44840b968ca296c660c3c89c8e8cb58a51bd77a6f221952fa3ef899f4a271336f8a98a177082c0b4ed1a2cd49cc60818344d364888

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          342B

                          MD5

                          159a600325afba4ffb82facd1eeb3e29

                          SHA1

                          56d961e54a653e4fc8d38e8d004d87a538db7931

                          SHA256

                          5e74b2d0d8de4c8f9809ea6b689d7091ed436fe46742d89ab18f53502be778be

                          SHA512

                          b1603d12fade28e3c45a70dcf9da4809da7c6fea04a895f5f5d798c4889f7b6aea21814cf522a87b3b1eb4ff7630efff00041304d39a6541a55018da49045cb0

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          342B

                          MD5

                          7a7bdc72de9c8558a0bcc6a2dc754e16

                          SHA1

                          abca49ed02a4b2805e9d36a2de216a1eac4c153a

                          SHA256

                          8b5cd53774ecb5bc18e90a72922ff25d75983ed2eb3c5e72f4feed57b1619852

                          SHA512

                          96508cef7e67ee59376e9e16d0c53af6666d7cb3f34db1a0f611349814879dd037c54211ce78914cef2d7cde8550716871a8a2fb9383119dafd5e7e8fb09f4ab

                          Download Submit

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                          Filesize

                          342B

                          MD5

                          0543b072018191187775419138bdc202

                          SHA1

                          743036f37b551d2a02e1e108b6da0afa2e16e8e0

                          SHA256

                          d0767e1984c3919dfaad5e874c8cb0d8a187cc63ce02d35645a29199333ed8ed

                          SHA512

                          e36181da8792754e28347b7b025dda4431e6af215a0cdb1974711e1fb11a61f799c8e747b31be02cdccf1f9be9c5b6884fbab1afc79b30eb38101c9543393d45

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000007.dbtmp
                          Filesize

                          16B

                          MD5

                          18e723571b00fb1694a3bad6c78e4054

                          SHA1

                          afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                          SHA256

                          8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                          SHA512

                          43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                          Filesize

                          264KB

                          MD5

                          f50f89a0a91564d0b8a211f8921aa7de

                          SHA1

                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                          SHA256

                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                          SHA512

                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
                          Filesize

                          1.3MB

                          MD5

                          d419a0a5a81da8360c3db8c358e7492e

                          SHA1

                          a4fa4a9cd4143b152c52c678dd2433379d5c5b7b

                          SHA256

                          c8718abc923b7a8f552445edb5a69ff56c76cd73d4703ec8acfe02a0ce0cb5b2

                          SHA512

                          8b02a250070de14eebcdea2688302bf0701005cbb64d89684fb45da1284828bda89241beab60565c1c8d6c4a20c5f5510afda92aa170babb6dc8efba087c023e

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                          Filesize

                          307KB

                          MD5

                          68a99cf42959dc6406af26e91d39f523

                          SHA1

                          f11db933a83400136dc992820f485e0b73f1b933

                          SHA256

                          c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

                          SHA512

                          7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000099001\2927.exe
                          Filesize

                          1KB

                          MD5

                          5343c1a8b203c162a3bf3870d9f50fd4

                          SHA1

                          04b5b886c20d88b57eea6d8ff882624a4ac1e51d

                          SHA256

                          dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f

                          SHA512

                          e0f50acb6061744e825a4051765cebf23e8c489b55b190739409d8a79bb08dac8f919247a4e5f65a015ea9c57d326bbef7ea045163915129e01f316c4958d949

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe
                          Filesize

                          12.2MB

                          MD5

                          b4a7565f5fe7f3fa54fa55734c050695

                          SHA1

                          cb059c204ec0c030e29d41cddc7bc7e96a552b20

                          SHA256

                          e1475c8d8760880e5d874a7bacb983cedda7691e507f7b1f89269333063239cc

                          SHA512

                          72591ddf64e0d14dbb717ebeaf12feb559e49309541ab7035b3ea3f3005e25a8533a934764cc1bd6befe820c3e8d8371e356f68de3aee6a67f1e1b7d7f9e61ae

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000354001\767ccfb6f8.exe
                          Filesize

                          277B

                          MD5

                          d052d5386c0cea6928e36a0eea7cb777

                          SHA1

                          f01c44f9773efa1b5262956f225d24b1076fd2ff

                          SHA256

                          d96c85af3bdfc77361de9732c018a7bc7c623771e9a29331c793b6f9ff399fd0

                          SHA512

                          b8490ff4534ceca05c8ffe0a1f753681951d94117a5a6a06639f1372df9d45f0fc2402f7126526c88e911e4c73ea64917212bb07716b3bbb0d2ff6d9de52e05f

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
                          Filesize

                          6KB

                          MD5

                          c042782226565f89ce3954489075e516

                          SHA1

                          256dd5ba42837a33c7aa6cb71cef33d5617117ee

                          SHA256

                          a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

                          SHA512

                          9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
                          Filesize

                          1.1MB

                          MD5

                          ed9393d5765529c845c623e35c1b1a34

                          SHA1

                          d3eca07f5ce0df847070d2d7fe5253067f624285

                          SHA256

                          53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a

                          SHA512

                          565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
                          Filesize

                          551KB

                          MD5

                          3a0f1fe734b215e85f47816085e425c9

                          SHA1

                          30a3ddb576c2f0eeb1bfc718b30266123eb1e474

                          SHA256

                          ec189d42b19d842d94772287dd02c5b2a2a6a79fce75f2f132111820646b8fba

                          SHA512

                          840546dbba54a94452eaf069dbbb53fd00fdf42dff20ce5722226a1a25b7410731dfd7ad01c04ca97b269aabbd46cead03cd82e52ed49ba6ea1f6c5bdba37189

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe
                          Filesize

                          416KB

                          MD5

                          f5d7b79ee6b6da6b50e536030bcc3b59

                          SHA1

                          751b555a8eede96d55395290f60adc43b28ba5e2

                          SHA256

                          2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                          SHA512

                          532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\1000478001\black123.exe
                          Filesize

                          515KB

                          MD5

                          a904ae8b26c7d421140be930266ed425

                          SHA1

                          c2e246b9197c18d6d40d9477a8e9a2d74a83b0e2

                          SHA256

                          9d3380ee1ccaae63ca9f39e86630ffe877d0e3ecb711d87dc02350922595dc84

                          SHA512

                          2dbd601a564f7ffc1609bfb05ed55d57afb9bdd9bec1e9091deb53fcfa9fa02a7ba59825f2b9c3777d2016d724a8263808331356f569a1ecae585422e040f3be

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                          Filesize

                          1.8MB

                          MD5

                          73d71ec379a8f5978f4d1eaee373e5b0

                          SHA1

                          32c309bc28ecf5a1bbcdd8f68af4c7f2679cc90c

                          SHA256

                          7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79

                          SHA512

                          00829c741b1c8a14dfb3fd49b401924d9b907915c9be4576355c6f5ce895e6ee8a62fb1cb9b5f6626c17b09530a97ab3b5b9e82560b3f7d47f663b8ef3efc202

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\CabCFDD.tmp
                          Filesize

                          70KB

                          MD5

                          49aebf8cbd62d92ac215b2923fb1b9f5

                          SHA1

                          1723be06719828dda65ad804298d0431f6aff976

                          SHA256

                          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                          SHA512

                          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\TarD03D.tmp
                          Filesize

                          181KB

                          MD5

                          4ea6026cf93ec6338144661bf1202cd1

                          SHA1

                          a1dec9044f750ad887935a01430bf49322fbdcb7

                          SHA256

                          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                          SHA512

                          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                          Download Submit

                        • C:\Users\Admin\AppData\Local\Temp\TmpDA97.tmp
                          Filesize

                          2KB

                          MD5

                          1420d30f964eac2c85b2ccfe968eebce

                          SHA1

                          bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                          SHA256

                          f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                          SHA512

                          6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                          Download Submit

                        • C:\Users\Admin\AppData\Roaming\6qmp2N3aM1.exe
                          Filesize

                          315KB

                          MD5

                          59c9d5bc2cfca695e10f12c6f5f5be3c

                          SHA1

                          64f8568e8beeef61e3c3918b2f6c38c8af42c46e

                          SHA256

                          cac6b02d8f2ae8f58e7e02ab86fc82149bf466a5857d92e3457aabfca468cf47

                          SHA512

                          220b2013d60713e5041ce6422f68aa7753042e1c9ffe8f6644515590d605b6f1701eaf4ecda1f03357a52d04956933261ba02f7948bb652438598211d72b0874

                          Download Submit

                        • \ProgramData\mozglue.dll
                          Filesize

                          593KB

                          MD5

                          c8fd9be83bc728cc04beffafc2907fe9

                          SHA1

                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                          SHA256

                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                          SHA512

                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                          Download Submit

                        • \ProgramData\nss3.dll
                          Filesize

                          2.0MB

                          MD5

                          1cc453cdf74f31e4d913ff9c10acdde2

                          SHA1

                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                          SHA256

                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                          SHA512

                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                          Download Submit

                        • \Users\Admin\AppData\Roaming\Apgng2zULb.exe
                          Filesize

                          469KB

                          MD5

                          3eba6a9c3a91b6cab9e2cba1620bfc3e

                          SHA1

                          52d195538a8162143cefd745bf9eee7df1f84e9d

                          SHA256

                          664d5913432f1b76c33b37599b46cc5f6324283428dba6b45801de37ee2f8d81

                          SHA512

                          eb9224e84993a19cddc9eaf75bf422f43fa61e73ab59be0b1b20110eeea6ee75e06f863ad327c9c2314e164f00e2b8813d6498bd442203fb457e0e9c34724fb9

                          Download Submit

                        • memory/288-374-0x0000000000400000-0x0000000000452000-memory.dmp

                          Filesize

                          328KB

                          Download

                        • memory/288-371-0x0000000000400000-0x0000000000452000-memory.dmp

                          Filesize

                          328KB

                          Download

                        • memory/288-367-0x0000000000400000-0x0000000000452000-memory.dmp

                          Filesize

                          328KB

                          Download

                        • memory/288-369-0x0000000000400000-0x0000000000452000-memory.dmp

                          Filesize

                          328KB

                          Download

                        • memory/288-375-0x0000000000400000-0x0000000000452000-memory.dmp

                          Filesize

                          328KB

                          Download

                        • memory/288-365-0x0000000000400000-0x0000000000452000-memory.dmp

                          Filesize

                          328KB

                          Download

                        • memory/288-373-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/288-386-0x0000000000400000-0x0000000000452000-memory.dmp

                          Filesize

                          328KB

                          Download

                        • memory/304-554-0x0000000000FE0000-0x0000000001241000-memory.dmp

                          Filesize

                          2.4MB

                          Download

                        • memory/304-68-0x0000000000FE0000-0x0000000001241000-memory.dmp

                          Filesize

                          2.4MB

                          Download

                        • memory/304-269-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                          Filesize

                          972KB

                          Download

                        • memory/576-136-0x0000000001130000-0x0000000001138000-memory.dmp

                          Filesize

                          32KB

                          Download

                        • memory/740-135-0x00000000003A0000-0x000000000041A000-memory.dmp

                          Filesize

                          488KB

                          Download

                        • memory/1036-137-0x0000000000160000-0x00000000001B4000-memory.dmp

                          Filesize

                          336KB

                          Download

                        • memory/1112-91-0x0000000000D35000-0x0000000000D36000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1768-155-0x0000000005350000-0x00000000053D4000-memory.dmp

                          Filesize

                          528KB

                          Download

                        • memory/1768-154-0x0000000000CA0000-0x0000000000DB8000-memory.dmp

                          Filesize

                          1.1MB

                          Download

                        • memory/1920-178-0x0000000000400000-0x0000000000462000-memory.dmp

                          Filesize

                          392KB

                          Download

                        • memory/1920-180-0x0000000000400000-0x0000000000462000-memory.dmp

                          Filesize

                          392KB

                          Download

                        • memory/1920-187-0x0000000000400000-0x0000000000462000-memory.dmp

                          Filesize

                          392KB

                          Download

                        • memory/1920-185-0x0000000000400000-0x0000000000462000-memory.dmp

                          Filesize

                          392KB

                          Download

                        • memory/1920-176-0x0000000000400000-0x0000000000462000-memory.dmp

                          Filesize

                          392KB

                          Download

                        • memory/1920-182-0x0000000000400000-0x0000000000462000-memory.dmp

                          Filesize

                          392KB

                          Download

                        • memory/1920-174-0x0000000000400000-0x0000000000462000-memory.dmp

                          Filesize

                          392KB

                          Download

                        • memory/1920-184-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2096-0-0x0000000000A90000-0x0000000000F52000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2096-1-0x00000000777F0000-0x00000000777F2000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2096-2-0x0000000000A91000-0x0000000000ABF000-memory.dmp

                          Filesize

                          184KB

                          Download

                        • memory/2096-3-0x0000000000A90000-0x0000000000F52000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2096-5-0x0000000000A90000-0x0000000000F52000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2096-4-0x0000000000A90000-0x0000000000F52000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2096-16-0x0000000006C40000-0x0000000007102000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2096-15-0x0000000000A90000-0x0000000000F52000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2320-65-0x0000000000860000-0x0000000000D22000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2320-674-0x0000000006970000-0x0000000006BD1000-memory.dmp

                          Filesize

                          2.4MB

                          Download

                        • memory/2320-139-0x0000000000860000-0x0000000000D22000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2320-156-0x0000000000860000-0x0000000000D22000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2320-673-0x0000000006970000-0x0000000006BD1000-memory.dmp

                          Filesize

                          2.4MB

                          Download

                        • memory/2320-138-0x0000000000860000-0x0000000000D22000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2320-18-0x0000000000860000-0x0000000000D22000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2320-488-0x0000000000860000-0x0000000000D22000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2320-66-0x0000000006970000-0x0000000006BD1000-memory.dmp

                          Filesize

                          2.4MB

                          Download

                        • memory/2320-67-0x0000000006970000-0x0000000006BD1000-memory.dmp

                          Filesize

                          2.4MB

                          Download

                        • memory/2320-69-0x0000000000860000-0x0000000000D22000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2320-22-0x0000000000860000-0x0000000000D22000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2320-20-0x0000000000860000-0x0000000000D22000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2320-19-0x0000000000860000-0x0000000000D22000-memory.dmp

                          Filesize

                          4.8MB

                          Download

                        • memory/2432-76-0x0000000000400000-0x00000000004FD000-memory.dmp

                          Filesize

                          1012KB

                          Download

                        • memory/2432-78-0x0000000000400000-0x00000000004FD000-memory.dmp

                          Filesize

                          1012KB

                          Download

                        • memory/2432-127-0x0000000000400000-0x00000000004FD000-memory.dmp

                          Filesize

                          1012KB

                          Download

                        • memory/2432-87-0x0000000000400000-0x00000000004FD000-memory.dmp

                          Filesize

                          1012KB

                          Download

                        • memory/2432-74-0x0000000000400000-0x00000000004FD000-memory.dmp

                          Filesize

                          1012KB

                          Download

                        • memory/2432-90-0x0000000000400000-0x00000000004FD000-memory.dmp

                          Filesize

                          1012KB

                          Download

                        • memory/2432-89-0x0000000000400000-0x00000000004FD000-memory.dmp

                          Filesize

                          1012KB

                          Download

                        • memory/2432-86-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2432-84-0x0000000000400000-0x00000000004FD000-memory.dmp

                          Filesize

                          1012KB

                          Download

                        • memory/2432-82-0x0000000000400000-0x00000000004FD000-memory.dmp

                          Filesize

                          1012KB

                          Download

                        • memory/2432-80-0x0000000000400000-0x00000000004FD000-memory.dmp

                          Filesize

                          1012KB

                          Download

                        • memory/2592-497-0x0000000001120000-0x0000000001238000-memory.dmp

                          Filesize

                          1.1MB

                          Download

                        • memory/2592-498-0x0000000009ED0000-0x0000000009F54000-memory.dmp

                          Filesize

                          528KB

                          Download

                        • memory/2800-571-0x0000000000400000-0x0000000000471000-memory.dmp

                          Filesize

                          452KB

                          Download

                        • memory/2800-573-0x0000000000400000-0x0000000000471000-memory.dmp

                          Filesize

                          452KB

                          Download

                        • memory/2800-575-0x0000000000400000-0x0000000000471000-memory.dmp

                          Filesize

                          452KB

                          Download

                        • memory/2800-577-0x0000000000400000-0x0000000000471000-memory.dmp

                          Filesize

                          452KB

                          Download