Overview

overview

10

Static

static

3

066cf9b2d9...b4.exe

windows7-x64

10

066cf9b2d9...b4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25-10-2024 13:33

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    066cf9b2d9edde6a63192b3c513944a4b67a5f36cff40bead11074e22d7737b4.exe

  • Size

    1.9MB

  • MD5

    2a34cc0bdb7a4af298975cd47989775e

  • SHA1

    0695436b200062af7b68623051d24aac43415b6d

  • SHA256

    066cf9b2d9edde6a63192b3c513944a4b67a5f36cff40bead11074e22d7737b4

  • SHA512

    3a656e6b234f733eab6321385d82943c251893e7ab4c0ac0245c469e8ec5c1a28932f3fba9c2ea2582353ac17f21a8479595a33f7f76f0fb16a5ddb3fd1671a2

  • SSDEEP

    49152:5gxo+eRJNToYXZpWjYe7YAnlBGK9GSuF+RgIHacCMW:N+eRzIYqYAnlt9/uFCHaL

Score
10/10
amadeylummaredlinestealcdefault_valencigadomafed3aatg cloud @rlreborn admin @fatherofcarderscredential_accessdiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

lumma

C2

https://snailyeductyi.sbs

https://ferrycheatyk.sbs

https://deepymouthi.sbs

https://wrigglesight.sbs

https://captaitwik.sbs

https://sidercotay.sbs

https://heroicmint.sbs

https://monstourtu.sbs

https://clearancek.site

https://licendfilteo.site

https://spirittunek.store

https://bathdoomgaz.store

https://studennotediw.store

https://dissapoiznw.store

https://eaglepawnoy.store

https://mobbipenju.store

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

89.105.223.196:29155

Extracted

Family

stealc

Botnet

doma

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 5 IoCs
  • Redline family
    redline
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 8 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 30 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 54 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Embeds OpenSSL 2 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 21 IoCs
  • Suspicious use of FindShellTrayWindow 36 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\066cf9b2d9edde6a63192b3c513944a4b67a5f36cff40bead11074e22d7737b4.exe
    "C:\Users\Admin\AppData\Local\Temp\066cf9b2d9edde6a63192b3c513944a4b67a5f36cff40bead11074e22d7737b4.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
        "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:684
        • C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
          4⤵
          • Executes dropped EXE
          PID:2968
        • C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
          4⤵
          • Executes dropped EXE
          PID:2988
        • C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
          4⤵
          • Executes dropped EXE
          PID:1348
        • C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
          4⤵
          • Executes dropped EXE
          PID:2932
        • C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
          4⤵
          • Executes dropped EXE
          PID:1272
        • C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
          4⤵
          • Executes dropped EXE
          PID:2460
        • C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
          4⤵
          • Executes dropped EXE
          PID:1580
        • C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
          4⤵
          • Executes dropped EXE
          PID:1456
        • C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
          4⤵
          • Executes dropped EXE
          PID:3028
        • C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
          "C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2360
          • C:\Users\Admin\AppData\Roaming\UqnWCNfShd.exe
            "C:\Users\Admin\AppData\Roaming\UqnWCNfShd.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2024
          • C:\Users\Admin\AppData\Roaming\ypJLuQJbsG.exe
            "C:\Users\Admin\AppData\Roaming\ypJLuQJbsG.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1276
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 684 -s 168
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2392
      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:1788
      • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
        "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1984
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start context.exe
          4⤵
            PID:1360
            • C:\Users\Admin\AppData\Local\Temp\context.exe
              context.exe
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:336
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 336 -s 728
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2032
        • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
          "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:776
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:316
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1888
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /f /im "InstallUtil.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1560
              • C:\Windows\SysWOW64\timeout.exe
                timeout 1
                6⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:2936
        • C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
          "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:2092
          • C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
            "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            PID:1912
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 52
            4⤵
            • Loads dropped DLL
            • Program crash
            PID:1584
        • C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe
          "C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          PID:1028
          • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
            "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:1528
            • C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:2532
        • C:\Users\Admin\AppData\Local\Temp\1000569001\myrdx.exe
          "C:\Users\Admin\AppData\Local\Temp\1000569001\myrdx.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:1748
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2064
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1748 -s 52
            4⤵
            • Loads dropped DLL
            • Program crash
            PID:2076
        • C:\Users\Admin\AppData\Local\Temp\1000585001\Set-up-1.exe
          "C:\Users\Admin\AppData\Local\Temp\1000585001\Set-up-1.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Checks processor information in registry
          PID:2968
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
            4⤵
            • Uses browser remote debugging
            • Enumerates system info in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            PID:2708
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6969758,0x7fef6969768,0x7fef6969778
              5⤵
                PID:2584
              • C:\Windows\system32\ctfmon.exe
                ctfmon.exe
                5⤵
                  PID:2268
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1396,i,17133189624431439526,13508965416976214315,131072 /prefetch:2
                  5⤵
                    PID:444
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1396,i,17133189624431439526,13508965416976214315,131072 /prefetch:8
                    5⤵
                      PID:1940
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1636 --field-trial-handle=1396,i,17133189624431439526,13508965416976214315,131072 /prefetch:8
                      5⤵
                        PID:1516
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1396,i,17133189624431439526,13508965416976214315,131072 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:900
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2280 --field-trial-handle=1396,i,17133189624431439526,13508965416976214315,131072 /prefetch:1
                        5⤵
                        • Uses browser remote debugging
                        PID:1924
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1592 --field-trial-handle=1396,i,17133189624431439526,13508965416976214315,131072 /prefetch:2
                        5⤵
                          PID:1016
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1568 --field-trial-handle=1396,i,17133189624431439526,13508965416976214315,131072 /prefetch:1
                          5⤵
                          • Uses browser remote debugging
                          PID:2624
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3516 --field-trial-handle=1396,i,17133189624431439526,13508965416976214315,131072 /prefetch:8
                          5⤵
                            PID:1348
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3640 --field-trial-handle=1396,i,17133189624431439526,13508965416976214315,131072 /prefetch:8
                            5⤵
                              PID:1916
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3756 --field-trial-handle=1396,i,17133189624431439526,13508965416976214315,131072 /prefetch:8
                              5⤵
                                PID:2100
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3540 --field-trial-handle=1396,i,17133189624431439526,13508965416976214315,131072 /prefetch:8
                                5⤵
                                  PID:836
                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                                4⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:1260
                              • C:\Windows\SysWOW64\schtasks.exe
                                "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                                4⤵
                                • System Location Discovery: System Language Discovery
                                • Scheduled Task/Job: Scheduled Task
                                PID:1824
                            • C:\Users\Admin\AppData\Local\Temp\1000679001\d5743dfed9.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000679001\d5743dfed9.exe"
                              3⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2076
                            • C:\Users\Admin\AppData\Local\Temp\1000680001\17a3f9264f.exe
                              "C:\Users\Admin\AppData\Local\Temp\1000680001\17a3f9264f.exe"
                              3⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Modifies system certificate store
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1952
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:2676
                          • C:\Windows\system32\taskeng.exe
                            taskeng.exe {72406C62-C12D-44BE-B9F2-0D60D975C077} S-1-5-21-3533259084-2542256011-65585152-1000:XPAJOTIY\Admin:Interactive:[1]
                            1⤵
                              PID:1064
                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:2960
                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                2⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:1540

                            Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Modify Authentication Process

                            1
                            T1556

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Defense Evasion

                            Modify Authentication Process

                            1
                            T1556

                            Modify Registry

                            2
                            T1112

                            Subvert Trust Controls

                            1
                            T1553

                            Install Root Certificate

                            1
                            T1553.004

                            Virtualization/Sandbox Evasion

                            2
                            T1497

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Modify Authentication Process

                            1
                            T1556

                            Steal Web Session Cookie

                            1
                            T1539

                            Unsecured Credentials

                            4
                            T1552

                            Credentials In Files

                            4
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Query Registry

                            6
                            T1012

                            System Information Discovery

                            4
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            Virtualization/Sandbox Evasion

                            2
                            T1497

                            Lateral Movement

                            Collection

                            Data from Local System

                            3
                            T1005

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                              Filesize

                              342B

                              MD5

                              48e4f598b68d1917ce62de0b00bc032e

                              SHA1

                              959e53cdb60aed0eeb6a3ae61807095a9a479b34

                              SHA256

                              cc350eb74d0b824f68d6224a46ca4fd224b64dd7b19f5361bd1ee46f0a20bf5c

                              SHA512

                              5f91c3ce9febd61a20dede957362c3bbbf5485f292fa1d38c76736aa8836bd211cd4669ae6977853fb06e32535daec5880ea74baa81d2fd5b902fd92f0109b82

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000007.dbtmp
                              Filesize

                              16B

                              MD5

                              18e723571b00fb1694a3bad6c78e4054

                              SHA1

                              afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                              SHA256

                              8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                              SHA512

                              43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000004001\zxcv.exe
                              Filesize

                              1.1MB

                              MD5

                              a5cf5de46ec3f0a677e94188b19e7862

                              SHA1

                              d07e3fd100c423662dbb3ed85713ff7b87c52e60

                              SHA256

                              450ac7367b33ac0d26ee08c5371ba668d9d3331a8c119520eb5ca4a46f91973c

                              SHA512

                              1d2d91625f971f71670a36340092ab9ac0a35a4ac791a46ee8b055894cdf3b7fc7030e4d27f973d738b85295c31a4bfbe5c033b07a5f7ebf10508d75043c1ab1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                              Filesize

                              307KB

                              MD5

                              68a99cf42959dc6406af26e91d39f523

                              SHA1

                              f11db933a83400136dc992820f485e0b73f1b933

                              SHA256

                              c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

                              SHA512

                              7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe
                              Filesize

                              6.3MB

                              MD5

                              02cdcc122a549d0a84e2a1342a57afa4

                              SHA1

                              660ec77fdddcb3596e600a3e1e904855e29994c1

                              SHA256

                              2b1f016f12fef7124ea7c9898622e650e53814f2d5ff4d76fa712c3e591f9a7f

                              SHA512

                              0d25c04f17021e191daa73d746e60ffbe1fd2fd725e7376b5a3ec33f4985c820e52d504b214a191cc3efc45bd58512a5ba38b793e05fccb33d31d215fd79ac38

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
                              Filesize

                              6KB

                              MD5

                              c042782226565f89ce3954489075e516

                              SHA1

                              256dd5ba42837a33c7aa6cb71cef33d5617117ee

                              SHA256

                              a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

                              SHA512

                              9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
                              Filesize

                              1.1MB

                              MD5

                              ed9393d5765529c845c623e35c1b1a34

                              SHA1

                              d3eca07f5ce0df847070d2d7fe5253067f624285

                              SHA256

                              53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a

                              SHA512

                              565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
                              Filesize

                              551KB

                              MD5

                              3a0f1fe734b215e85f47816085e425c9

                              SHA1

                              30a3ddb576c2f0eeb1bfc718b30266123eb1e474

                              SHA256

                              ec189d42b19d842d94772287dd02c5b2a2a6a79fce75f2f132111820646b8fba

                              SHA512

                              840546dbba54a94452eaf069dbbb53fd00fdf42dff20ce5722226a1a25b7410731dfd7ad01c04ca97b269aabbd46cead03cd82e52ed49ba6ea1f6c5bdba37189

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe
                              Filesize

                              416KB

                              MD5

                              f5d7b79ee6b6da6b50e536030bcc3b59

                              SHA1

                              751b555a8eede96d55395290f60adc43b28ba5e2

                              SHA256

                              2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

                              SHA512

                              532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000569001\myrdx.exe
                              Filesize

                              515KB

                              MD5

                              a904ae8b26c7d421140be930266ed425

                              SHA1

                              c2e246b9197c18d6d40d9477a8e9a2d74a83b0e2

                              SHA256

                              9d3380ee1ccaae63ca9f39e86630ffe877d0e3ecb711d87dc02350922595dc84

                              SHA512

                              2dbd601a564f7ffc1609bfb05ed55d57afb9bdd9bec1e9091deb53fcfa9fa02a7ba59825f2b9c3777d2016d724a8263808331356f569a1ecae585422e040f3be

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000585001\Set-up-1.exe
                              Filesize

                              12.2MB

                              MD5

                              b7f95a6fba7ee898425a69ffd2b6c204

                              SHA1

                              d995e2ed97947778c489f6384ba3af0f4343c0bc

                              SHA256

                              8b6a0a8d8594fb4f465a8220533a8cbf25fb725220dfc35056c7787b27d89643

                              SHA512

                              3b9d35e20161767dabea7bda5ed7db3f63ce738e0934965695dedf1f7487fc092c0e2fe3cf35b9656f521c2ab9e30596cda49d38c7ace360ff2b2b0e52930b59

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000679001\d5743dfed9.exe
                              Filesize

                              1.8MB

                              MD5

                              b94564df46a4ceb322ffe1a44eaaff87

                              SHA1

                              855fcb9d18160bf3652e271f41136c3b57a5af2b

                              SHA256

                              2005eb54d5d5a531e25fd6170fb521b051e36862ec92c6ff69dbe27fd9249618

                              SHA512

                              a0acd0142d931eb66ad05711840da63c4cc1252a6f556bb8e725056964dc885ef355363e2b39e4810224f9439e542c6ae477fb3dbc61f2e8f6df438abaaa3bbb

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1000680001\17a3f9264f.exe
                              Filesize

                              2.8MB

                              MD5

                              331c78b2aa13525f5172b4b5e17791e0

                              SHA1

                              69729b0f6a11a8b155a9321b254a08918b2359bf

                              SHA256

                              3b0f8bd2fa8aaebebfffd8d8eed4044130ad363902c65d8d0ece64ab95f6c2e5

                              SHA512

                              0451fd56ebce525d1d1cad139a8bab70e1aa5bfd81a91d40fb873488793c0a8c7544a9bf8b3d6fdf74008a72ac86216c37ec76d57d8cb3880c25d07f104963ab

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
                              Filesize

                              1.9MB

                              MD5

                              2a34cc0bdb7a4af298975cd47989775e

                              SHA1

                              0695436b200062af7b68623051d24aac43415b6d

                              SHA256

                              066cf9b2d9edde6a63192b3c513944a4b67a5f36cff40bead11074e22d7737b4

                              SHA512

                              3a656e6b234f733eab6321385d82943c251893e7ab4c0ac0245c469e8ec5c1a28932f3fba9c2ea2582353ac17f21a8479595a33f7f76f0fb16a5ddb3fd1671a2

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\CabDC5C.tmp
                              Filesize

                              70KB

                              MD5

                              49aebf8cbd62d92ac215b2923fb1b9f5

                              SHA1

                              1723be06719828dda65ad804298d0431f6aff976

                              SHA256

                              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                              SHA512

                              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\TarDD19.tmp
                              Filesize

                              181KB

                              MD5

                              4ea6026cf93ec6338144661bf1202cd1

                              SHA1

                              a1dec9044f750ad887935a01430bf49322fbdcb7

                              SHA256

                              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                              SHA512

                              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\TmpE689.tmp
                              Filesize

                              2KB

                              MD5

                              1420d30f964eac2c85b2ccfe968eebce

                              SHA1

                              bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                              SHA256

                              f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                              SHA512

                              6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\UqnWCNfShd.exe
                              Filesize

                              331KB

                              MD5

                              fd381b2627904d8365229d1ddd7e221f

                              SHA1

                              d7bcbabb6cd84875cc76f8170833ac679cd7d915

                              SHA256

                              ed5ac0c0d07595eb99ccc7346faab8504eb03000da1012abc1009c0cfbd4d4b9

                              SHA512

                              2b1e15b539d55b92f31c61cff954dafa61a44f7ccf75d113ab57ad54e9a8cbde304a285d0583663a206f648fd4f3b63257dbedf3df608d0391353ffb4aa78daf

                              Download Submit

                            • \Users\Admin\AppData\Roaming\ypJLuQJbsG.exe
                              Filesize

                              340KB

                              MD5

                              131d164783db3608e4b2e97428e17028

                              SHA1

                              c00064a0f4952f5a37093cd7631f5921f9c00387

                              SHA256

                              05053f2a6db0f5352295ce4ca7146618ddb175f1ff4cdcd93a055a039c098e5f

                              SHA512

                              020b22527d0e555509897ce2df876bf2a30e3fc976cd86e52335104cf0f9db152caa8b46650a8bd0022b3cbaf3d20e0201322e3617e00eb0f25c6fcba245c505

                              Download Submit

                            • memory/336-356-0x0000000001010000-0x0000000001128000-memory.dmp

                              Filesize

                              1.1MB

                              Download

                            • memory/684-61-0x0000000000090000-0x00000000001A2000-memory.dmp

                              Filesize

                              1.1MB

                              Download

                            • memory/684-130-0x0000000000090000-0x00000000001A2000-memory.dmp

                              Filesize

                              1.1MB

                              Download

                            • memory/776-146-0x0000000000020000-0x0000000000138000-memory.dmp

                              Filesize

                              1.1MB

                              Download

                            • memory/776-147-0x0000000009EB0000-0x0000000009F34000-memory.dmp

                              Filesize

                              528KB

                              Download

                            • memory/1276-127-0x0000000001330000-0x000000000138A000-memory.dmp

                              Filesize

                              360KB

                              Download

                            • memory/1292-2-0x0000000000D91000-0x0000000000DBF000-memory.dmp

                              Filesize

                              184KB

                              Download

                            • memory/1292-3-0x0000000000D90000-0x0000000001262000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/1292-0-0x0000000000D90000-0x0000000001262000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/1292-1-0x00000000772C0000-0x00000000772C2000-memory.dmp

                              Filesize

                              8KB

                              Download

                            • memory/1292-5-0x0000000000D90000-0x0000000001262000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/1292-16-0x0000000000D90000-0x0000000001262000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/1292-10-0x0000000000D90000-0x0000000001262000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/1788-56-0x00000000001B0000-0x0000000000411000-memory.dmp

                              Filesize

                              2.4MB

                              Download

                            • memory/1788-342-0x00000000001B0000-0x0000000000411000-memory.dmp

                              Filesize

                              2.4MB

                              Download

                            • memory/1788-197-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                              Filesize

                              972KB

                              Download

                            • memory/1912-178-0x0000000000400000-0x0000000000462000-memory.dmp

                              Filesize

                              392KB

                              Download

                            • memory/1912-167-0x0000000000400000-0x0000000000462000-memory.dmp

                              Filesize

                              392KB

                              Download

                            • memory/1912-169-0x0000000000400000-0x0000000000462000-memory.dmp

                              Filesize

                              392KB

                              Download

                            • memory/1912-175-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/1912-165-0x0000000000400000-0x0000000000462000-memory.dmp

                              Filesize

                              392KB

                              Download

                            • memory/1912-176-0x0000000000400000-0x0000000000462000-memory.dmp

                              Filesize

                              392KB

                              Download

                            • memory/1912-173-0x0000000000400000-0x0000000000462000-memory.dmp

                              Filesize

                              392KB

                              Download

                            • memory/1912-171-0x0000000000400000-0x0000000000462000-memory.dmp

                              Filesize

                              392KB

                              Download

                            • memory/1952-541-0x0000000000CB0000-0x0000000000FC3000-memory.dmp

                              Filesize

                              3.1MB

                              Download

                            • memory/1952-471-0x0000000000CB0000-0x0000000000FC3000-memory.dmp

                              Filesize

                              3.1MB

                              Download

                            • memory/1984-126-0x0000000001030000-0x0000000001038000-memory.dmp

                              Filesize

                              32KB

                              Download

                            • memory/2024-128-0x0000000000FE0000-0x0000000001038000-memory.dmp

                              Filesize

                              352KB

                              Download

                            • memory/2064-279-0x0000000000400000-0x0000000000452000-memory.dmp

                              Filesize

                              328KB

                              Download

                            • memory/2064-288-0x0000000000400000-0x0000000000452000-memory.dmp

                              Filesize

                              328KB

                              Download

                            • memory/2064-287-0x0000000000400000-0x0000000000452000-memory.dmp

                              Filesize

                              328KB

                              Download

                            • memory/2064-278-0x0000000000400000-0x0000000000452000-memory.dmp

                              Filesize

                              328KB

                              Download

                            • memory/2064-281-0x0000000000400000-0x0000000000452000-memory.dmp

                              Filesize

                              328KB

                              Download

                            • memory/2064-283-0x0000000000400000-0x0000000000452000-memory.dmp

                              Filesize

                              328KB

                              Download

                            • memory/2064-285-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2064-286-0x0000000000400000-0x0000000000452000-memory.dmp

                              Filesize

                              328KB

                              Download

                            • memory/2076-452-0x00000000011F0000-0x000000000188E000-memory.dmp

                              Filesize

                              6.6MB

                              Download

                            • memory/2076-454-0x00000000011F0000-0x000000000188E000-memory.dmp

                              Filesize

                              6.6MB

                              Download

                            • memory/2360-82-0x0000000000400000-0x00000000004E0000-memory.dmp

                              Filesize

                              896KB

                              Download

                            • memory/2360-94-0x0000000000400000-0x00000000004E0000-memory.dmp

                              Filesize

                              896KB

                              Download

                            • memory/2360-80-0x0000000000400000-0x00000000004E0000-memory.dmp

                              Filesize

                              896KB

                              Download

                            • memory/2360-78-0x0000000000400000-0x00000000004E0000-memory.dmp

                              Filesize

                              896KB

                              Download

                            • memory/2360-91-0x0000000000400000-0x00000000004E0000-memory.dmp

                              Filesize

                              896KB

                              Download

                            • memory/2360-84-0x0000000000400000-0x00000000004E0000-memory.dmp

                              Filesize

                              896KB

                              Download

                            • memory/2360-90-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                              Filesize

                              4KB

                              Download

                            • memory/2360-104-0x0000000000400000-0x00000000004E0000-memory.dmp

                              Filesize

                              896KB

                              Download

                            • memory/2360-93-0x0000000000400000-0x00000000004E0000-memory.dmp

                              Filesize

                              896KB

                              Download

                            • memory/2360-88-0x0000000000400000-0x00000000004E0000-memory.dmp

                              Filesize

                              896KB

                              Download

                            • memory/2360-86-0x0000000000400000-0x00000000004E0000-memory.dmp

                              Filesize

                              896KB

                              Download

                            • memory/2532-345-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                              Filesize

                              10.4MB

                              Download

                            • memory/2776-129-0x00000000001A0000-0x0000000000672000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/2776-53-0x00000000001A0000-0x0000000000672000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/2776-565-0x00000000065C0000-0x0000000006821000-memory.dmp

                              Filesize

                              2.4MB

                              Download

                            • memory/2776-145-0x00000000001A0000-0x0000000000672000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/2776-55-0x00000000065C0000-0x0000000006821000-memory.dmp

                              Filesize

                              2.4MB

                              Download

                            • memory/2776-450-0x0000000006BE0000-0x000000000727E000-memory.dmp

                              Filesize

                              6.6MB

                              Download

                            • memory/2776-157-0x00000000001A0000-0x0000000000672000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/2776-451-0x0000000006BE0000-0x000000000727E000-memory.dmp

                              Filesize

                              6.6MB

                              Download

                            • memory/2776-182-0x00000000001A0000-0x0000000000672000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/2776-156-0x00000000001A0000-0x0000000000672000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/2776-21-0x00000000001A0000-0x0000000000672000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/2776-470-0x00000000065C0000-0x00000000068D3000-memory.dmp

                              Filesize

                              3.1MB

                              Download

                            • memory/2776-469-0x00000000065C0000-0x00000000068D3000-memory.dmp

                              Filesize

                              3.1MB

                              Download

                            • memory/2776-19-0x00000000001A0000-0x0000000000672000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/2776-18-0x00000000001A1000-0x00000000001CF000-memory.dmp

                              Filesize

                              184KB

                              Download

                            • memory/2776-17-0x00000000001A0000-0x0000000000672000-memory.dmp

                              Filesize

                              4.8MB

                              Download

                            • memory/2776-564-0x00000000065C0000-0x0000000006821000-memory.dmp

                              Filesize

                              2.4MB

                              Download

                            • memory/2776-54-0x00000000065C0000-0x0000000006821000-memory.dmp

                              Filesize

                              2.4MB

                              Download