Overview

overview

10

Static

static

3

a604d7f02b...1N.exe

windows7-x64

10

a604d7f02b...1N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    116s
  • max time network
    113s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    13-11-2024 11:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a604d7f02b52f55cf29de06b95c46eab8b3c2026e2572a176820bc5dbee59551N.exe

  • Size

    3.1MB

  • MD5

    3f37f3ed555ba8cb563f1c44d48f7dc0

  • SHA1

    4e48a0cc1ca64a4adf0fe130c271e042c8d5cf79

  • SHA256

    a604d7f02b52f55cf29de06b95c46eab8b3c2026e2572a176820bc5dbee59551

  • SHA512

    4231e1529f2c8d6dee89adbd852d2aaf19f14a274262f6d833467db493f4e713563631f3b12659fc9e2610e9714b6d3dcae94c206b5fe94c5888b5a8f53f54f2

  • SSDEEP

    49152:/C4Wly0+XQ/Z4DmYG9xxx1UU/8dxSleIGlr9edvLoIsnFkitulfDN+:/C4WyfcZ4DmYG3xxWheebkiI

Score
10/10
amadeycryptbotlumma9c9aa5credential_accessdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://faintbl0w.sbs/api

https://thicktoys.sbs/api

https://3xc1aimbl0w.sbs/api

https://300snails.sbs/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 3 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 12 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 21 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 9 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1212
      • C:\Users\Admin\AppData\Local\Temp\a604d7f02b52f55cf29de06b95c46eab8b3c2026e2572a176820bc5dbee59551N.exe
        "C:\Users\Admin\AppData\Local\Temp\a604d7f02b52f55cf29de06b95c46eab8b3c2026e2572a176820bc5dbee59551N.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Modifies system certificate store
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1928
          • C:\Users\Admin\AppData\Local\Temp\1005824001\9d34a6c827.exe
            "C:\Users\Admin\AppData\Local\Temp\1005824001\9d34a6c827.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:1728
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\exploma.exe.exe"
              5⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of WriteProcessMemory
              PID:2664
              • C:\Windows\system32\cmd.exe
                cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\exploma.exe.exe"
                6⤵
                • Loads dropped DLL
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious use of WriteProcessMemory
                PID:2908
                • C:\Windows\system32\PING.EXE
                  ping localhost -n 1
                  7⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:2864
                • C:\Users\Admin\AppData\Local\exploma.exe.exe
                  C:\Users\Admin\AppData\Local\exploma.exe.exe
                  7⤵
                  • Executes dropped EXE
                  PID:844
          • C:\Users\Admin\AppData\Local\Temp\1005893001\oi.exe
            "C:\Users\Admin\AppData\Local\Temp\1005893001\oi.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:880
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c copy Uh Uh.cmd & Uh.cmd
              5⤵
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:904
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2272
              • C:\Windows\SysWOW64\findstr.exe
                findstr /I "wrsa opssvc"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1640
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2496
              • C:\Windows\SysWOW64\findstr.exe
                findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1108
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c md 27375
                6⤵
                • System Location Discovery: System Language Discovery
                PID:500
              • C:\Windows\SysWOW64\findstr.exe
                findstr /V "optimizationsquarerehabseq" Tech
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1780
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c copy /b ..\Maintained + ..\Bryan + ..\Ace + ..\Stored + ..\Concerts + ..\Tiny + ..\Simplified G
                6⤵
                • System Location Discovery: System Language Discovery
                PID:1676
              • C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                Lovely.pif G
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                PID:2564
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks.exe /create /tn "ZenFlow" /tr "wscript //B 'C:\Users\Admin\AppData\Local\FlowZen Dynamics\ZenFlow.js'" /sc onlogon /F /RL HIGHEST
                  7⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:1536
                • C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                  C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies system certificate store
                  PID:2500
                • C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                  C:\Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2560
              • C:\Windows\SysWOW64\choice.exe
                choice /d y /t 15
                6⤵
                • System Location Discovery: System Language Discovery
                PID:2420
          • C:\Users\Admin\AppData\Local\Temp\1005952001\47137661f2.exe
            "C:\Users\Admin\AppData\Local\Temp\1005952001\47137661f2.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:1788
          • C:\Users\Admin\AppData\Local\Temp\1005953001\9e1493d217.exe
            "C:\Users\Admin\AppData\Local\Temp\1005953001\9e1493d217.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2852
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            4⤵
              PID:2388
            • C:\Users\Admin\AppData\Local\Temp\1005955001\834f2eb831.exe
              "C:\Users\Admin\AppData\Local\Temp\1005955001\834f2eb831.exe"
              4⤵
              • Modifies Windows Defender Real-time Protection settings
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Windows security modification
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2024
            • C:\Users\Admin\AppData\Local\Temp\1005956001\f69cf35b1e.exe
              "C:\Users\Admin\AppData\Local\Temp\1005956001\f69cf35b1e.exe"
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:2120
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
                5⤵
                • Uses browser remote debugging
                • Enumerates system info in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                PID:2300
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6629758,0x7fef6629768,0x7fef6629778
                  6⤵
                    PID:572
                  • C:\Windows\system32\ctfmon.exe
                    ctfmon.exe
                    6⤵
                      PID:2308
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1348,i,104635149152954006,3184212919245713557,131072 /prefetch:2
                      6⤵
                        PID:3040
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 --field-trial-handle=1348,i,104635149152954006,3184212919245713557,131072 /prefetch:8
                        6⤵
                          PID:2584
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1348,i,104635149152954006,3184212919245713557,131072 /prefetch:8
                          6⤵
                            PID:2700
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1348,i,104635149152954006,3184212919245713557,131072 /prefetch:1
                            6⤵
                            • Uses browser remote debugging
                            PID:1572
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2344 --field-trial-handle=1348,i,104635149152954006,3184212919245713557,131072 /prefetch:1
                            6⤵
                            • Uses browser remote debugging
                            PID:2228
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1588 --field-trial-handle=1348,i,104635149152954006,3184212919245713557,131072 /prefetch:2
                            6⤵
                              PID:2216
                          • C:\Users\Admin\AppData\Local\Temp\service123.exe
                            "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:2396
                          • C:\Windows\SysWOW64\schtasks.exe
                            "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                            5⤵
                            • System Location Discovery: System Language Discovery
                            • Scheduled Task/Job: Scheduled Task
                            PID:2884
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 952
                            5⤵
                            • Loads dropped DLL
                            • Program crash
                            PID:2544
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /c schtasks.exe /create /tn "Total" /tr "wscript //B 'C:\Users\Admin\AppData\Local\FlowZen Dynamics\ZenFlow.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                      2⤵
                      • System Location Discovery: System Language Discovery
                      PID:1436
                      • C:\Windows\SysWOW64\schtasks.exe
                        schtasks.exe /create /tn "Total" /tr "wscript //B 'C:\Users\Admin\AppData\Local\FlowZen Dynamics\ZenFlow.js'" /sc daily /mo 1 /ri 3 /du 23:57 /F /RL HIGHEST
                        3⤵
                        • System Location Discovery: System Language Discovery
                        • Scheduled Task/Job: Scheduled Task
                        PID:1712
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:2020

                    Network

                    MITRE ATT&CK Enterprise v15

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Modify Authentication Process

                    1
                    T1556

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Boot or Logon Autostart Execution

                    1
                    T1547

                    Registry Run Keys / Startup Folder

                    1
                    T1547.001

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Impair Defenses

                    2
                    T1562

                    Disable or Modify Tools

                    2
                    T1562.001

                    Modify Authentication Process

                    1
                    T1556

                    Modify Registry

                    4
                    T1112

                    Subvert Trust Controls

                    1
                    T1553

                    Install Root Certificate

                    1
                    T1553.004

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Credential Access

                    Credentials from Password Stores

                    1
                    T1555

                    Credentials from Web Browsers

                    1
                    T1555.003

                    Modify Authentication Process

                    1
                    T1556

                    Steal Web Session Cookie

                    1
                    T1539

                    Unsecured Credentials

                    1
                    T1552

                    Credentials In Files

                    1
                    T1552.001

                    Discovery

                    Browser Information Discovery

                    1
                    T1217

                    Process Discovery

                    1
                    T1057

                    Query Registry

                    6
                    T1012

                    Remote System Discovery

                    1
                    T1018

                    System Information Discovery

                    4
                    T1082

                    System Location Discovery

                    1
                    T1614

                    System Language Discovery

                    1
                    T1614.001

                    System Network Configuration Discovery

                    1
                    T1016

                    Internet Connection Discovery

                    1
                    T1016.001

                    Virtualization/Sandbox Evasion

                    2
                    T1497

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                      Filesize

                      342B

                      MD5

                      9648b2b45ef672ed3717c21081a6b518

                      SHA1

                      7a3dcb8843840a313355b786c8a5fb8087ef28ae

                      SHA256

                      178323b3aa7f83abc0a16329d3fedb11efe8d1ea3b43afde3ec70b85c60ad846

                      SHA512

                      949d93d5331c94828ae4b81c4e1abc490380fcd394b1c1065c78132c0ae23b944c1bcb89d235ccdedb719aa3a74a4688d71a44f786edc36e01046b9570c77285

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1
                      Filesize

                      264KB

                      MD5

                      f50f89a0a91564d0b8a211f8921aa7de

                      SHA1

                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                      SHA256

                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                      SHA512

                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
                      Filesize

                      16B

                      MD5

                      18e723571b00fb1694a3bad6c78e4054

                      SHA1

                      afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                      SHA256

                      8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                      SHA512

                      43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1005824001\9d34a6c827.exe
                      Filesize

                      3.5MB

                      MD5

                      bcd58bf1a969740fd1e8329f851bb0cc

                      SHA1

                      1d553e9014146260847ab8c28496f07ec8bf4d49

                      SHA256

                      be40f0f232d87663f189587f4809bac6d0394009c520d245092cef93a61ba7b1

                      SHA512

                      378d912a45aa54dbee8f153f87b1eb171b834faf44c5a5322baeb076dc4d458b19b2176083eee8828827e3922a471e3773d921178b09907e77315d51f3f7f331

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1005893001\oi.exe
                      Filesize

                      1009KB

                      MD5

                      bd9ea2886936f3013285b983c3c1537e

                      SHA1

                      c92073e3457e9fc787a2c2757745e92c949a0668

                      SHA256

                      bb653dddd858f686a07ac236a6098d9da8dcb8524aedc8da2cb5a6f084cbfebc

                      SHA512

                      6cd0fdd4d89edb60ffae53f0245d188b8400d71ff2d0fdfba7e0255c2e6a94d327fe5b290abe984022652a7f2875bdbf33b82dcff9b30ed7fa0cb0591e68275a

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1005952001\47137661f2.exe
                      Filesize

                      3.0MB

                      MD5

                      14213bc1265194d5d8176a0c980171f7

                      SHA1

                      072426f65517ab6a53b92c28f41b410c1b78521a

                      SHA256

                      45ab2dd8f940129af3600b52cb5fef094c14ce2f9afddd30b2b624c11d65f138

                      SHA512

                      2850455477084b9584126144dd71d888869c04c81ebe28687bfc73b86752e7a61270d21454d95895611e5703caab96fc8ccf5f699fa7d7f1e09b2581b63785a3

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1005953001\9e1493d217.exe
                      Filesize

                      1.7MB

                      MD5

                      4ef056c57477a8cdf508b93aad388588

                      SHA1

                      18a90dbde56b1fdcdb10935fc29166df1322d51b

                      SHA256

                      f2198db35c65adb3ca095325def052e519e840061e856a1f4e8ae4d68d66c526

                      SHA512

                      ccee13089a8d775396aa025e6a46a5549d5235517660451a33a3ab663b39e907c4f7f340d4e6923b2d7637f78b3f762274bdd36efd207685abddcdd140a0eea1

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1005955001\834f2eb831.exe
                      Filesize

                      2.7MB

                      MD5

                      ebe500347dff5aa2ed62b0be311708d1

                      SHA1

                      21383fde5e5f5a996549addedac518f77c276e6a

                      SHA256

                      4d28a8ba49931c21b31d91b83ec8f5c31213cba3d03b13fbcfaa8a8ca5f71175

                      SHA512

                      b70f2a6e35023c8e99e49fd08190727f7704c5ca8596f9c2bd8d8387fdca9fb38934d46ea97fa972bb846721eb2878e92bc2023924760facf45937e2acefb883

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\1005956001\f69cf35b1e.exe
                      Filesize

                      4.2MB

                      MD5

                      343d04fe2c54b826ab8dd68af58bc511

                      SHA1

                      7ec2a009680b24bbb634372f854c29081b1709c6

                      SHA256

                      d2ce21cc3ee103cd36406ecfcb0f6c5e3a937e4159269abfe698bededa27f4ef

                      SHA512

                      5961e23d96d395c09cb6e1c5d7416ad4eb7d220138d3f1262b62c47e73438caea7281e2b9a682d26b958270c11082524c6b092d99b8af66327b945e3c4d5eaee

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\27375\G
                      Filesize

                      518KB

                      MD5

                      4119ef62bcd358ce3eeb9242067b201b

                      SHA1

                      5d4d94fd119aa6223af089b174c0cf475dbfd7a7

                      SHA256

                      10bcb2925540219372c72f31dd5766be5850ff2a993ada75f73c8ab429aea077

                      SHA512

                      1b98598039373301cdea25615889b303526ec14b25a34db978f2ed0d5fdfa8e9a6d2d4fec0ff814de6c6482808f2c99593d542f12b14af8e0450c6f48191c890

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Ace
                      Filesize

                      86KB

                      MD5

                      a2051ab029f76a13f21d1ee9e1d13fdb

                      SHA1

                      f6d2ce4554d8aa45623b4474a36cba2e2f55dbb5

                      SHA256

                      6c9a4bce60a8b019f5b74cc9861ed3da801ecc7127e4fb8199ff310274e6a6db

                      SHA512

                      ece6bfcc0d17c9cf06058db6df98de618892ee416f89024e20bed27a387cbebc7158e1db51133f66d1aef6fcc07c4c1f97bd5d821f2638d614f85f7d08e3e95c

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Advertiser
                      Filesize

                      909KB

                      MD5

                      b2f00d6517111c40a399acc3193a9847

                      SHA1

                      6c754fc2edb87e6d29b6d5938a7710e6a17c5201

                      SHA256

                      f3df9dd5028e882d651cc871a673f9811b15114e8915375b93bc72b6b93e2733

                      SHA512

                      1855cd164f00f201105abf906ca4d9acb48adc4c3cde7cb4e1e86293d8b0bb95f3e6d73742102f0cfd030746497be80383abf47c499cd5b91cc0342f0ced2ebf

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Bryan
                      Filesize

                      84KB

                      MD5

                      2b8f2f734ba41de74b0f2ad8c4635807

                      SHA1

                      c8fde4793ee88811482aa8b8810505fcf978c185

                      SHA256

                      d62ef368aca33c0c7503b469a5701919cc8524310c624182f5243c913d33ca70

                      SHA512

                      6e6bbc71fc96d7f364ddbfb2165f8e6fc7875e966b36bfcaa622a37f70e59bc571d446ed934d1805e9d70db2fbd93fa8594bb972a1ee8e3f46da39894b887191

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Cab3582.tmp
                      Filesize

                      70KB

                      MD5

                      49aebf8cbd62d92ac215b2923fb1b9f5

                      SHA1

                      1723be06719828dda65ad804298d0431f6aff976

                      SHA256

                      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                      SHA512

                      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Concerts
                      Filesize

                      98KB

                      MD5

                      8d1261afc55e57b8e4d1fbd56fa3c609

                      SHA1

                      cd872e347a2c66f7d4549092362a8db6d2674a30

                      SHA256

                      d5d97b1f80d3680d5177cecb173bb7032379e7e8afa4763a09b7cc00b511ea8c

                      SHA512

                      a1a5f4b18d59bf89a9af298b7d8c5273d14f73094230be4e71efb05b3d940e68ef48a4e043ca11cda579a13d6091dc42e763443d9d8636ae9ad1d8f1102aa79b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Maintained
                      Filesize

                      88KB

                      MD5

                      02efef57945fdfa1228bb81d764fcaa9

                      SHA1

                      3544c446eba2ea13df24eaee4854bd9ec50eb911

                      SHA256

                      a843a39f214722b5e878a6c29114b9e71efe5842147f2e79dfa48ae762430679

                      SHA512

                      67e15b531213cb19080a26ba61281ddc9db5e1a8f1125241d34eca4097cf020081827d3f63c49b3ac6d4b1e651c0bf7af0c96f461d312470e5946830d974ff7d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Simplified
                      Filesize

                      22KB

                      MD5

                      e2fa682e3bbba82ad68e3a8770751da2

                      SHA1

                      2a22006385ee1386d8ab359e45794e043ea73845

                      SHA256

                      f5c0563e8cb841e8ca1b1480eb512334f1a9c4f0172a21d39514c37d4c6eb8af

                      SHA512

                      b829346501967a932fa72b41d19687217ca042fe8fee5d92f3361f32057c0aae011b6457d30dcf030ba7a2ca2e6613182edc79f91f2e560233dda26fb0717994

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Stored
                      Filesize

                      72KB

                      MD5

                      4968ca19c1e07ca817149225f5fdae4a

                      SHA1

                      5eb15169a968ea921edf0a88cb2a0f501ad108c1

                      SHA256

                      144ad9f5e00905fe457459e5501b341e1523d37c6a5947efe2a12e01c103ca21

                      SHA512

                      9fbb0e5b0c27ee7770cdc51e5d249cd522dbd4fa8d87e20d9d253ec4bd6dbc18f4b4433fec415bf1dd42801ed5466624cde34b481533d898905aef506cd77c00

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Tar35F2.tmp
                      Filesize

                      181KB

                      MD5

                      4ea6026cf93ec6338144661bf1202cd1

                      SHA1

                      a1dec9044f750ad887935a01430bf49322fbdcb7

                      SHA256

                      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                      SHA512

                      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Tech
                      Filesize

                      12KB

                      MD5

                      c190bf2940b6c8bca86355ca1f5d100f

                      SHA1

                      1b6694187b834041aa2e3577e47ebdfebd9dc9de

                      SHA256

                      24c658f99200081bceae83740631ab7326b8a328f23364104c9e534d191ffb28

                      SHA512

                      01a253b228778be835e619b8b1f4e08ed22c095cd7e935421065bef0acd91fd6089f4b6d3edaa43aa7bdf73d127e7af312feb0a7c0035aedbce48486b334326d

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Tiny
                      Filesize

                      68KB

                      MD5

                      45bc518ce494d5b80c2b6af80adff8bb

                      SHA1

                      7defa2817736bacca12072ca858d61064bbde5a3

                      SHA256

                      0cd19abfc3719aaf60e84529980afb15b58e753980b9d089dff32913a9b8e88b

                      SHA512

                      a12cad7b9f58d2897b46c9bbfc361c861f2586177e8a1cbadb74d1b33d32e7a71af69e123bf7d807a4ec39e54cf1414663a508979b23b4c36344a52d481f2f5f

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\Uh.cmd
                      Filesize

                      12KB

                      MD5

                      a26452a5a6b681e1680ff91ddcfa2c5c

                      SHA1

                      7fe7878abf2f3d5ec30bac96bb32db574416edb5

                      SHA256

                      717fb7062ce364fbb54c89e1aba5a0de1e3bf3bc239b6c6cdc4972aa6f96fee3

                      SHA512

                      8a3e5ab0aef13f066280d58063af9a34a9df2053dc417224c57ffa7a174e9ab253ca38efba4753c18d2e1130f8a60a030713b4446c44472e71335386e93f4e08

                      Download Submit

                    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                      Filesize

                      3.1MB

                      MD5

                      3f37f3ed555ba8cb563f1c44d48f7dc0

                      SHA1

                      4e48a0cc1ca64a4adf0fe130c271e042c8d5cf79

                      SHA256

                      a604d7f02b52f55cf29de06b95c46eab8b3c2026e2572a176820bc5dbee59551

                      SHA512

                      4231e1529f2c8d6dee89adbd852d2aaf19f14a274262f6d833467db493f4e713563631f3b12659fc9e2610e9714b6d3dcae94c206b5fe94c5888b5a8f53f54f2

                      Download Submit

                    • \??\pipe\crashpad_2300_KXGUNGJSTLUZBAYY
                      MD5

                      d41d8cd98f00b204e9800998ecf8427e

                      SHA1

                      da39a3ee5e6b4b0d3255bfef95601890afd80709

                      SHA256

                      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                      SHA512

                      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                      Download Submit

                    • \Users\Admin\AppData\Local\Temp\27375\Lovely.pif
                      Filesize

                      921KB

                      MD5

                      78ba0653a340bac5ff152b21a83626cc

                      SHA1

                      b12da9cb5d024555405040e65ad89d16ae749502

                      SHA256

                      05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7

                      SHA512

                      efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317

                      Download Submit

                    • memory/1788-469-0x0000000000E00000-0x000000000110A000-memory.dmp

                      Filesize

                      3.0MB

                      Download

                    • memory/1788-406-0x0000000000E00000-0x000000000110A000-memory.dmp

                      Filesize

                      3.0MB

                      Download

                    • memory/1928-467-0x000000000AC20000-0x000000000AF45000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-528-0x0000000006E90000-0x0000000007A2B000-memory.dmp

                      Filesize

                      11.6MB

                      Download

                    • memory/1928-82-0x0000000001141000-0x00000000011A9000-memory.dmp

                      Filesize

                      416KB

                      Download

                    • memory/1928-85-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-47-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-24-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-23-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-21-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-407-0x0000000006D90000-0x000000000709A000-memory.dmp

                      Filesize

                      3.0MB

                      Download

                    • memory/1928-405-0x0000000006D90000-0x000000000709A000-memory.dmp

                      Filesize

                      3.0MB

                      Download

                    • memory/1928-20-0x0000000001141000-0x00000000011A9000-memory.dmp

                      Filesize

                      416KB

                      Download

                    • memory/1928-425-0x0000000006ED0000-0x0000000007561000-memory.dmp

                      Filesize

                      6.6MB

                      Download

                    • memory/1928-629-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-426-0x0000000006ED0000-0x0000000007561000-memory.dmp

                      Filesize

                      6.6MB

                      Download

                    • memory/1928-626-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-19-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-618-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-80-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-594-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-597-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-466-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-470-0x0000000006D90000-0x000000000709A000-memory.dmp

                      Filesize

                      3.0MB

                      Download

                    • memory/1928-471-0x0000000006D90000-0x000000000709A000-memory.dmp

                      Filesize

                      3.0MB

                      Download

                    • memory/1928-544-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-540-0x0000000006E90000-0x0000000007A2B000-memory.dmp

                      Filesize

                      11.6MB

                      Download

                    • memory/1928-485-0x0000000006D90000-0x000000000704A000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/1928-538-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-524-0x0000000006D90000-0x000000000704A000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/1928-490-0x0000000006ED0000-0x0000000007561000-memory.dmp

                      Filesize

                      6.6MB

                      Download

                    • memory/1928-519-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-499-0x000000000AC20000-0x000000000AF45000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-614-0x0000000001140000-0x0000000001465000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/1928-516-0x0000000006E90000-0x0000000007A2B000-memory.dmp

                      Filesize

                      11.6MB

                      Download

                    • memory/1928-517-0x0000000006E90000-0x0000000007A2B000-memory.dmp

                      Filesize

                      11.6MB

                      Download

                    • memory/2024-487-0x0000000000AD0000-0x0000000000D8A000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/2024-486-0x0000000000AD0000-0x0000000000D8A000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/2024-520-0x0000000000AD0000-0x0000000000D8A000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/2024-488-0x0000000000AD0000-0x0000000000D8A000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/2024-527-0x0000000000AD0000-0x0000000000D8A000-memory.dmp

                      Filesize

                      2.7MB

                      Download

                    • memory/2120-541-0x00000000010D0000-0x0000000001C6B000-memory.dmp

                      Filesize

                      11.6MB

                      Download

                    • memory/2120-613-0x00000000010D0000-0x0000000001C6B000-memory.dmp

                      Filesize

                      11.6MB

                      Download

                    • memory/2120-595-0x00000000010D0000-0x0000000001C6B000-memory.dmp

                      Filesize

                      11.6MB

                      Download

                    • memory/2120-529-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                      Filesize

                      10.4MB

                      Download

                    • memory/2120-598-0x00000000010D0000-0x0000000001C6B000-memory.dmp

                      Filesize

                      11.6MB

                      Download

                    • memory/2120-539-0x00000000010D0000-0x0000000001C6B000-memory.dmp

                      Filesize

                      11.6MB

                      Download

                    • memory/2120-545-0x00000000010D0000-0x0000000001C6B000-memory.dmp

                      Filesize

                      11.6MB

                      Download

                    • memory/2120-518-0x00000000010D0000-0x0000000001C6B000-memory.dmp

                      Filesize

                      11.6MB

                      Download

                    • memory/2120-615-0x00000000010D0000-0x0000000001C6B000-memory.dmp

                      Filesize

                      11.6MB

                      Download

                    • memory/2396-616-0x0000000000240000-0x0000000000252000-memory.dmp

                      Filesize

                      72KB

                      Download

                    • memory/2396-617-0x0000000073140000-0x0000000073274000-memory.dmp

                      Filesize

                      1.2MB

                      Download

                    • memory/2500-493-0x0000000000080000-0x00000000000D6000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2500-523-0x0000000000080000-0x00000000000D6000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2500-521-0x0000000000080000-0x00000000000D6000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2540-18-0x00000000072B0000-0x00000000075D5000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2540-1-0x0000000076F80000-0x0000000076F82000-memory.dmp

                      Filesize

                      8KB

                      Download

                    • memory/2540-2-0x0000000000BD1000-0x0000000000C39000-memory.dmp

                      Filesize

                      416KB

                      Download

                    • memory/2540-3-0x0000000000BD0000-0x0000000000EF5000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2540-5-0x0000000000BD0000-0x0000000000EF5000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2540-9-0x0000000000BD0000-0x0000000000EF5000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2540-15-0x0000000000BD0000-0x0000000000EF5000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2540-0-0x0000000000BD0000-0x0000000000EF5000-memory.dmp

                      Filesize

                      3.1MB

                      Download

                    • memory/2540-17-0x0000000000BD1000-0x0000000000C39000-memory.dmp

                      Filesize

                      416KB

                      Download

                    • memory/2560-623-0x00000000000C0000-0x0000000000116000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2560-625-0x00000000000C0000-0x0000000000116000-memory.dmp

                      Filesize

                      344KB

                      Download

                    • memory/2852-428-0x0000000000230000-0x00000000008C1000-memory.dmp

                      Filesize

                      6.6MB

                      Download

                    • memory/2852-427-0x0000000000230000-0x00000000008C1000-memory.dmp

                      Filesize

                      6.6MB

                      Download