Overview

overview

10

Static

static

3

561a986291...5f.exe

windows7-x64

10

561a986291...5f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-11-2024 02:43

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    561a986291b7ae3b790dd250da49f5011828cf18faffd9aad325d712cef4595f.exe

  • Size

    1.8MB

  • MD5

    7b79bbb0cffcd10a2c1ec7c50834030a

  • SHA1

    5e72bee282ef61fa7f65bd10b58b6deb0f8dc2d8

  • SHA256

    561a986291b7ae3b790dd250da49f5011828cf18faffd9aad325d712cef4595f

  • SHA512

    fdc8ef7c76ccf238ec6393e75f8314921f41a1a37a30f067c8860033a9752802091b84f23f4f901dd195c15de15d37548f0230e3bc23a416459fa490f68980c0

  • SSDEEP

    24576:dlfJRq0Xj0f5naPOcMspJ+ZRsHSOY9cLmI2DWk337f0IJlZB3pQ4VTLlFO8xhh8b:dxJRq5n23wR8SdVx3L0AZB7VFZvcGJ

Score
10/10
amadeycryptbotstealc9c9aa5marscredential_accessdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 3 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 59 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\561a986291b7ae3b790dd250da49f5011828cf18faffd9aad325d712cef4595f.exe
    "C:\Users\Admin\AppData\Local\Temp\561a986291b7ae3b790dd250da49f5011828cf18faffd9aad325d712cef4595f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4320
      • C:\Users\Admin\AppData\Local\Temp\1007518001\mixeleven.exe
        "C:\Users\Admin\AppData\Local\Temp\1007518001\mixeleven.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:228
        • C:\Users\Admin\AppData\Local\Temp\1007518001\mixeleven.exe
          "C:\Users\Admin\AppData\Local\Temp\1007518001\mixeleven.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:372
      • C:\Users\Admin\AppData\Local\Temp\1007559001\9857f8b57a.exe
        "C:\Users\Admin\AppData\Local\Temp\1007559001\9857f8b57a.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:2580
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:3208
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa49c1cc40,0x7ffa49c1cc4c,0x7ffa49c1cc58
            5⤵
              PID:1256
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2328,i,7461228889759855082,699239242018215808,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2324 /prefetch:2
              5⤵
                PID:2524
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1712,i,7461228889759855082,699239242018215808,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2356 /prefetch:3
                5⤵
                  PID:5948
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1236,i,7461228889759855082,699239242018215808,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2460 /prefetch:8
                  5⤵
                    PID:5584
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,7461228889759855082,699239242018215808,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3196 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:1940
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,7461228889759855082,699239242018215808,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3244 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:2716
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:5168
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:3620
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 2580 -s 1860
                  4⤵
                  • Program crash
                  PID:1984
              • C:\Users\Admin\AppData\Local\Temp\1007560001\2b5b18fc02.exe
                "C:\Users\Admin\AppData\Local\Temp\1007560001\2b5b18fc02.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2328
              • C:\Users\Admin\AppData\Local\Temp\1007561001\59010b1b94.exe
                "C:\Users\Admin\AppData\Local\Temp\1007561001\59010b1b94.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2496
              • C:\Users\Admin\AppData\Local\Temp\1007562001\8770329447.exe
                "C:\Users\Admin\AppData\Local\Temp\1007562001\8770329447.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:1240
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3940
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4936
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5092
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2612
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1660
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2352
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                    5⤵
                    • Checks processor information in registry
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1792
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2000 -parentBuildID 20240401114208 -prefsHandle 1928 -prefMapHandle 1888 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66f965dc-3cbd-47d8-8d81-12c32edd0380} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" gpu
                      6⤵
                        PID:1348
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4acf7269-ce59-4709-acde-6e48291986ed} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" socket
                        6⤵
                          PID:1092
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3084 -childID 1 -isForBrowser -prefsHandle 2948 -prefMapHandle 3164 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac060c5d-a074-419b-84bf-075852c1dbfd} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                          6⤵
                            PID:2024
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3892 -childID 2 -isForBrowser -prefsHandle 1228 -prefMapHandle 872 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a25b55d3-d116-4c36-b175-5d87bf466077} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                            6⤵
                              PID:2576
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4624 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4616 -prefMapHandle 4604 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c659a39d-5064-4890-96f1-404ec308b74a} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" utility
                              6⤵
                              • Checks processor information in registry
                              PID:5372
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5292 -childID 3 -isForBrowser -prefsHandle 5356 -prefMapHandle 5360 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {27a90e15-1029-4485-b11e-7ff1cf12c8ca} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                              6⤵
                                PID:724
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5272 -childID 4 -isForBrowser -prefsHandle 5332 -prefMapHandle 5312 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2a42d60-3232-49db-bbe2-d558fb5ba39a} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                                6⤵
                                  PID:5124
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 5 -isForBrowser -prefsHandle 5712 -prefMapHandle 5720 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1268 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd587127-4ffc-4364-b83f-0a6dd21cc5bd} 1792 "\\.\pipe\gecko-crash-server-pipe.1792" tab
                                  6⤵
                                    PID:5148
                            • C:\Users\Admin\AppData\Local\Temp\1007563001\6a36ab51ad.exe
                              "C:\Users\Admin\AppData\Local\Temp\1007563001\6a36ab51ad.exe"
                              3⤵
                              • Modifies Windows Defender Real-time Protection settings
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Windows security modification
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5792
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                          1⤵
                            PID:8
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5780
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2580 -ip 2580
                            1⤵
                              PID:5756
                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              1⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4164
                            • C:\Users\Admin\AppData\Local\Temp\service123.exe
                              C:\Users\Admin\AppData\Local\Temp\/service123.exe
                              1⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              PID:3556

                            Network

                            MITRE ATT&CK Enterprise v15

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Persistence

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Modify Authentication Process

                            1
                            T1556

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            1
                            T1547

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Scheduled Task/Job

                            1
                            T1053

                            Scheduled Task

                            1
                            T1053.005

                            Defense Evasion

                            Impair Defenses

                            2
                            T1562

                            Disable or Modify Tools

                            2
                            T1562.001

                            Modify Authentication Process

                            1
                            T1556

                            Modify Registry

                            3
                            T1112

                            Virtualization/Sandbox Evasion

                            2
                            T1497

                            Credential Access

                            Credentials from Password Stores

                            1
                            T1555

                            Credentials from Web Browsers

                            1
                            T1555.003

                            Modify Authentication Process

                            1
                            T1556

                            Steal Web Session Cookie

                            1
                            T1539

                            Unsecured Credentials

                            1
                            T1552

                            Credentials In Files

                            1
                            T1552.001

                            Discovery

                            Browser Information Discovery

                            1
                            T1217

                            Query Registry

                            8
                            T1012

                            System Information Discovery

                            5
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            Virtualization/Sandbox Evasion

                            2
                            T1497

                            Lateral Movement

                            Collection

                            Data from Local System

                            1
                            T1005

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\download[1].htm
                              Filesize

                              1B

                              MD5

                              cfcd208495d565ef66e7dff9f98764da

                              SHA1

                              b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                              SHA256

                              5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                              SHA512

                              31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\activity-stream.discovery_stream.json
                              Filesize

                              27KB

                              MD5

                              deb9dd2e13f3e7f10bcfb5ff4965c466

                              SHA1

                              d007e3eecc22ebb5eee11b84ec4c2fb40dfd665b

                              SHA256

                              9688e588922a50b11c002ebfff9b784eb3121883b494fdc23526a4420f475fbc

                              SHA512

                              60ff29249629d9a343682b4d19bbadf35bdae3e811242a096f0288a7d827fbf1faec839531d21008ef02816d8164324db4d0c3612015748f5f688a93fc1b303d

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yuzka873.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
                              Filesize

                              13KB

                              MD5

                              377c6185136a450efb409ee3f01f3fd3

                              SHA1

                              136fc6bc4735c2a3bd33a450dbfa7d74ae4e9a12

                              SHA256

                              1dd9eb583d3409e5712797ce91d0df4fe08919005cc937d8d9b2153dbda40212

                              SHA512

                              0fa9ddf2152216e3dffeec41aec816a860f5b18e22877883d21b8a443e69347f49d9021eed74331fae47cb97813dc86d1d4023e44c24e2324a2b7596c12f815c

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1007518001\mixeleven.exe
                              Filesize

                              428KB

                              MD5

                              5237853dbebaefb1dfa86130dd1d39fa

                              SHA1

                              c2a42211c8970e1f10cc13261d5e133739c196f4

                              SHA256

                              e185e43f039f7a97672db4a44597abd6d2bf49c08d7bc689318a098ec826bb00

                              SHA512

                              72fc21a0d325b88b4e99d66d05f77ac362aa03cdd41db053cfecd2fec148740bc5349fa45001650500f844ff76784bc12177543deb8d075c5c84e93420c15c7a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1007559001\9857f8b57a.exe
                              Filesize

                              4.2MB

                              MD5

                              2ca191450d69dcbee0485f1c14135040

                              SHA1

                              6cf3997d6e3f246bcad8497476fea2dd792199fa

                              SHA256

                              d91b3f6f4e566fff74506d30a1a61597c03f07b1f826f393bebfee12cbc8d95d

                              SHA512

                              8a4241a3cd9531db18b75b5bed1a384daf71a45876f85de6821bcecfdb2c6f7efd67facb35313afe496696a5c73e2b36d6aa17b96b39d1c84593a61a61715e2a

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1007560001\2b5b18fc02.exe
                              Filesize

                              1.8MB

                              MD5

                              c6774985fc109440ce01c0bdf1978a96

                              SHA1

                              6c3c8e16544c299ee31175d7796679da0bf33736

                              SHA256

                              eaa41c656c107cadd3ecd84eb6f9338185db27b7ed156e8244446fa46b3b936b

                              SHA512

                              9b3bb6f1de8a84cf3163faa52444c993c2ad46981b26e95e00a7d2e7eb3d676c8d8826419b6f1273fdaaa9db7daa0f520186599230b0dff949ad4385a3b5d316

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1007561001\59010b1b94.exe
                              Filesize

                              1.7MB

                              MD5

                              af00fae5bf606001c0c6ef0b98fb54d0

                              SHA1

                              a24fe73ec0b2d0190d3f6f068ca3c13a6cde4fd3

                              SHA256

                              8b1fbd75e6fcdf963260148537cae0d876130656c343518a5d7623937d4f0881

                              SHA512

                              e08d6691ed7092e2f569391ef89c6b3528630ff449372b064e06ebde2e7de482517e7407c81ce75a190d74936c64a0c31f5acc23efeffe6f54622184f780a5bc

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1007562001\8770329447.exe
                              Filesize

                              900KB

                              MD5

                              5ddbda8baef12cdd69941b253fee8aec

                              SHA1

                              57e7be2b1a5a94a521da718c857cc47de4ca51de

                              SHA256

                              eb24498db31fab6a17b5b5c1eee0e87f46c324b74edc6b76db8ed4c0c66dcdd8

                              SHA512

                              648e76c6cf42268166e57afa3f9a7b5dadd5ac63eb13898e12098b173eb27b726cf7624b01b0404b3f73bf54d96595c21c2a2e4a991604c76d5aa83bcd32f139

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\1007563001\6a36ab51ad.exe
                              Filesize

                              2.7MB

                              MD5

                              8016e5d93e55bb0356c789bb6ba0bdbe

                              SHA1

                              d22bb6723ea29ff986bdbcda2943b6f77f9121e6

                              SHA256

                              683609cf5dad7e5a984bf4ebab65c2fa2a6d59724507b7c5e9d240932f2994a4

                              SHA512

                              02a0988cdf9fad5e64893c9271ca4b7cd9008214193c713b1e068912461a7e4d01342c97c96ab0091c25c7444705ba516ef7349ead6843f9cfb9127278d1d0c0

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                              Filesize

                              1.8MB

                              MD5

                              7b79bbb0cffcd10a2c1ec7c50834030a

                              SHA1

                              5e72bee282ef61fa7f65bd10b58b6deb0f8dc2d8

                              SHA256

                              561a986291b7ae3b790dd250da49f5011828cf18faffd9aad325d712cef4595f

                              SHA512

                              fdc8ef7c76ccf238ec6393e75f8314921f41a1a37a30f067c8860033a9752802091b84f23f4f901dd195c15de15d37548f0230e3bc23a416459fa490f68980c0

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                              Filesize

                              479KB

                              MD5

                              09372174e83dbbf696ee732fd2e875bb

                              SHA1

                              ba360186ba650a769f9303f48b7200fb5eaccee1

                              SHA256

                              c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                              SHA512

                              b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                              Download Submit

                            • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                              Filesize

                              13.8MB

                              MD5

                              0a8747a2ac9ac08ae9508f36c6d75692

                              SHA1

                              b287a96fd6cc12433adb42193dfe06111c38eaf0

                              SHA256

                              32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                              SHA512

                              59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\AlternateServices.bin
                              Filesize

                              10KB

                              MD5

                              d18ab6e34671c691d4f2d572b2069142

                              SHA1

                              63ffeba79a3ad659cfdfa5c362531c1d3337fbfa

                              SHA256

                              b9bfc10bdfeb79f17a5362e85ab3576841ce92a2d6e384f6c5b772783732be4c

                              SHA512

                              60316dc2cf3ccdf7dbfc093b1325658c7094785deafaf8f374eed470836e686d71929c13ff73d78e645c1e680ac622535f85e28421f68f363e9c201acbb7fdc0

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              25KB

                              MD5

                              3311ffc7ad49989416fbd34a80540207

                              SHA1

                              c807cb62000403ccc90671afed8b92f3d5bdbad4

                              SHA256

                              638b6d26a7a7891fd952430b7014bf0766f7cc5d5e4ed683f387c6e5ff4832c4

                              SHA512

                              c1a0f1b6f644143046a6006e72d4528247ff26f533c4047bc632289e98eb10e343e9fd64fca7cb460b960ba6f437dc620ecba9164a767c77d200ac8e0ae810e0

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              22KB

                              MD5

                              81eb8a83aa5b9eb438582a6246e72b47

                              SHA1

                              2429a34e688afc8b11b23d5a349d5d1a2808f6b2

                              SHA256

                              9880df1d696a16db658f865629cce05c1aa22b6ab5c6f5a2eb56c5947b4f58a1

                              SHA512

                              717a88ad82dd8cebe0b86c3f3bdde1d75fc719dcfaef52ad553d2fb3061ad1e1c381c6a409af8bdc33440fa2da84374be62f9e152f9fcd3daa053ac0960ae660

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\db\data.safe.tmp
                              Filesize

                              22KB

                              MD5

                              127875ad6e97223c55f0a201936a4e6f

                              SHA1

                              f7ec0c4fa2b8e7f773663bac9cf0ec2047fc5bc9

                              SHA256

                              7c961b68ea9592b021e2eb766baa75f370f2e311042e964b3dccdaf2130bde5c

                              SHA512

                              00d184cfcc8bc689a9070a17f77d31268781463084c756b497fc3967c6e1aa628865e4be9932952d5a162033a8b70be44f3af1d6db0d17ac063eaa8f3a05f702

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\99ac4d44-5b3a-4d65-bd04-8a3055aedd72
                              Filesize

                              659B

                              MD5

                              915d6393587f485d2b6d562e335d0b2e

                              SHA1

                              66094c1b730df44e4d886c01c0403fbe292073ed

                              SHA256

                              f8774d2a25ba3b35242a0a8dfe0ef006ae8e7d1367d68e33386160917ac13cc1

                              SHA512

                              def9fcf6bcff6468618a9d0feb974768ef74091bdd38235c48608cfb46e557911ddd9c6bd332229dd03c5fdee50952c89b241cdd229f90f5fe05d10757804939

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\datareporting\glean\pending_pings\a24d8039-2329-42b5-8ea2-2aebd59b71c0
                              Filesize

                              982B

                              MD5

                              4375e3f438b838905dcc4fe592542433

                              SHA1

                              741c73bcf1630b19e1f76003d059e2a32b49d45e

                              SHA256

                              9ec9d8ea73e3f7b64fdb42cdc7fe5f9ebef4a1dfb5a4d70cd82150c290131f00

                              SHA512

                              3081b611cf259146f15acd230bac7d22438eca91bd0aab9e6e3c015c0f1d899e17d6b757f9e0b24de2f4c578ce010a7ee73571d0d6f6181021fff1e5899c2b08

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                              Filesize

                              1.1MB

                              MD5

                              842039753bf41fa5e11b3a1383061a87

                              SHA1

                              3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                              SHA256

                              d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                              SHA512

                              d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                              Filesize

                              116B

                              MD5

                              2a461e9eb87fd1955cea740a3444ee7a

                              SHA1

                              b10755914c713f5a4677494dbe8a686ed458c3c5

                              SHA256

                              4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                              SHA512

                              34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                              Filesize

                              372B

                              MD5

                              bf957ad58b55f64219ab3f793e374316

                              SHA1

                              a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                              SHA256

                              bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                              SHA512

                              79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                              Filesize

                              17.8MB

                              MD5

                              daf7ef3acccab478aaa7d6dc1c60f865

                              SHA1

                              f8246162b97ce4a945feced27b6ea114366ff2ad

                              SHA256

                              bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                              SHA512

                              5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
                              Filesize

                              12KB

                              MD5

                              2ba32e7969c9ec25bc0719ac66f6844f

                              SHA1

                              20a490109d32fdb1f9a4ac0fe3db98be6a446fa4

                              SHA256

                              25bad038fd8e924d2c9e89f6a296d77a3a7c7d4265dfc24cbcd9329cf8a07187

                              SHA512

                              e82c8e31fbc798d86a98857a3d508fd61949b77e8fb08a2c658c55f6b228c2a310b2e7853e4b0d95e5943a1ea134b951ab484190d031ade74724d7a5919ed253

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
                              Filesize

                              10KB

                              MD5

                              9c55a00d1e5c7e46fd96d492338db8e7

                              SHA1

                              c2d3a2f8ca46efd5534aa7c42aac30b58838d274

                              SHA256

                              a1361df9f817647dd75e53d5e66848c3bad0a8bf32779d3f16bd01f2225d316a

                              SHA512

                              1d36d0017bfd7a97e2d201d114edbe0cdd3b786991474f66a685904bf09049970bc7d97a96964c13cd8ca8e97a38ff0b34df2108f87e6e33c067fcb1127ce94c

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs-1.js
                              Filesize

                              15KB

                              MD5

                              b7f0291b89d52736dde8c78d3601e0d9

                              SHA1

                              00bf25325bb92c4307cd743f9ac7e6850f45523a

                              SHA256

                              32e2f2ddbe8314a0ea93c49bee5bef3af0701273d40872c478ac89f9473b7113

                              SHA512

                              35f4ad86c22f7c6b0d3632ceda42ed148f92f74585b0dcc31cef6374b78c1b2ab10ef8fd71ef5f8322861d3a2b9121c57fb5bf685e0b074202431507d8303517

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
                              Filesize

                              10KB

                              MD5

                              7365da68cd6493caf9f5fc2f52f7d90f

                              SHA1

                              2e8fb693c61ef019e31133801930aa7464e1e7b7

                              SHA256

                              245a575151822ac66230e3b3cd412a49f99b2820223b17787c42a0a568dd46e9

                              SHA512

                              6c0d5a8a044ffd9c6063bcb3d280a407adf734443076d2790a61ff15f41fc8093bfc592e2ebb47d2049666564462a30947a9073d3920e3cf09d66820c9bd7789

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                              Filesize

                              1.4MB

                              MD5

                              21acdad442c1912f285dd6cf9ef2a87b

                              SHA1

                              dfdff3ffa8ab5d1aa0538758eb6a99414737dd34

                              SHA256

                              96e1d4ad69acae1862f38f804d8839296697e464c5a4846f588baef66dddb79f

                              SHA512

                              04c5eadefa3c981ee7df199ecbb8ea6267b7f473ff304efd66eb3b63eb5cc23f2f77f72c50790ea50d195e5792199cd07ea6804953f68a6bf0702fec0161fc18

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                              Filesize

                              1.7MB

                              MD5

                              aeb896622ce8e2216aec276dae7118cb

                              SHA1

                              ec0d7fbbe4185329fdba5ddf3a3afb849d12c834

                              SHA256

                              30630242838070b4c38b6490a665eb8e852ab05a9886d47009e48142b430401e

                              SHA512

                              597d6127b8e78f36a5919e0be8974bc59e60bb8f929f8f872f5ace539d122820ff2e9a8e98c7424d0facb48769233728669c340244deff91c8219671085d9bfb

                              Download Submit

                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                              Filesize

                              1.9MB

                              MD5

                              fe8bebf48e6f2d372e0e8366d99b7a92

                              SHA1

                              57131b54e261fec2a53f82b80e4c25d2411e2f81

                              SHA256

                              367ce1a9603791b01e1908c07d08723f0627dba0f855daed831a43c9eaf79b8c

                              SHA512

                              e19298d89a5ca87ff79e4b4e80aba63371ffd253abe22185ce74139805be4c6d98b9fd97a5e8ed14ecf38c50751ee66f56bd0ce58ad1c08614f76b44e10fba8c

                              Download Submit

                            • \??\pipe\crashpad_3208_SCDWDVMZUMAEQGNW
                              MD5

                              d41d8cd98f00b204e9800998ecf8427e

                              SHA1

                              da39a3ee5e6b4b0d3255bfef95601890afd80709

                              SHA256

                              e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                              SHA512

                              cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                              Download Submit

                            • memory/228-39-0x00000000005E0000-0x000000000060E000-memory.dmp

                              Filesize

                              184KB

                              Download

                            • memory/228-38-0x00000000001C0000-0x00000000001EC000-memory.dmp

                              Filesize

                              176KB

                              Download

                            • memory/372-41-0x0000000000400000-0x0000000000431000-memory.dmp

                              Filesize

                              196KB

                              Download

                            • memory/372-42-0x0000000000400000-0x0000000000431000-memory.dmp

                              Filesize

                              196KB

                              Download

                            • memory/372-577-0x0000000000400000-0x0000000000431000-memory.dmp

                              Filesize

                              196KB

                              Download

                            • memory/372-48-0x0000000010000000-0x000000001001C000-memory.dmp

                              Filesize

                              112KB

                              Download

                            • memory/372-36-0x0000000000400000-0x0000000000431000-memory.dmp

                              Filesize

                              196KB

                              Download

                            • memory/372-87-0x0000000000400000-0x0000000000431000-memory.dmp

                              Filesize

                              196KB

                              Download

                            • memory/372-40-0x0000000000400000-0x0000000000431000-memory.dmp

                              Filesize

                              196KB

                              Download

                            • memory/2328-89-0x0000000000240000-0x00000000006E1000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2328-92-0x0000000000240000-0x00000000006E1000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/2496-120-0x0000000000670000-0x0000000000D05000-memory.dmp

                              Filesize

                              6.6MB

                              Download

                            • memory/2496-118-0x0000000000670000-0x0000000000D05000-memory.dmp

                              Filesize

                              6.6MB

                              Download

                            • memory/2580-597-0x00000000000A0000-0x0000000000CE4000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/2580-852-0x00000000000A0000-0x0000000000CE4000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/2580-70-0x00000000000A0000-0x0000000000CE4000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/2580-141-0x00000000000A0000-0x0000000000CE4000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/2580-2199-0x00000000000A0000-0x0000000000CE4000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/2580-2598-0x00000000000A0000-0x0000000000CE4000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/2580-574-0x00000000000A0000-0x0000000000CE4000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/2580-122-0x00000000000A0000-0x0000000000CE4000-memory.dmp

                              Filesize

                              12.3MB

                              Download

                            • memory/2580-106-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                              Filesize

                              10.4MB

                              Download

                            • memory/3556-3447-0x0000000000D50000-0x0000000000D62000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/4164-3442-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4164-3444-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-1809-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-734-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-18-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-20-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-3454-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-3451-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-119-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-514-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-17-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-3423-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-3448-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-43-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-53-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-3431-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-596-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-3435-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-3229-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-52-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-19-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-46-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4320-3438-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4908-4-0x0000000000280000-0x0000000000722000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4908-1-0x0000000077E64000-0x0000000077E66000-memory.dmp

                              Filesize

                              8KB

                              Download

                            • memory/4908-0-0x0000000000280000-0x0000000000722000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4908-2-0x0000000000281000-0x00000000002AF000-memory.dmp

                              Filesize

                              184KB

                              Download

                            • memory/4908-3-0x0000000000280000-0x0000000000722000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/4908-16-0x0000000000280000-0x0000000000722000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5168-3419-0x0000000000D50000-0x0000000000D62000-memory.dmp

                              Filesize

                              72KB

                              Download

                            • memory/5168-3420-0x0000000073AA0000-0x0000000073BD4000-memory.dmp

                              Filesize

                              1.2MB

                              Download

                            • memory/5780-932-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5780-919-0x0000000000160000-0x0000000000602000-memory.dmp

                              Filesize

                              4.6MB

                              Download

                            • memory/5792-374-0x0000000000AF0000-0x0000000000DB2000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/5792-479-0x0000000000AF0000-0x0000000000DB2000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/5792-487-0x0000000000AF0000-0x0000000000DB2000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/5792-592-0x0000000000AF0000-0x0000000000DB2000-memory.dmp

                              Filesize

                              2.8MB

                              Download

                            • memory/5792-595-0x0000000000AF0000-0x0000000000DB2000-memory.dmp

                              Filesize

                              2.8MB

                              Download