amadey | 32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 11:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe
Size

1.8MB
MD5

274d813d41ac6d28b467ce4709bb42bb
SHA1

08670195255d587368f622f42078f9ae32e16a79
SHA256

32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d
SHA512

23935bf7eee8c89b7ccef3680e207208d338e22c0c82b0bdca2dd0a4c59f8c5f57682ebcbfd4dfc5602b50c3bb0cfc38a1ab040ac0e2e5a9f429a5df32d08b0d
SSDEEP

49152:ZLWIdST2/uCQbgNA8xpUaue1GXb8z5ZBH9Q7KGlR:BOT9MqazTGAzzBH9Q77R

Score

10^/10

amadey stealc default_valenciga fed3aa mars discovery evasion persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

stealc

Botnet

mars

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	0a6c19768c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	69602f42a3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4f023d71a2.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0a6c19768c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	0a6c19768c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	69602f42a3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4f023d71a2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4f023d71a2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	69602f42a3.exe

Executes dropped EXE 14 IoCs

pid	Process
2992	axplong.exe
2592	stealc_default2.exe
3028	aqbjn3fl.exe
1684	0a6c19768c.exe
2840	AllNew.exe
3020	Gxtuum.exe
1752	kxfh9qhs.exe
1912	Javvvum.exe
1004	stail.exe
2832	stail.tmp
2732	barrymoreplayer.exe
2888	trru7rd2.exe
2716	69602f42a3.exe
1480	4f023d71a2.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	0a6c19768c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	69602f42a3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	4f023d71a2.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe

Loads dropped DLL 27 IoCs

pid	Process
2036	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe
2992	axplong.exe
2992	axplong.exe
2992	axplong.exe
2992	axplong.exe
2992	axplong.exe
2992	axplong.exe
2992	axplong.exe
2840	AllNew.exe
2992	axplong.exe
3020	Gxtuum.exe
3020	Gxtuum.exe
3020	Gxtuum.exe
1004	stail.exe
2832	stail.tmp
2832	stail.tmp
2832	stail.tmp
2832	stail.tmp
2732	barrymoreplayer.exe
2992	axplong.exe
2992	axplong.exe
2992	axplong.exe
2992	axplong.exe
2992	axplong.exe
2108	WerFault.exe
2108	WerFault.exe
2108	WerFault.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\69602f42a3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1003810001\\69602f42a3.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\4f023d71a2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1003811001\\4f023d71a2.exe"	axplong.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2036	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe
2992	axplong.exe
1684	0a6c19768c.exe
2716	69602f42a3.exe
1480	4f023d71a2.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe
File created	C:\Windows\Tasks\Gxtuum.job	AllNew.exe

Embeds OpenSSL 2 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x0006000000019056-166.dat	embeds_openssl
behavioral1/files/0x000500000001924f-286.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2108	2592	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AllNew.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Javvvum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stail.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4f023d71a2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kxfh9qhs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	trru7rd2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69602f42a3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0a6c19768c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	barrymoreplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stail.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	kxfh9qhs.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	kxfh9qhs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	0a6c19768c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	0a6c19768c.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	0a6c19768c.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2036	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe
2992	axplong.exe
1684	0a6c19768c.exe
1752	kxfh9qhs.exe
1752	kxfh9qhs.exe
2832	stail.tmp
2832	stail.tmp
2716	69602f42a3.exe
1480	4f023d71a2.exe
2592	stealc_default2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2036	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe
2840	AllNew.exe
2832	stail.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 2992	2036	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe	28
PID 2036 wrote to memory of 2992	2036	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe	28
PID 2036 wrote to memory of 2992	2036	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe	28
PID 2036 wrote to memory of 2992	2036	32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe	28
PID 2992 wrote to memory of 2592	2992	axplong.exe	30
PID 2992 wrote to memory of 2592	2992	axplong.exe	30
PID 2992 wrote to memory of 2592	2992	axplong.exe	30
PID 2992 wrote to memory of 2592	2992	axplong.exe	30
PID 2992 wrote to memory of 3028	2992	axplong.exe	31
PID 2992 wrote to memory of 3028	2992	axplong.exe	31
PID 2992 wrote to memory of 3028	2992	axplong.exe	31
PID 2992 wrote to memory of 3028	2992	axplong.exe	31
PID 2992 wrote to memory of 1684	2992	axplong.exe	33
PID 2992 wrote to memory of 1684	2992	axplong.exe	33
PID 2992 wrote to memory of 1684	2992	axplong.exe	33
PID 2992 wrote to memory of 1684	2992	axplong.exe	33
PID 2992 wrote to memory of 2840	2992	axplong.exe	34
PID 2992 wrote to memory of 2840	2992	axplong.exe	34
PID 2992 wrote to memory of 2840	2992	axplong.exe	34
PID 2992 wrote to memory of 2840	2992	axplong.exe	34
PID 2840 wrote to memory of 3020	2840	AllNew.exe	35
PID 2840 wrote to memory of 3020	2840	AllNew.exe	35
PID 2840 wrote to memory of 3020	2840	AllNew.exe	35
PID 2840 wrote to memory of 3020	2840	AllNew.exe	35
PID 2992 wrote to memory of 1752	2992	axplong.exe	39
PID 2992 wrote to memory of 1752	2992	axplong.exe	39
PID 2992 wrote to memory of 1752	2992	axplong.exe	39
PID 2992 wrote to memory of 1752	2992	axplong.exe	39
PID 3020 wrote to memory of 1912	3020	Gxtuum.exe	40
PID 3020 wrote to memory of 1912	3020	Gxtuum.exe	40
PID 3020 wrote to memory of 1912	3020	Gxtuum.exe	40
PID 3020 wrote to memory of 1912	3020	Gxtuum.exe	40
PID 3020 wrote to memory of 1004	3020	Gxtuum.exe	41
PID 3020 wrote to memory of 1004	3020	Gxtuum.exe	41
PID 3020 wrote to memory of 1004	3020	Gxtuum.exe	41
PID 3020 wrote to memory of 1004	3020	Gxtuum.exe	41
PID 3020 wrote to memory of 1004	3020	Gxtuum.exe	41
PID 3020 wrote to memory of 1004	3020	Gxtuum.exe	41
PID 3020 wrote to memory of 1004	3020	Gxtuum.exe	41
PID 1004 wrote to memory of 2832	1004	stail.exe	42
PID 1004 wrote to memory of 2832	1004	stail.exe	42
PID 1004 wrote to memory of 2832	1004	stail.exe	42
PID 1004 wrote to memory of 2832	1004	stail.exe	42
PID 1004 wrote to memory of 2832	1004	stail.exe	42
PID 1004 wrote to memory of 2832	1004	stail.exe	42
PID 1004 wrote to memory of 2832	1004	stail.exe	42
PID 2832 wrote to memory of 2244	2832	stail.tmp	43
PID 2832 wrote to memory of 2244	2832	stail.tmp	43
PID 2832 wrote to memory of 2244	2832	stail.tmp	43
PID 2832 wrote to memory of 2244	2832	stail.tmp	43
PID 2832 wrote to memory of 2732	2832	stail.tmp	45
PID 2832 wrote to memory of 2732	2832	stail.tmp	45
PID 2832 wrote to memory of 2732	2832	stail.tmp	45
PID 2832 wrote to memory of 2732	2832	stail.tmp	45
PID 2244 wrote to memory of 1744	2244	net.exe	46
PID 2244 wrote to memory of 1744	2244	net.exe	46
PID 2244 wrote to memory of 1744	2244	net.exe	46
PID 2244 wrote to memory of 1744	2244	net.exe	46
PID 2992 wrote to memory of 2888	2992	axplong.exe	47
PID 2992 wrote to memory of 2888	2992	axplong.exe	47
PID 2992 wrote to memory of 2888	2992	axplong.exe	47
PID 2992 wrote to memory of 2888	2992	axplong.exe	47
PID 2992 wrote to memory of 2716	2992	axplong.exe	48
PID 2992 wrote to memory of 2716	2992	axplong.exe	48

C:\Users\Admin\AppData\Local\Temp\32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe
"C:\Users\Admin\AppData\Local\Temp\32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2592
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 764
      4⤵
      Loads dropped DLL
      Program crash
      PID:2108
- - C:\Users\Admin\AppData\Local\Temp\1001527001\aqbjn3fl.exe
    "C:\Users\Admin\AppData\Local\Temp\1001527001\aqbjn3fl.exe"
    3⤵
    - Executes dropped EXE
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\1002824001\0a6c19768c.exe
    "C:\Users\Admin\AppData\Local\Temp\1002824001\0a6c19768c.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe
    "C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
      "C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\10000270101\Javvvum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000270101\Javvvum.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\10000281101\stail.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000281101\stail.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\is-USS2T.tmp\stail.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-USS2T.tmp\stail.tmp" /SL5="$9010A,3638454,54272,C:\Users\Admin\AppData\Local\Temp\10000281101\stail.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\system32\net.exe" pause barrymore_player_11211
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 pause barrymore_player_11211
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Barrymore Player 2.2.22\barrymoreplayer.exe
        
        "C:\Users\Admin\AppData\Local\Barrymore Player 2.2.22\barrymoreplayer.exe" -i
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2732
- - C:\Users\Admin\AppData\Local\Temp\1003374001\kxfh9qhs.exe
    "C:\Users\Admin\AppData\Local\Temp\1003374001\kxfh9qhs.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\1003620001\trru7rd2.exe
    "C:\Users\Admin\AppData\Local\Temp\1003620001\trru7rd2.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2888
- - C:\Users\Admin\AppData\Local\Temp\1003810001\69602f42a3.exe
    "C:\Users\Admin\AppData\Local\Temp\1003810001\69602f42a3.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2716
- - C:\Users\Admin\AppData\Local\Temp\1003811001\4f023d71a2.exe
    "C:\Users\Admin\AppData\Local\Temp\1003811001\4f023d71a2.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Barrymore Player 2.2.22\barrymoreplayer.exe

Filesize
3.4MB

MD5
3e5d4453e596ee331a42bac71f108b8f

SHA1
f3ec4798c91f50c2c83977c1f2d2bfef6b6fed61

SHA256
a7a5320910cefa245389b4d760f0f930444af5625482b1011c0daf08b3f9a6a8

SHA512
3642a43388c6688dad116dbb5e64b70366119d5cc15499475d59db29e405900ca0dd3a715b4fc852e1dd9332197006922a81d1a94545dfcebabf6b683e309a15

Download Submit
C:\Users\Admin\AppData\Local\Barrymore Player 2.2.22\sqlite3.dll

Filesize
630KB

MD5
e477a96c8f2b18d6b5c27bde49c990bf

SHA1
e980c9bf41330d1e5bd04556db4646a0210f7409

SHA256
16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

SHA512
335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000270101\Javvvum.exe

Filesize
7.3MB

MD5
aed024049f525c8ae6671ebdd7001c30

SHA1
fadd86e0ce140dc18f33193564d0355b02ee9b05

SHA256
9c45c5456167f65156faa1313ad8bbaffb8aa375669bf756fe0273580a621494

SHA512
ec0846be717d200639c529a4ac14f47f6b466fa2c8231049bc474183b285c7d8ce3200ff9f9c813171de8b7eb15c63f229b4748c751a167d7eff3489249738d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000281101\stail.exe

Filesize
3.7MB

MD5
0672a07cf6b9a0538583b65b72ef7e65

SHA1
0f0211d8d7f18f15a96d0f9e1d1b3417651c4fe7

SHA256
fca17c53d6b5ef9451c3af4d2eb13ac807f97cc4f517f707f9cd1acd6dbf4e4d

SHA512
a97161c3293f354a774e2e7e1c7b2cc29f441fd31b55c64b2503c7d57cf24727fe00f03b5a76e4a367e1245e7bc411ac6aa3ef005286190b1f3a8f50e565973f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
307KB

MD5
68a99cf42959dc6406af26e91d39f523

SHA1
f11db933a83400136dc992820f485e0b73f1b933

SHA256
c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

SHA512
7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

Download Submit
C:\Users\Admin\AppData\Local\Temp\1001527001\aqbjn3fl.exe

Filesize
572KB

MD5
34a152eb5d1d3e63dafef23579042933

SHA1
9e1c23718d5b30c13d0cec51ba3484ddc32a3184

SHA256
42365467efe5746a0b0076a3e609219a9cffe827d5a95f4e10221f081a3bf8fa

SHA512
270298ca39c3ff0ab4c576374a5c091135efad3c1cb9930888a74ef7d421f43039c2545eadecb037fcff2b8ee4e22cd4d809b19e7958b44ba1c72100135a46fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\1002824001\0a6c19768c.exe

Filesize
2.8MB

MD5
6a3268db51b26c41418351e516bc33a6

SHA1
57a12903fff8cd7ea5aa3a2d2308c910ac455428

SHA256
eaebfc5e60378bbc47a603ca1310440c290a396cb2446de36ff6e7afb624ee0c

SHA512
43f257dbb7e444355e29a8023e8c8838c9e0ca7538a86c25ac41db1e0308bf73c3adda1b0fe5d0bcf536387b9ce5f8fed216f5f7d92c80bcc12e7bffde979b33

Download Submit
C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe

Filesize
429KB

MD5
c07e06e76de584bcddd59073a4161dbb

SHA1
08954ac6f6cf51fd5d9d034060a9ae25a8448971

SHA256
cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9

SHA512
e92c9fcd0448591738daedb19e8225ff05da588b48d1f15479ec8af62acd3ea52b5d4ba3e3b0675c2aa1705185f5523dcafdf14137c6e2984588069a2e05309f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1003374001\kxfh9qhs.exe

Filesize
3.9MB

MD5
b3834900eea7e3c2bae3ab65bb78664a

SHA1
cf5665241bc0ea70d7856ea75b812619cb31fb94

SHA256
cc35b0641c3c85446892311031369a42990c019c7b143b875be5c683e83ff3ce

SHA512
ae36ab053e692434b9307a21dcebe6499b60a3d0bca8549d7264b4756565cb44e190aa9396aea087609adaeb1443f098da1787fd8ffe2458c4fa1c5faea15909

Download Submit
C:\Users\Admin\AppData\Local\Temp\1003620001\trru7rd2.exe

Filesize
6.3MB

MD5
7b5e89271f2f7e9a42d00cd1f1283d0f

SHA1
8e2a8d2f63713f0499d0df70e61db3ce0ff88b4f

SHA256
fd51fd3388f72dd5eef367bd8848a9e92ae1b218be128e9e75dffdf39ed9438a

SHA512
3779e92bd1d68644ceb2ef327c7d24667e13d8c927df3f77ec3b542278538b424ea2fa58a7c03554f7bec245e0ba7702853d8d520c528745dafd67653234ab22

Download Submit
C:\Users\Admin\AppData\Local\Temp\1003810001\69602f42a3.exe

Filesize
1.7MB

MD5
efbcceeff7fbbe424508e4de00ad3ccd

SHA1
33574ecf95f1ca351c97fa11c439b7679ae56ac6

SHA256
59d0f4b4643ad0497f1d181024953aff948698a7e749da8cce46f1e86642ee08

SHA512
154aad64a9cc25915986190df630b889fe41207d434831ff606f3212994bcac8235763d43c1be4d1bc98f1a712e27f6e06847a38b5c9ddc14780a587b9416e9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1003811001\4f023d71a2.exe

Filesize
1.8MB

MD5
77483df5aa89c592975f97c5b06e3b90

SHA1
9ac4ff41d154c7f190595ec3f79fcfa153b1e8b7

SHA256
c8d8f6e5c297198da47177430728765729a71599417658aee85fc058ecb1a962

SHA512
44a8c8e179078dbacd79ecd8a0bbb7d016d035bfe572a94d719dac3256c779a31c84b8bb75e9093ba1830cea23457bde39761887c4bee879cf053c7b9d2b196d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab678.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6BA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-USS2T.tmp\stail.tmp

Filesize
687KB

MD5
7aa727453918460fa9df58e0bb78a943

SHA1
83bf5fd5684f4dec50bb45e85ea768b5506a0495

SHA256
c0f24f425f1e7d7898b07845ca1a229b4b57151c11777088b8e3a4746bbbeb92

SHA512
403828e325f37d3ebf6cd55ad1da8f0f6c132d862601953624d7f42c3a0b8fdfb2e5666597c134452730d312ae3e7640e7a08bf62cc51cdde8eeb74f1e6a8a4a

Download Submit
\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
274d813d41ac6d28b467ce4709bb42bb

SHA1
08670195255d587368f622f42078f9ae32e16a79

SHA256
32b58def9bde863ab3e3b8965053c836be01b17f4cffa38bbedb1fedcb3acd3d

SHA512
23935bf7eee8c89b7ccef3680e207208d338e22c0c82b0bdca2dd0a4c59f8c5f57682ebcbfd4dfc5602b50c3bb0cfc38a1ab040ac0e2e5a9f429a5df32d08b0d

Download Submit
\Users\Admin\AppData\Local\Temp\is-BFG62.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-BFG62.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1004-224-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1004-332-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1480-351-0x0000000000CB0000-0x0000000001177000-memory.dmp

Filesize
4.8MB

Download
memory/1480-337-0x0000000000CB0000-0x0000000001177000-memory.dmp

Filesize
4.8MB

Download
memory/1480-346-0x0000000000CB0000-0x0000000001177000-memory.dmp

Filesize
4.8MB

Download
memory/1480-353-0x0000000000CB0000-0x0000000001177000-memory.dmp

Filesize
4.8MB

Download
memory/1684-161-0x00000000003A0000-0x000000000069B000-memory.dmp

Filesize
3.0MB

Download
memory/1684-108-0x00000000003A0000-0x000000000069B000-memory.dmp

Filesize
3.0MB

Download
memory/1684-242-0x00000000003A0000-0x000000000069B000-memory.dmp

Filesize
3.0MB

Download
memory/1684-79-0x00000000003A0000-0x000000000069B000-memory.dmp

Filesize
3.0MB

Download
memory/1752-134-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1752-154-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1752-274-0x0000000000400000-0x0000000000AD0000-memory.dmp

Filesize
6.8MB

Download
memory/1752-131-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1752-320-0x0000000000400000-0x0000000000AD0000-memory.dmp

Filesize
6.8MB

Download
memory/1752-124-0x0000000000400000-0x0000000000AD0000-memory.dmp

Filesize
6.8MB

Download
memory/1752-132-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1752-141-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1752-156-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1752-127-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1752-157-0x0000000000400000-0x0000000000AD0000-memory.dmp

Filesize
6.8MB

Download
memory/1752-151-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1752-149-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1752-146-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1752-144-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/1752-139-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1752-136-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1752-129-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1752-125-0x0000000000400000-0x0000000000AD0000-memory.dmp

Filesize
6.8MB

Download
memory/1912-177-0x0000000000FB0000-0x0000000001701000-memory.dmp

Filesize
7.3MB

Download
memory/2036-5-0x0000000001160000-0x000000000162D000-memory.dmp

Filesize
4.8MB

Download
memory/2036-16-0x0000000001160000-0x000000000162D000-memory.dmp

Filesize
4.8MB

Download
memory/2036-1-0x00000000777F0000-0x00000000777F2000-memory.dmp

Filesize
8KB

Download
memory/2036-2-0x0000000001161000-0x000000000118F000-memory.dmp

Filesize
184KB

Download
memory/2036-3-0x0000000001160000-0x000000000162D000-memory.dmp

Filesize
4.8MB

Download
memory/2036-0-0x0000000001160000-0x000000000162D000-memory.dmp

Filesize
4.8MB

Download
memory/2036-15-0x0000000001160000-0x000000000162D000-memory.dmp

Filesize
4.8MB

Download
memory/2592-359-0x0000000000020000-0x0000000000281000-memory.dmp

Filesize
2.4MB

Download
memory/2592-42-0x0000000000020000-0x0000000000281000-memory.dmp

Filesize
2.4MB

Download
memory/2716-355-0x0000000000A90000-0x0000000001129000-memory.dmp

Filesize
6.6MB

Download
memory/2716-365-0x0000000000A90000-0x0000000001129000-memory.dmp

Filesize
6.6MB

Download
memory/2716-343-0x0000000000A90000-0x0000000001129000-memory.dmp

Filesize
6.6MB

Download
memory/2716-344-0x0000000000A90000-0x0000000001129000-memory.dmp

Filesize
6.6MB

Download
memory/2716-317-0x0000000000A90000-0x0000000001129000-memory.dmp

Filesize
6.6MB

Download
memory/2732-339-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/2732-349-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/2732-340-0x0000000060900000-0x0000000060992000-memory.dmp

Filesize
584KB

Download
memory/2732-319-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/2732-275-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/2732-277-0x0000000000400000-0x0000000000771000-memory.dmp

Filesize
3.4MB

Download
memory/2832-318-0x00000000053E0000-0x0000000005751000-memory.dmp

Filesize
3.4MB

Download
memory/2832-334-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2832-269-0x00000000053E0000-0x0000000005751000-memory.dmp

Filesize
3.4MB

Download
memory/2888-298-0x0000000001150000-0x00000000017AB000-memory.dmp

Filesize
6.4MB

Download
memory/2992-60-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-123-0x0000000006930000-0x0000000007000000-memory.dmp

Filesize
6.8MB

Download
memory/2992-341-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-315-0x0000000006930000-0x0000000006FC9000-memory.dmp

Filesize
6.6MB

Download
memory/2992-342-0x0000000006930000-0x0000000006FC9000-memory.dmp

Filesize
6.6MB

Download
memory/2992-122-0x0000000006320000-0x000000000661B000-memory.dmp

Filesize
3.0MB

Download
memory/2992-107-0x0000000006320000-0x000000000661B000-memory.dmp

Filesize
3.0MB

Download
memory/2992-82-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-80-0x0000000006320000-0x000000000661B000-memory.dmp

Filesize
3.0MB

Download
memory/2992-336-0x0000000006930000-0x0000000006DF7000-memory.dmp

Filesize
4.8MB

Download
memory/2992-273-0x0000000006930000-0x0000000007000000-memory.dmp

Filesize
6.8MB

Download
memory/2992-59-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-61-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-281-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-160-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-316-0x0000000006930000-0x0000000006FC9000-memory.dmp

Filesize
6.6MB

Download
memory/2992-78-0x0000000006320000-0x000000000661B000-memory.dmp

Filesize
3.0MB

Download
memory/2992-41-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-40-0x0000000006310000-0x0000000006571000-memory.dmp

Filesize
2.4MB

Download
memory/2992-345-0x0000000006930000-0x0000000006DF7000-memory.dmp

Filesize
4.8MB

Download
memory/2992-38-0x0000000006310000-0x0000000006571000-memory.dmp

Filesize
2.4MB

Download
memory/2992-22-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-20-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-354-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-18-0x0000000000A41000-0x0000000000A6F000-memory.dmp

Filesize
184KB

Download
memory/2992-19-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-17-0x0000000000A40000-0x0000000000F0D000-memory.dmp

Filesize
4.8MB

Download
memory/2992-372-0x0000000006310000-0x0000000006571000-memory.dmp

Filesize
2.4MB

Download
memory/2992-377-0x0000000006310000-0x0000000006571000-memory.dmp

Filesize
2.4MB

Download