Overview

overview

10

Static

static

3

27078da224...d3.exe

windows7-x64

10

27078da224...d3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2024 02:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    27078da22468bc047da60bdfaf05b18f5d135d27ff58c655e7e9e474ce02e8d3.exe

  • Size

    1.8MB

  • MD5

    82d65703f59b88d8f091de327bbabce4

  • SHA1

    07580dac62ef9478a94f1a316616f15c9d0a9f13

  • SHA256

    27078da22468bc047da60bdfaf05b18f5d135d27ff58c655e7e9e474ce02e8d3

  • SHA512

    3471a3a1acb124cce0219d9330b46549a560f0b99dc8e3ca216b449ee4a0e93d3e1f0963e725a143faca932cfc0ba804e7724b836e3c185d6fda39c03d19671f

  • SSDEEP

    49152:5BXUShjURElo/e6Lk5PfzHLR4nTsD2g02q2fMypj8xok0gPC/4KPRr6:fX9h/PPfx4nTsigA2f5pj8WXNAKI

Score
10/10
amadeycryptbotstealc9c9aa5marscredential_accessdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

mars

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 60 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\27078da22468bc047da60bdfaf05b18f5d135d27ff58c655e7e9e474ce02e8d3.exe
    "C:\Users\Admin\AppData\Local\Temp\27078da22468bc047da60bdfaf05b18f5d135d27ff58c655e7e9e474ce02e8d3.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3968
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1092
      • C:\Users\Admin\AppData\Local\Temp\1008317001\54eab7982d.exe
        "C:\Users\Admin\AppData\Local\Temp\1008317001\54eab7982d.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1196
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
          4⤵
          • Uses browser remote debugging
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2160
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff98236cc40,0x7ff98236cc4c,0x7ff98236cc58
            5⤵
              PID:5088
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,9987961449769291887,3093886307244699059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:2
              5⤵
                PID:4252
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2140,i,9987961449769291887,3093886307244699059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:3
                5⤵
                  PID:464
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,9987961449769291887,3093886307244699059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2328 /prefetch:8
                  5⤵
                    PID:3992
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,9987961449769291887,3093886307244699059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3196 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:4520
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3168,i,9987961449769291887,3093886307244699059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3224 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:2888
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4468,i,9987961449769291887,3093886307244699059,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4544 /prefetch:1
                    5⤵
                    • Uses browser remote debugging
                    PID:5016
                • C:\Users\Admin\AppData\Local\Temp\service123.exe
                  "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                  4⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:5484
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:5572
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1196 -s 1764
                  4⤵
                  • Program crash
                  PID:5780
              • C:\Users\Admin\AppData\Local\Temp\1008322001\91059f68c9.exe
                "C:\Users\Admin\AppData\Local\Temp\1008322001\91059f68c9.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2700
              • C:\Users\Admin\AppData\Local\Temp\1008323001\e1a316176e.exe
                "C:\Users\Admin\AppData\Local\Temp\1008323001\e1a316176e.exe"
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1848
              • C:\Users\Admin\AppData\Local\Temp\1008324001\e662d75abc.exe
                "C:\Users\Admin\AppData\Local\Temp\1008324001\e662d75abc.exe"
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:1380
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM firefox.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3732
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM chrome.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:616
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM msedge.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3648
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM opera.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2908
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /F /IM brave.exe /T
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3112
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                  4⤵
                    PID:4816
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                      5⤵
                      • Checks processor information in registry
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:1184
                      • C:\Program Files\Mozilla Firefox\firefox.exe
                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1984 -parentBuildID 20240401114208 -prefsHandle 1904 -prefMapHandle 1896 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8ce5f57-9441-446a-85cc-a9eea31d35b0} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" gpu
                        6⤵
                          PID:448
                        • C:\Program Files\Mozilla Firefox\firefox.exe
                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2468 -parentBuildID 20240401114208 -prefsHandle 2444 -prefMapHandle 2432 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f3f365f0-9f85-4728-baaa-d77d911f28dd} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" socket
                          6⤵
                            PID:2372
                          • C:\Program Files\Mozilla Firefox\firefox.exe
                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3016 -childID 1 -isForBrowser -prefsHandle 3020 -prefMapHandle 3056 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd96ad3b-4114-417f-873b-e0f4f3819fab} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" tab
                            6⤵
                              PID:1096
                            • C:\Program Files\Mozilla Firefox\firefox.exe
                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4156 -childID 2 -isForBrowser -prefsHandle 4140 -prefMapHandle 4132 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d6eda816-1b1b-45c2-828f-5fa8563df166} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" tab
                              6⤵
                                PID:4224
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4892 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4648 -prefMapHandle 4492 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {09519155-6e62-41f7-81da-f27eb0028fab} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" utility
                                6⤵
                                • Checks processor information in registry
                                PID:5436
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5384 -childID 3 -isForBrowser -prefsHandle 5376 -prefMapHandle 5196 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8731083-f05b-4897-b3eb-f46105b61a42} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" tab
                                6⤵
                                  PID:2292
                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5508 -childID 4 -isForBrowser -prefsHandle 5516 -prefMapHandle 5524 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54b62acb-2de6-4b1f-abbc-8d48e378336e} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" tab
                                  6⤵
                                    PID:3896
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5716 -childID 5 -isForBrowser -prefsHandle 5796 -prefMapHandle 5792 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c402df02-5afb-4904-b137-454c54c0c309} 1184 "\\.\pipe\gecko-crash-server-pipe.1184" tab
                                    6⤵
                                      PID:3536
                              • C:\Users\Admin\AppData\Local\Temp\1008325001\4dd586417e.exe
                                "C:\Users\Admin\AppData\Local\Temp\1008325001\4dd586417e.exe"
                                3⤵
                                • Modifies Windows Defender Real-time Protection settings
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Windows security modification
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • System Location Discovery: System Language Discovery
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1052
                          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                            1⤵
                            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                            • Checks BIOS information in registry
                            • Executes dropped EXE
                            • Identifies Wine through registry keys
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3924
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                            1⤵
                              PID:896
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1196 -ip 1196
                              1⤵
                                PID:5652
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5992
                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:3312
                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                1⤵
                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                • Checks BIOS information in registry
                                • Executes dropped EXE
                                • Identifies Wine through registry keys
                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                • Suspicious behavior: EnumeratesProcesses
                                PID:5920
                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                1⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                PID:4588

                              Network

                              MITRE ATT&CK Enterprise v15

                              Reconnaissance

                              Resource Development

                              Initial Access

                              Execution

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Persistence

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Modify Authentication Process

                              1
                              T1556

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Privilege Escalation

                              Boot or Logon Autostart Execution

                              1
                              T1547

                              Registry Run Keys / Startup Folder

                              1
                              T1547.001

                              Create or Modify System Process

                              1
                              T1543

                              Windows Service

                              1
                              T1543.003

                              Scheduled Task/Job

                              1
                              T1053

                              Scheduled Task

                              1
                              T1053.005

                              Defense Evasion

                              Impair Defenses

                              2
                              T1562

                              Disable or Modify Tools

                              2
                              T1562.001

                              Modify Authentication Process

                              1
                              T1556

                              Modify Registry

                              3
                              T1112

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Credential Access

                              Credentials from Password Stores

                              1
                              T1555

                              Credentials from Web Browsers

                              1
                              T1555.003

                              Modify Authentication Process

                              1
                              T1556

                              Steal Web Session Cookie

                              1
                              T1539

                              Unsecured Credentials

                              1
                              T1552

                              Credentials In Files

                              1
                              T1552.001

                              Discovery

                              Browser Information Discovery

                              1
                              T1217

                              Query Registry

                              8
                              T1012

                              System Information Discovery

                              5
                              T1082

                              System Location Discovery

                              1
                              T1614

                              System Language Discovery

                              1
                              T1614.001

                              Virtualization/Sandbox Evasion

                              2
                              T1497

                              Lateral Movement

                              Collection

                              Data from Local System

                              1
                              T1005

                              Command and Control

                              Exfiltration

                              Impact

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                Filesize

                                2B

                                MD5

                                d751713988987e9331980363e24189ce

                                SHA1

                                97d170e1550eee4afc0af065b78cda302a97674c

                                SHA256

                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                SHA512

                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\activity-stream.discovery_stream.json
                                Filesize

                                28KB

                                MD5

                                5186513cc12cf61ff8be0b13716a36d8

                                SHA1

                                73bf1f04a4f0d2e60312beb2ddcc68e45b76b0f9

                                SHA256

                                0818a4869ba6fd3863231a668cbca2b7dc4378d05799c040f22da6869fcab3b8

                                SHA512

                                87fa88306e812a46905fe772f9accbd43720221254f1d206e766fd8d758d6ac965d7d0feba448d15ecc78e91011583c19fbcf558a7bf88fbeb7a44aaff0e80a8

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\85mw8mk9.default-release\cache2\entries\39DB9E847E680B765D7B04FCCE6BF5BC0225F878
                                Filesize

                                13KB

                                MD5

                                e317d48d45eddd8b8e9983f4e8069d9d

                                SHA1

                                001303ce2448863cbf2ecca1c7d97940973e952e

                                SHA256

                                1875f5cefee000dc051f08747ace2e3c00ab4ea5ce8ee0e1b3f7b32d93439a78

                                SHA512

                                def37e0fc475543d41193313a885e4049b2fd061e528e5a46283bdee7e3a7049f1ad4dc4da93e25d9db4d6b2613e432c3f38ec467f2cd58f33792e6ed7daf7a7

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008317001\54eab7982d.exe
                                Filesize

                                4.2MB

                                MD5

                                0b6b622de253d8ebab387a924f7735d2

                                SHA1

                                2922b01435ec24a0090eb9266051ec714cdbd431

                                SHA256

                                e5f29348bc07584a7e370c5adafa376137382bfbfd5b5ee042e5ca27d013adf0

                                SHA512

                                bb1e138a025aae83698af5513783ab67109978cb1619ab13a1bf177f9c0403c2e315d74c16a5f8a9fa8326e46824f728f0ef2fe1eac43e093719db14c96f3738

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008322001\91059f68c9.exe
                                Filesize

                                1.8MB

                                MD5

                                b70b1671baa5d6caaace25d7ddcd78fe

                                SHA1

                                2fed77301f8006ff0ee3470e2f6f0ddb6bc0f9af

                                SHA256

                                a713de5a8e8414518a7927adae9edced07692a6428fef2fffd7f379de58cb83b

                                SHA512

                                789051f3bbb5f5b2cb27340600d80939aba6162bef43be37490de2b517e825a2684a66fa9c0d800dea9d6a30f96d969c7b98a777a9bddafc0ee9c6cf10c6579a

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008323001\e1a316176e.exe
                                Filesize

                                1.7MB

                                MD5

                                c39eb549a7dc6f9f6eeababcaea602dc

                                SHA1

                                33c34ab34eb843e347694db102e68ae0b59d9c29

                                SHA256

                                ebd45bb1a1f3c24ca2c7c4d9c30efe71eea9b8246a750bd5722043703013af99

                                SHA512

                                8702781d879c22ef45362e0e539015670c3365724b519881ee6a7e10b241540080c196ddd52003b8395c338dbf8448485703b076e43c17e8466e41f41dc40ee4

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008324001\e662d75abc.exe
                                Filesize

                                900KB

                                MD5

                                013c3fb391228f0ae96123aafd47f414

                                SHA1

                                2e7c08f94b126b86e10315dab1106bc8f5adb543

                                SHA256

                                fe3127cbef22a34c43d015948d1297044b01c8b8ed5a78169659ec5c83df92ae

                                SHA512

                                94f8f33c6f37c0a2c2caabff912eed69854a0bae633075b5c3a598d9f8586983d9a14914c01a3586535f414311b262b7dad297b0a56e7ae80d74e0a559902c76

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\1008325001\4dd586417e.exe
                                Filesize

                                2.6MB

                                MD5

                                3a635fef14102b754410ece391685b93

                                SHA1

                                b427cb065492e71710d14e5c3fe04b5806bef5f6

                                SHA256

                                467ae373cafb2e87b04974ff1ee6480931784e057bcd1e1a125b6a57e3e0ab2a

                                SHA512

                                2ddcdfdad502065bb765de70021884429e7f6d1fb83f5981a7b714d4a0bd6b0bca345f9d555da6efc134df23b8f47b6eaec67e3a8542d7fc11b812ed94a84822

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                                Filesize

                                1.8MB

                                MD5

                                82d65703f59b88d8f091de327bbabce4

                                SHA1

                                07580dac62ef9478a94f1a316616f15c9d0a9f13

                                SHA256

                                27078da22468bc047da60bdfaf05b18f5d135d27ff58c655e7e9e474ce02e8d3

                                SHA512

                                3471a3a1acb124cce0219d9330b46549a560f0b99dc8e3ca216b449ee4a0e93d3e1f0963e725a143faca932cfc0ba804e7724b836e3c185d6fda39c03d19671f

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                Filesize

                                479KB

                                MD5

                                09372174e83dbbf696ee732fd2e875bb

                                SHA1

                                ba360186ba650a769f9303f48b7200fb5eaccee1

                                SHA256

                                c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

                                SHA512

                                b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                Filesize

                                13.8MB

                                MD5

                                0a8747a2ac9ac08ae9508f36c6d75692

                                SHA1

                                b287a96fd6cc12433adb42193dfe06111c38eaf0

                                SHA256

                                32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

                                SHA512

                                59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
                                Filesize

                                6KB

                                MD5

                                84a81bb55ca1374de2028f5b2eee155f

                                SHA1

                                a5a3251335bd132a6d10a0271c03544105e06d79

                                SHA256

                                78b5d9b0f2c54a63886c9b45bc5301f62b7e2076441fca56f9e53dc2ca3c8191

                                SHA512

                                cadfae44f7709c8f672007c0065120bfe720431fcd776cab35d99d8beef818897a0a87fec95404a2f2ec4c320bd697a512188a9dfd4ac9a6bcff845db6440990

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\AlternateServices.bin
                                Filesize

                                10KB

                                MD5

                                557219cd28ec481870ae5e118476a7f8

                                SHA1

                                f4b565aa00065af955f2776e037301ff0e9ccad2

                                SHA256

                                6940cb91385fe188372ddb37970a358522f1633364d850f44260cb210e2b4814

                                SHA512

                                7ed63bfbc49514ce56ee359138c45e998c3aad9937985a479052218e3267ecd0e9de9c88166487899c805064f4dd1e3ebe7ee1b9e383b6f1e76f573d2555641e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                22KB

                                MD5

                                8eedcd665ccd552ac49e14c93f0e87da

                                SHA1

                                cfef395ad33cecce506f13fa1309701a198eda0e

                                SHA256

                                7256e3d83d1393b7739506332fb542c3888c36816013def013f0954f3eea7922

                                SHA512

                                95879759127bb90f7fbd2f0d2a455697a0000eb70890c81199c498dd2e8c350f7e2731644b48b8b56480a1d7d79adf71c32de468443fb07ea5316ad50a524da3

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                25KB

                                MD5

                                c9055dac99d2ee9a38de41d0d820b7c3

                                SHA1

                                62acdd925b88c5dba3672d2ddd917cf2b23676bf

                                SHA256

                                eb0f254c5a2f1b571cdd01d174857500b24a421aa24d9afecda7d75036466587

                                SHA512

                                db116ed78958a73e2d7f9c1297999bce10d2167268ddb123b6ce4bb078398ba0bb408eb754df8d7d715687366f915ddfe92335b1c6329ef687858e20bfa5f6e7

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                26KB

                                MD5

                                5b8abddaedc779a7d0fbeb5bc96f9af6

                                SHA1

                                3fbc465b51ab384b43b4e347cefea5c9ce8b5d09

                                SHA256

                                0329212559c1237c922d7630eb699e47c4c34aead25551ddfe2449c7a2792a20

                                SHA512

                                d15effe2c87fe4d7414a34bfe5aa514be79ec2f9ddfb0b97a7cc26add71d5034e1f873fa70bbcdf69aeb1c4cc06102739e402867d420850ee4d1f8ff28a71c4b

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                23KB

                                MD5

                                57c606544f2d459e6a56499f805b41e1

                                SHA1

                                fefc381b0619aff5b9beecb6ad0f9cca58c621ec

                                SHA256

                                36519393e07a673bcf3fddfc9a8c3b0c69a124aa07ce37945ffe27aec43ed617

                                SHA512

                                6aeb4fa0596bdca5d14138fcc75346b563bb73ca3a2adb54823daed49cfcd2706fce1cc5d026b241c354ee36ee6e1d204d0a56061b635addf6b2f3251305472d

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\db\data.safe.tmp
                                Filesize

                                22KB

                                MD5

                                ee87c9a6aa40d251deae33942648c632

                                SHA1

                                7e76198a1bcf9ebde82644f6204bafac7712c6a6

                                SHA256

                                f42b5e4939f10883ce098bfdff97228b13983756fbb4b5e5e86b7defadaf4d62

                                SHA512

                                f204c388827dc826d35f07ff19a3e4890d6cfc8ee24a52636b3172c2b3df60f411f6871fdb2c8cefc33da04a76ef3ca1164fa6ad0d0e7d3a096eeff44ca05032

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\6b7376e1-3a7b-4ca4-9632-3afe221d3bc0
                                Filesize

                                982B

                                MD5

                                8cbce452f6ec17adc151c35d00983e16

                                SHA1

                                3941104e109e55882623c9573d21a2f1b711a0c8

                                SHA256

                                b62a211885c1174b65396116185d8fa3baecb326e104f6afa155c7d355724510

                                SHA512

                                88882aff405773492f3f6e7307a8f496a7287d93a931c45e24a3cdf31e851756fc6ccb00610ce6b3af97d7e15fdbd59c48e8e44f9534a3544e57827dab3007ba

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\datareporting\glean\pending_pings\aa56e411-e164-4e2d-ae31-4fca8a53f59a
                                Filesize

                                659B

                                MD5

                                24f55fcad73613f238fdc59ab58646f1

                                SHA1

                                f9bbb84153ee0fefee8c014e61dc706c12207db7

                                SHA256

                                dad129ac4ed98967984d25846eabb6c285969a2a75d81c0a3f1f0b9e135b0c05

                                SHA512

                                708be53d948f1fae024afbac071e47f6988cee113f353ccbeff6a37ec32382f6dc69ce5d24fa1fe3496184f2c77458ec5549ad09a7023725fd19bfab91f33993

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll
                                Filesize

                                1.1MB

                                MD5

                                842039753bf41fa5e11b3a1383061a87

                                SHA1

                                3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

                                SHA256

                                d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

                                SHA512

                                d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info
                                Filesize

                                116B

                                MD5

                                2a461e9eb87fd1955cea740a3444ee7a

                                SHA1

                                b10755914c713f5a4677494dbe8a686ed458c3c5

                                SHA256

                                4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

                                SHA512

                                34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json
                                Filesize

                                372B

                                MD5

                                bf957ad58b55f64219ab3f793e374316

                                SHA1

                                a11adc9d7f2c28e04d9b35e23b7616d0527118a1

                                SHA256

                                bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

                                SHA512

                                79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll
                                Filesize

                                17.8MB

                                MD5

                                daf7ef3acccab478aaa7d6dc1c60f865

                                SHA1

                                f8246162b97ce4a945feced27b6ea114366ff2ad

                                SHA256

                                bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

                                SHA512

                                5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
                                Filesize

                                10KB

                                MD5

                                b865663e6217a5b8400870ec55e339d9

                                SHA1

                                cf75a32917c4c6a6c910f276ba4e6d40482c9602

                                SHA256

                                1903a1a847c0a951eeed07d55b48edc9f9366a4121c5dfd37cc31efe9b0ce587

                                SHA512

                                689c957128945c0c0936538795cd96912204fd22473416e595ac32aa2ad04246b38ab72675eb00cbc48a9da0c8a689f8df664d3c9bd59e42bd41fe8157c82aed

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs-1.js
                                Filesize

                                15KB

                                MD5

                                ff9c09648e8538fefe2a9ddc53b142ff

                                SHA1

                                5bafbc338e02b7d9934083b7e1538ebc010e5eba

                                SHA256

                                f3cf071ebc2027e89c4b9dcb50a4470c8e2cf9f5970a742a296be65d653fb9a0

                                SHA512

                                710c06dae0dc998c27b90c67b11d5aa03cc3baa325fad05449202f055efec46f7fffa6ab1b37d5dcd47e2b306493eb7569560eee13e3e1a3681af302c3cde5dd

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
                                Filesize

                                10KB

                                MD5

                                8cdc6702c4362d15487adcb1778e8507

                                SHA1

                                4cf702d981d0993b0fc5bf7bbe60a6980dca4de6

                                SHA256

                                46b02e83570b2a799a8364f99465c19c7bdaa262da2abadd2c625dfcaea464d7

                                SHA512

                                8dc8b3a04538a1b25fc8b0aa1c1f1b00ad1c83f7adca9d570ac91306301e5f30e7e33f2342d84fa3a0a592e6dc6a1e19d335bbb5d187d7f85c47fdb5736c739b

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\85mw8mk9.default-release\prefs.js
                                Filesize

                                11KB

                                MD5

                                cf1c31cef3b270383dbb4aa049e000a1

                                SHA1

                                1b3dc98208cf5934a7642706c8a798234b7c970b

                                SHA256

                                e1e26391a636358ef8e75869e6f5d65fb7e9208ce0807a022a992b65cec38a86

                                SHA512

                                4c1c71dba34ff3ae70d14681eff7d47f4a79fbf71c0201738d1334793040f8f4618a860ddebc305be8c61d832fdf4a958f80ed03554e699d79bb6ca05b674f5f

                                Download Submit

                              • \??\pipe\crashpad_2160_GUIUYAVLUDMLPLJO
                                MD5

                                d41d8cd98f00b204e9800998ecf8427e

                                SHA1

                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                SHA256

                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                SHA512

                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                Download Submit

                              • memory/1052-136-0x00000000002A0000-0x0000000000544000-memory.dmp

                                Filesize

                                2.6MB

                                Download

                              • memory/1052-542-0x00000000002A0000-0x0000000000544000-memory.dmp

                                Filesize

                                2.6MB

                                Download

                              • memory/1052-539-0x00000000002A0000-0x0000000000544000-memory.dmp

                                Filesize

                                2.6MB

                                Download

                              • memory/1052-137-0x00000000002A0000-0x0000000000544000-memory.dmp

                                Filesize

                                2.6MB

                                Download

                              • memory/1052-131-0x00000000002A0000-0x0000000000544000-memory.dmp

                                Filesize

                                2.6MB

                                Download

                              • memory/1092-2502-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-16-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-2941-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-2938-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-2933-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-2925-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-21-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-1926-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-1136-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-40-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-41-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-2944-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-688-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-31-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-524-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-2952-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-101-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-20-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-551-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1092-19-0x0000000000DA1000-0x0000000000DCF000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/1092-22-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/1196-42-0x0000000000F31000-0x00000000011A9000-memory.dmp

                                Filesize

                                2.5MB

                                Download

                              • memory/1196-59-0x0000000069CC0000-0x000000006A71B000-memory.dmp

                                Filesize

                                10.4MB

                                Download

                              • memory/1196-550-0x0000000000F30000-0x0000000001B79000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/1196-100-0x0000000000F30000-0x0000000001B79000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/1196-87-0x0000000000F30000-0x0000000001B79000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/1196-495-0x0000000000F30000-0x0000000001B79000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/1196-39-0x0000000000F30000-0x0000000001B79000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/1196-566-0x0000000000F30000-0x0000000001B79000-memory.dmp

                                Filesize

                                12.3MB

                                Download

                              • memory/1848-83-0x00000000003E0000-0x0000000000A84000-memory.dmp

                                Filesize

                                6.6MB

                                Download

                              • memory/1848-91-0x00000000003E0000-0x0000000000A84000-memory.dmp

                                Filesize

                                6.6MB

                                Download

                              • memory/2700-85-0x0000000000AA0000-0x0000000000F40000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/2700-58-0x0000000000AA0000-0x0000000000F40000-memory.dmp

                                Filesize

                                4.6MB

                                Download

                              • memory/3312-2353-0x0000000000CA0000-0x0000000000CB2000-memory.dmp

                                Filesize

                                72KB

                                Download

                              • memory/3924-88-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/3924-90-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/3968-0-0x0000000000C10000-0x00000000010C2000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/3968-2-0x0000000000C11000-0x0000000000C3F000-memory.dmp

                                Filesize

                                184KB

                                Download

                              • memory/3968-3-0x0000000000C10000-0x00000000010C2000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/3968-4-0x0000000000C10000-0x00000000010C2000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/3968-1-0x0000000077D24000-0x0000000077D26000-memory.dmp

                                Filesize

                                8KB

                                Download

                              • memory/3968-18-0x0000000000C10000-0x00000000010C2000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/4588-2950-0x0000000000CA0000-0x0000000000CB2000-memory.dmp

                                Filesize

                                72KB

                                Download

                              • memory/5484-865-0x0000000073680000-0x00000000737B4000-memory.dmp

                                Filesize

                                1.2MB

                                Download

                              • memory/5484-864-0x0000000000CA0000-0x0000000000CB2000-memory.dmp

                                Filesize

                                72KB

                                Download

                              • memory/5920-2951-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/5992-2300-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download

                              • memory/5992-2274-0x0000000000DA0000-0x0000000001252000-memory.dmp

                                Filesize

                                4.7MB

                                Download