Overview

overview

10

Static

static

10

94620a7635...c7.exe

windows7-x64

10

94620a7635...c7.exe

windows10-2004-x64

10

Discordrat.exe

windows7-x64

10

Discordrat.exe

windows10-2004-x64

10

F4620C0AFA...F5.exe

windows7-x64

10

F4620C0AFA...F5.exe

windows10-2004-x64

10

a2bc9b467f...23.exe

windows7-x64

10

a2bc9b467f...23.exe

windows10-2004-x64

10

unturnedHack.exe

windows7-x64

10

unturnedHack.exe

windows10-2004-x64

10

Resubmissions

24/11/2024, 19:42

241124-yexs5s1rgq10

24/11/2024, 09:24

241124-lc6xtatmay10

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2024, 09:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7.exe
  • Size 1.8MB
  • Sample241124-lc6xtatmay
  • SHA256 94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
amadeycryptbotstealc4bee079c9aa5marscredential_accessdiscoveryevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

  • amadey

Version

  • 5.04

Botnet

  • 4bee07

C2

  • http://185.215.113.209

Attributes
  • install_dir

    fc9e0aaab7

  • install_file

    defnur.exe

  • strings_key

    191655f008adc880f91bfc85bc56db54

  • url_paths

    /Fru7Nk9/index.php

rc4.plain

Extracted

Family

  • amadey

Version

  • 4.42

Botnet

  • 9c9aa5

C2

  • http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

  • stealc

Botnet

  • mars

C2

  • http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Uses browser remote debugging 2 TTPs 4 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks BIOS information in registry 2 TTPs 22 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 18 IoCs
  • Identifies Wine through registry keys 2 TTPs 11 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 54 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 8 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 8 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7.exe
    "C:\Users\Admin\AppData\Local\Temp\94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
      "C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2808
      • C:\Users\Admin\AppData\Local\Temp\10006070101\game.exe
        "C:\Users\Admin\AppData\Local\Temp\10006070101\game.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:536
        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\O1M08.exe
          C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\O1M08.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1088
          • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\M9m81.exe
            C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\M9m81.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1072
            • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1U37p9.exe
              C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1U37p9.exe
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:600
              • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
                "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
                7⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Loads dropped DLL
                • Adds Run key to start application
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                PID:2220
                • C:\Users\Admin\AppData\Local\Temp\1008713001\2b7a1bac6d.exe
                  "C:\Users\Admin\AppData\Local\Temp\1008713001\2b7a1bac6d.exe"
                  8⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Loads dropped DLL
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  PID:1112
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
                    9⤵
                    • Uses browser remote debugging
                    • Enumerates system info in registry
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    PID:3664
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x12c,0x130,0x134,0x100,0x138,0x7fef4889758,0x7fef4889768,0x7fef4889778
                      10⤵
                        PID:3676
                      • C:\Windows\system32\ctfmon.exe
                        ctfmon.exe
                        10⤵
                          PID:3792
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1132 --field-trial-handle=1356,i,321758657278824825,9672885344859760425,131072 /prefetch:2
                          10⤵
                            PID:3844
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1428 --field-trial-handle=1356,i,321758657278824825,9672885344859760425,131072 /prefetch:8
                            10⤵
                              PID:3864
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1356,i,321758657278824825,9672885344859760425,131072 /prefetch:8
                              10⤵
                                PID:3884
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2172 --field-trial-handle=1356,i,321758657278824825,9672885344859760425,131072 /prefetch:1
                                10⤵
                                • Uses browser remote debugging
                                PID:3992
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2180 --field-trial-handle=1356,i,321758657278824825,9672885344859760425,131072 /prefetch:1
                                10⤵
                                • Uses browser remote debugging
                                PID:4088
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1364 --field-trial-handle=1356,i,321758657278824825,9672885344859760425,131072 /prefetch:2
                                10⤵
                                  PID:3420
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1412 --field-trial-handle=1356,i,321758657278824825,9672885344859760425,131072 /prefetch:1
                                  10⤵
                                  • Uses browser remote debugging
                                  PID:3168
                              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                                9⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • System Location Discovery: System Language Discovery
                                PID:4028
                              • C:\Windows\SysWOW64\schtasks.exe
                                "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                                9⤵
                                • System Location Discovery: System Language Discovery
                                • Scheduled Task/Job: Scheduled Task
                                PID:4024
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 808
                                9⤵
                                • Loads dropped DLL
                                • Program crash
                                PID:4044
                            • C:\Users\Admin\AppData\Local\Temp\1008718001\1743c7f598.exe
                              "C:\Users\Admin\AppData\Local\Temp\1008718001\1743c7f598.exe"
                              8⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Loads dropped DLL
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Modifies system certificate store
                              • Suspicious behavior: EnumeratesProcesses
                              PID:992
                            • C:\Users\Admin\AppData\Local\Temp\1008719001\6ab6ff1532.exe
                              "C:\Users\Admin\AppData\Local\Temp\1008719001\6ab6ff1532.exe"
                              8⤵
                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                              • Checks BIOS information in registry
                              • Executes dropped EXE
                              • Identifies Wine through registry keys
                              • Loads dropped DLL
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1676
                            • C:\Users\Admin\AppData\Local\Temp\1008720001\0a29b13a33.exe
                              "C:\Users\Admin\AppData\Local\Temp\1008720001\0a29b13a33.exe"
                              8⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              PID:2352
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /F /IM firefox.exe /T
                                9⤵
                                • System Location Discovery: System Language Discovery
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2236
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /F /IM chrome.exe /T
                                9⤵
                                • System Location Discovery: System Language Discovery
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2832
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /F /IM msedge.exe /T
                                9⤵
                                • System Location Discovery: System Language Discovery
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2160
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /F /IM opera.exe /T
                                9⤵
                                • System Location Discovery: System Language Discovery
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:600
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /F /IM brave.exe /T
                                9⤵
                                • System Location Discovery: System Language Discovery
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2764
                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
                                9⤵
                                  PID:2296
                                  • C:\Program Files\Mozilla Firefox\firefox.exe
                                    "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
                                    10⤵
                                    • Checks processor information in registry
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:556
                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="556.0.892599705\997048598" -parentBuildID 20221007134813 -prefsHandle 1280 -prefMapHandle 1272 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24a1eef4-24f1-4680-8949-b27d08fca010} 556 "\\.\pipe\gecko-crash-server-pipe.556" 1344 10af4658 gpu
                                      11⤵
                                        PID:2684
                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="556.1.1838381858\1628324507" -parentBuildID 20221007134813 -prefsHandle 1536 -prefMapHandle 1532 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b09cc4a-b58f-496e-bbf3-6a8a1570b610} 556 "\\.\pipe\gecko-crash-server-pipe.556" 1548 2672a58 socket
                                        11⤵
                                          PID:1660
                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="556.2.460024540\1255237840" -childID 1 -isForBrowser -prefsHandle 2112 -prefMapHandle 2108 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eecf2691-52c7-4fa5-b0c3-2da6544eb022} 556 "\\.\pipe\gecko-crash-server-pipe.556" 2124 1a5bf358 tab
                                          11⤵
                                            PID:664
                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="556.3.1585754963\1043108034" -childID 2 -isForBrowser -prefsHandle 2940 -prefMapHandle 2936 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {56cfd359-9235-4936-be2e-5e8d09929213} 556 "\\.\pipe\gecko-crash-server-pipe.556" 2952 2664258 tab
                                            11⤵
                                              PID:2604
                                            • C:\Program Files\Mozilla Firefox\firefox.exe
                                              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="556.4.2052109017\1675123443" -childID 3 -isForBrowser -prefsHandle 3692 -prefMapHandle 3688 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {69e1bed5-f2a5-49a2-957e-d0e6154b54dc} 556 "\\.\pipe\gecko-crash-server-pipe.556" 3704 1e0f7058 tab
                                              11⤵
                                                PID:484
                                              • C:\Program Files\Mozilla Firefox\firefox.exe
                                                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="556.5.1236549542\970273505" -childID 4 -isForBrowser -prefsHandle 3912 -prefMapHandle 3916 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e31ac54b-fb66-4540-9e9f-c3328f3a587b} 556 "\\.\pipe\gecko-crash-server-pipe.556" 3900 20779358 tab
                                                11⤵
                                                  PID:356
                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="556.6.956341493\217338706" -childID 5 -isForBrowser -prefsHandle 4036 -prefMapHandle 3868 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 880 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e06134df-a853-4e44-add3-43e05eb74a68} 556 "\\.\pipe\gecko-crash-server-pipe.556" 4024 20779658 tab
                                                  11⤵
                                                    PID:2120
                                            • C:\Users\Admin\AppData\Local\Temp\1008721001\f23d4648cb.exe
                                              "C:\Users\Admin\AppData\Local\Temp\1008721001\f23d4648cb.exe"
                                              8⤵
                                              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                              • Checks BIOS information in registry
                                              • Executes dropped EXE
                                              • Identifies Wine through registry keys
                                              • Loads dropped DLL
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:3176
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3176 -s 796
                                                9⤵
                                                • Loads dropped DLL
                                                • Program crash
                                                PID:3540
                                        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2y9598.exe
                                          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2y9598.exe
                                          6⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Checks BIOS information in registry
                                          • Executes dropped EXE
                                          • Identifies Wine through registry keys
                                          • Loads dropped DLL
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2744
                                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3y27e.exe
                                        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3y27e.exe
                                        5⤵
                                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                        • Checks BIOS information in registry
                                        • Executes dropped EXE
                                        • Identifies Wine through registry keys
                                        • Loads dropped DLL
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3036
                                    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4y227q.exe
                                      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4y227q.exe
                                      4⤵
                                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                      • Checks BIOS information in registry
                                      • Executes dropped EXE
                                      • Identifies Wine through registry keys
                                      • Loads dropped DLL
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2092
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 796
                                        5⤵
                                        • Loads dropped DLL
                                        • Program crash
                                        PID:1756
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                                    3⤵
                                    • Blocklisted process makes network request
                                    • Loads dropped DLL
                                    • System Location Discovery: System Language Discovery
                                    PID:448
                                  • C:\Users\Admin\AppData\Local\Temp\10006170101\7efb1b6c24.exe
                                    "C:\Users\Admin\AppData\Local\Temp\10006170101\7efb1b6c24.exe"
                                    3⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    PID:2508
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c start cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\kreon.exe"
                                      4⤵
                                      • System Network Configuration Discovery: Internet Connection Discovery
                                      PID:3016
                                      • C:\Windows\system32\cmd.exe
                                        cmd /C "ping localhost -n 1 && start C:\Users\Admin\AppData\Local\kreon.exe"
                                        5⤵
                                        • Loads dropped DLL
                                        • System Network Configuration Discovery: Internet Connection Discovery
                                        PID:2704
                                        • C:\Windows\system32\PING.EXE
                                          ping localhost -n 1
                                          6⤵
                                          • System Network Configuration Discovery: Internet Connection Discovery
                                          • Runs ping.exe
                                          PID:1852
                                        • C:\Users\Admin\AppData\Local\kreon.exe
                                          C:\Users\Admin\AppData\Local\kreon.exe
                                          6⤵
                                          • Executes dropped EXE
                                          PID:2252
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                1⤵
                                  PID:3128
                                • C:\Windows\system32\taskeng.exe
                                  taskeng.exe {F0FE0BDB-36F3-4B03-B051-EA8E824EB3B4} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]
                                  1⤵
                                    PID:1780
                                    • C:\Users\Admin\AppData\Local\Temp\service123.exe
                                      C:\Users\Admin\AppData\Local\Temp\/service123.exe
                                      2⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      PID:3720

                                  Network

                                        MITRE ATT&CK Enterprise v15

                                        Reconnaissance

                                        Resource Development

                                        Initial Access

                                        Execution

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Persistence

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Modify Authentication Process

                                        1
                                        T1556

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Privilege Escalation

                                        Boot or Logon Autostart Execution

                                        1
                                        T1547

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1547.001

                                        Scheduled Task/Job

                                        1
                                        T1053

                                        Scheduled Task

                                        1
                                        T1053.005

                                        Defense Evasion

                                        Modify Authentication Process

                                        1
                                        T1556

                                        Modify Registry

                                        2
                                        T1112

                                        Subvert Trust Controls

                                        1
                                        T1553

                                        Install Root Certificate

                                        1
                                        T1553.004

                                        Virtualization/Sandbox Evasion

                                        2
                                        T1497

                                        Credential Access

                                        Credentials from Password Stores

                                        1
                                        T1555

                                        Credentials from Web Browsers

                                        1
                                        T1555.003

                                        Modify Authentication Process

                                        1
                                        T1556

                                        Steal Web Session Cookie

                                        1
                                        T1539

                                        Unsecured Credentials

                                        1
                                        T1552

                                        Credentials In Files

                                        1
                                        T1552.001

                                        Discovery

                                        Browser Information Discovery

                                        1
                                        T1217

                                        Query Registry

                                        7
                                        T1012

                                        Remote System Discovery

                                        1
                                        T1018

                                        System Information Discovery

                                        4
                                        T1082

                                        System Location Discovery

                                        1
                                        T1614

                                        System Language Discovery

                                        1
                                        T1614.001

                                        System Network Configuration Discovery

                                        1
                                        T1016

                                        Internet Connection Discovery

                                        1
                                        T1016.001

                                        Virtualization/Sandbox Evasion

                                        2
                                        T1497

                                        Lateral Movement

                                        Collection

                                        Data from Local System

                                        1
                                        T1005

                                        Command and Control

                                        Web Service

                                        1
                                        T1102

                                        Exfiltration

                                        Impact

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        000007.dbtmp
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp
                                        • Size 16B
                                        • SHA256 8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        data_1
                                        • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                        • Size 264KB
                                        • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        activity-stream.discovery_stream.json.tmp
                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\activity-stream.discovery_stream.json.tmp
                                        • Size 31KB
                                        • SHA256 2781fb070c40e22ebf23d7c28f8394a8c6f307954dbf4695bf8a36f796180021
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        asrouter.ftl
                                        • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl
                                        • Size 13KB
                                        • SHA256 402571262fd1f6dca336f822ceb0ec2a368a25dfe2f4bfa13b45c983e88b6069
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        game.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\10006070101\game.exe
                                        • Size 7.0MB
                                        • SHA256 513544f9a75630e32a26c2d54c69247a32ffa85e4bcc9eca24547416634911d9
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        7efb1b6c24.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\10006170101\7efb1b6c24.exe
                                        • Size 3.5MB
                                        • SHA256 377717dd342a9169589d1e2c8509d12ceafe9c43b3407ab16771ec611a367a2a
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        2b7a1bac6d.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\1008713001\2b7a1bac6d.exe
                                        • Size 4.1MB
                                        • SHA256 92edd16fc04624fc69b9be59155def1c28600e9d1bb8c804df61fc4f1422e017
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        1743c7f598.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\1008718001\1743c7f598.exe
                                        • Size 1.7MB
                                        • SHA256 b7ddf1ea8408262be1584cca601fafac7d18e8e9e1f075c0579395d1ae30616d
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        6ab6ff1532.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\1008719001\6ab6ff1532.exe
                                        • Size 1.7MB
                                        • SHA256 327b96e7de0c91b4799d730b5c18641fe694ab2e367f1a1d7665dbca7e37aba9
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        0a29b13a33.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\1008720001\0a29b13a33.exe
                                        • Size 901KB
                                        • SHA256 f2c117fe2b73781335a3b701890ad7b61dc1970b2a25be7fd4ed6a2b3264d308
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        f23d4648cb.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\1008721001\f23d4648cb.exe
                                        • Size 2.7MB
                                        • SHA256 43b97c1dc396c9492f6e13786f748ee59cfcab42eebcf7d9ff3a959940aab53b
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Cab3E2B.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\Cab3E2B.tmp
                                        • Size 70KB
                                        • SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        O1M08.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\O1M08.exe
                                        • Size 5.4MB
                                        • SHA256 a3e340fcdfd20f88c060c740149adf3920bcddb009906f328121a9889ff8656a
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        2y9598.exe
                                        • Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2y9598.exe
                                        • Size 1.8MB
                                        • SHA256 6f064372869eee9be9b504a086011c8beb3d7c753a87bd0a28c44ee5a22c6ffc
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        Tar3E5D.tmp
                                        • Path C:\Users\Admin\AppData\Local\Temp\Tar3E5D.tmp
                                        • Size 181KB
                                        • SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        tmpaddon
                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon
                                        • Size 442KB
                                        • SHA256 a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        tmpaddon-1
                                        • Path C:\Users\Admin\AppData\Local\Temp\tmpaddon-1
                                        • Size 8.0MB
                                        • SHA256 345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        data.safe.bin
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\db\data.safe.bin
                                        • Size 2KB
                                        • SHA256 d8edf824c9f4eeeea7b24a82459c58d00e6854e4aaa5d6312de8f4526b51a3a2
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        20023643-84b5-4ad8-9b19-4c58813dc362
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\20023643-84b5-4ad8-9b19-4c58813dc362
                                        • Size 11KB
                                        • SHA256 c99063372e165325c4278938d3f5c27d5865bc6184dde7c75ccf2a9b56ab5bdd
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        c0a6692e-2759-4786-856e-641044140ca9
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\datareporting\glean\pending_pings\c0a6692e-2759-4786-856e-641044140ca9
                                        • Size 745B
                                        • SHA256 43eb14cd1a7495240771bd3485c6c184bde9e60a4d789e93cae2e2f07b2cc354
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        gmpopenh264.dll
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll
                                        • Size 997KB
                                        • SHA256 1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        gmpopenh264.info
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info
                                        • Size 116B
                                        • SHA256 f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        LICENSE.txt
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt
                                        • Size 479B
                                        • SHA256 2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        manifest.json
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json
                                        • Size 372B
                                        • SHA256 e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        widevinecdm.dll
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll
                                        • Size 11.8MB
                                        • SHA256 8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        widevinecdm.dll.lib
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib
                                        • Size 1KB
                                        • SHA256 33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        widevinecdm.dll.sig
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig
                                        • Size 1KB
                                        • SHA256 68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81
                                        • MD5 SHA1 SHA512
                                        Submit Download

                                        prefs-1.js
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
                                        • Size 7KB
                                        • SHA256 31923c9289449f8c339762020887f6913c75a010b979a25203462cd6d5d84d84
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        prefs-1.js
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs-1.js
                                        • Size 7KB
                                        • SHA256 f5ac16eab38f74d4772303baf6729cb7878129aa65222fb437519de7f8469813
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        recovery.jsonlz4
                                        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\sessionstore-backups\recovery.jsonlz4
                                        • Size 4KB
                                        • SHA256 4b2ce2fa5c7dbab3f890ca9cdc5fd6d5caea9eebcbe7625cd8576f5bb33c50e6
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        clip64.dll
                                        • Path C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
                                        • Size 124KB
                                        • SHA256 885bf0b3b12b77ef3f953fbb48def1b45079faa2a4d574ee16afdbafa1de3ac7
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        4y227q.exe
                                        • Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\4y227q.exe
                                        • Size 2.7MB
                                        • SHA256 ac875e32c67120a2f55ce2120782aa50edb5bca31fc9767dd808882df740091f
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        3y27e.exe
                                        • Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\3y27e.exe
                                        • Size 1.7MB
                                        • SHA256 3427282a0e679abf14880c48f47728c97e1c3f870d1bf3bc0116736f3abde675
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        M9m81.exe
                                        • Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\M9m81.exe
                                        • Size 3.6MB
                                        • SHA256 dda5701d4fde3d5ca305ea1294dfd8474d8d6a6c552f324a10b6597e649a4670
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        1U37p9.exe
                                        • Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\1U37p9.exe
                                        • Size 1.8MB
                                        • SHA256 715223f9d8cbff4640796f95054a54aaba8a06c7215d167a13d9f1ebf8bc1f17
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        defnur.exe
                                        • Path \Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
                                        • Size 1.8MB
                                        • SHA256 94620a76353f019700029a53664a5b388bb67e49dfb4512ef688a733552f0fc7
                                        • MD5 SHA1 SHA512 SSDEEP
                                        Submit Download

                                        memory/536-167-0x0000000003070000-0x0000000003322000-memory.dmp
                                        Download

                                        memory/600-89-0x0000000007340000-0x00000000077DE000-memory.dmp
                                        Download

                                        memory/600-75-0x0000000001050000-0x00000000014EE000-memory.dmp
                                        Download

                                        memory/600-74-0x0000000000210000-0x00000000006AE000-memory.dmp
                                        Download

                                        memory/600-90-0x0000000000210000-0x00000000006AE000-memory.dmp
                                        Download

                                        memory/992-232-0x00000000010B0000-0x000000000152D000-memory.dmp
                                        Download

                                        memory/1072-107-0x0000000002940000-0x0000000002DDE000-memory.dmp
                                        Download

                                        memory/1072-98-0x0000000002940000-0x0000000002DCB000-memory.dmp
                                        Download

                                        memory/1072-104-0x0000000002940000-0x0000000002DDE000-memory.dmp
                                        Download

                                        memory/1072-76-0x0000000002940000-0x0000000002DDE000-memory.dmp
                                        Download

                                        memory/1072-73-0x0000000002940000-0x0000000002DDE000-memory.dmp
                                        Download

                                        memory/1088-146-0x0000000002B70000-0x00000000031F2000-memory.dmp
                                        Download

                                        memory/1112-598-0x0000000001070000-0x0000000001CA5000-memory.dmp
                                        Download

                                        memory/1112-234-0x0000000069CC0000-0x000000006A71B000-memory.dmp
                                        Download

                                        memory/1112-614-0x0000000001070000-0x0000000001CA5000-memory.dmp
                                        Download

                                        memory/1112-623-0x0000000001070000-0x0000000001CA5000-memory.dmp
                                        Download

                                        memory/1112-715-0x0000000001070000-0x0000000001CA5000-memory.dmp
                                        Download

                                        memory/1112-243-0x0000000001070000-0x0000000001CA5000-memory.dmp
                                        Download

                                        memory/1676-233-0x0000000000A10000-0x000000000108C000-memory.dmp
                                        Download

                                        memory/2092-172-0x00000000011A0000-0x0000000001452000-memory.dmp
                                        Download

                                        memory/2092-171-0x0000000000EE0000-0x0000000001192000-memory.dmp
                                        Download

                                        memory/2092-216-0x0000000000EE0000-0x0000000001192000-memory.dmp
                                        Download

                                        memory/2220-615-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-655-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-756-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-259-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-752-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-748-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-744-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-740-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-94-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-95-0x0000000000DE0000-0x000000000127E000-memory.dmp
                                        Download

                                        memory/2220-730-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-187-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-721-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-716-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-147-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-601-0x00000000003C0000-0x000000000085E000-memory.dmp
                                        Download

                                        memory/2220-151-0x0000000000DE0000-0x000000000127E000-memory.dmp
                                        Download

                                        memory/2484-15-0x0000000007170000-0x0000000007631000-memory.dmp
                                        Download

                                        memory/2484-0-0x0000000001360000-0x0000000001821000-memory.dmp
                                        Download

                                        memory/2484-1-0x0000000077680000-0x0000000077682000-memory.dmp
                                        Download

                                        memory/2484-2-0x0000000001361000-0x000000000138F000-memory.dmp
                                        Download

                                        memory/2484-3-0x0000000001360000-0x0000000001821000-memory.dmp
                                        Download

                                        memory/2484-4-0x0000000001360000-0x0000000001821000-memory.dmp
                                        Download

                                        memory/2484-16-0x0000000001360000-0x0000000001821000-memory.dmp
                                        Download

                                        memory/2744-103-0x0000000001030000-0x00000000014BB000-memory.dmp
                                        Download

                                        memory/2744-142-0x0000000001030000-0x00000000014BB000-memory.dmp
                                        Download

                                        memory/2744-105-0x0000000000BA0000-0x000000000102B000-memory.dmp
                                        Download

                                        memory/2808-741-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-106-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-17-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-22-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-214-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-622-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-702-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-23-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-602-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-25-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-718-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-722-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-21-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-753-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-24-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-749-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-19-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-734-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-381-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/2808-18-0x0000000000061000-0x000000000008F000-memory.dmp
                                        Download

                                        memory/2808-745-0x0000000000060000-0x0000000000521000-memory.dmp
                                        Download

                                        memory/3036-153-0x0000000001580000-0x0000000001C02000-memory.dmp
                                        Download

                                        memory/3036-152-0x0000000000EF0000-0x0000000001572000-memory.dmp
                                        Download

                                        memory/3036-154-0x0000000000EF0000-0x0000000001572000-memory.dmp
                                        Download

                                        memory/3720-725-0x0000000001320000-0x0000000001332000-memory.dmp
                                        Download

                                        memory/4028-719-0x0000000001320000-0x0000000001332000-memory.dmp
                                        Download

                                        memory/4028-720-0x0000000073880000-0x00000000739B4000-memory.dmp
                                        Download