amadey | 536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb

Analysis

max time kernel
144s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe
Size

3.0MB
MD5

520ee940832d8a70cef812a75401009c
SHA1

83d76e5b100e044be166e1be2b30bf5f1eaf2332
SHA256

536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb
SHA512

5b6e1e9495849c12e6e268c17347e4b3ce15c9b684e0697c524e5dbb7d8d0f9c5e14bdc2945e1c90949272893b911cef913becad4855fb58516784fd5b0d7217
SSDEEP

49152:2IX4k+/kZFoejWG7pFo4jjBuqNFrzrLujVUeTWDqHFC:2l1oFojG7pFo4jtuokSeqD

Score

10^/10

amadey gcleaner lumma stealc 9c9aa5 stok discovery evasion loader persistence stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

lumma

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

Extracted

Family

lumma

https://atten-supporse.biz/api

https://covery-mover.biz/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b183ad1893.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	fee1163b84.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9f7552d8b3.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9f7552d8b3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9f7552d8b3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	fee1163b84.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b183ad1893.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	fee1163b84.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b183ad1893.exe

Executes dropped EXE 6 IoCs

pid	Process
2208	skotes.exe
692	4ce42b1e92.exe
2360	b183ad1893.exe
1860	fee1163b84.exe
2464	579274aa73.exe
3776	9f7552d8b3.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	b183ad1893.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	fee1163b84.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	9f7552d8b3.exe

Loads dropped DLL 15 IoCs

pid	Process
2412	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe
2412	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe
2208	skotes.exe
2208	skotes.exe
2208	skotes.exe
2208	skotes.exe
2208	skotes.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
3684	WerFault.exe
2208	skotes.exe
2208	skotes.exe
3776	9f7552d8b3.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\b183ad1893.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013887001\\b183ad1893.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\fee1163b84.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013888001\\fee1163b84.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\579274aa73.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1013889001\\579274aa73.exe"	skotes.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x0005000000018704-93.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2412	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe
2208	skotes.exe
2360	b183ad1893.exe
1860	fee1163b84.exe
3776	9f7552d8b3.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3684	692	WerFault.exe	33

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ce42b1e92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b183ad1893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fee1163b84.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	579274aa73.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9f7552d8b3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	579274aa73.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	579274aa73.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
912	taskkill.exe
2188	taskkill.exe
2320	taskkill.exe
884	taskkill.exe
1692	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2412	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe
2208	skotes.exe
2360	b183ad1893.exe
1860	fee1163b84.exe
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe
3776	9f7552d8b3.exe
3776	9f7552d8b3.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	912	taskkill.exe
Token: SeDebugPrivilege	2188	taskkill.exe
Token: SeDebugPrivilege	1692	taskkill.exe
Token: SeDebugPrivilege	2320	taskkill.exe
Token: SeDebugPrivilege	884	taskkill.exe
Token: SeDebugPrivilege	1720	firefox.exe
Token: SeDebugPrivilege	1720	firefox.exe

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2412	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe
1720	firefox.exe
1720	firefox.exe
1720	firefox.exe
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe
2464	579274aa73.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2208	2412	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe	30
PID 2412 wrote to memory of 2208	2412	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe	30
PID 2412 wrote to memory of 2208	2412	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe	30
PID 2412 wrote to memory of 2208	2412	536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe	30
PID 2208 wrote to memory of 692	2208	skotes.exe	33
PID 2208 wrote to memory of 692	2208	skotes.exe	33
PID 2208 wrote to memory of 692	2208	skotes.exe	33
PID 2208 wrote to memory of 692	2208	skotes.exe	33
PID 2208 wrote to memory of 2360	2208	skotes.exe	34
PID 2208 wrote to memory of 2360	2208	skotes.exe	34
PID 2208 wrote to memory of 2360	2208	skotes.exe	34
PID 2208 wrote to memory of 2360	2208	skotes.exe	34
PID 2208 wrote to memory of 1860	2208	skotes.exe	35
PID 2208 wrote to memory of 1860	2208	skotes.exe	35
PID 2208 wrote to memory of 1860	2208	skotes.exe	35
PID 2208 wrote to memory of 1860	2208	skotes.exe	35
PID 2208 wrote to memory of 2464	2208	skotes.exe	36
PID 2208 wrote to memory of 2464	2208	skotes.exe	36
PID 2208 wrote to memory of 2464	2208	skotes.exe	36
PID 2208 wrote to memory of 2464	2208	skotes.exe	36
PID 2464 wrote to memory of 912	2464	579274aa73.exe	37
PID 2464 wrote to memory of 912	2464	579274aa73.exe	37
PID 2464 wrote to memory of 912	2464	579274aa73.exe	37
PID 2464 wrote to memory of 912	2464	579274aa73.exe	37
PID 2464 wrote to memory of 2188	2464	579274aa73.exe	40
PID 2464 wrote to memory of 2188	2464	579274aa73.exe	40
PID 2464 wrote to memory of 2188	2464	579274aa73.exe	40
PID 2464 wrote to memory of 2188	2464	579274aa73.exe	40
PID 2464 wrote to memory of 1692	2464	579274aa73.exe	42
PID 2464 wrote to memory of 1692	2464	579274aa73.exe	42
PID 2464 wrote to memory of 1692	2464	579274aa73.exe	42
PID 2464 wrote to memory of 1692	2464	579274aa73.exe	42
PID 2464 wrote to memory of 2320	2464	579274aa73.exe	44
PID 2464 wrote to memory of 2320	2464	579274aa73.exe	44
PID 2464 wrote to memory of 2320	2464	579274aa73.exe	44
PID 2464 wrote to memory of 2320	2464	579274aa73.exe	44
PID 2464 wrote to memory of 884	2464	579274aa73.exe	46
PID 2464 wrote to memory of 884	2464	579274aa73.exe	46
PID 2464 wrote to memory of 884	2464	579274aa73.exe	46
PID 2464 wrote to memory of 884	2464	579274aa73.exe	46
PID 2464 wrote to memory of 1600	2464	579274aa73.exe	48
PID 2464 wrote to memory of 1600	2464	579274aa73.exe	48
PID 2464 wrote to memory of 1600	2464	579274aa73.exe	48
PID 2464 wrote to memory of 1600	2464	579274aa73.exe	48
PID 1600 wrote to memory of 1720	1600	firefox.exe	49
PID 1600 wrote to memory of 1720	1600	firefox.exe	49
PID 1600 wrote to memory of 1720	1600	firefox.exe	49
PID 1600 wrote to memory of 1720	1600	firefox.exe	49
PID 1600 wrote to memory of 1720	1600	firefox.exe	49
PID 1600 wrote to memory of 1720	1600	firefox.exe	49
PID 1600 wrote to memory of 1720	1600	firefox.exe	49
PID 1600 wrote to memory of 1720	1600	firefox.exe	49
PID 1600 wrote to memory of 1720	1600	firefox.exe	49
PID 1600 wrote to memory of 1720	1600	firefox.exe	49
PID 1600 wrote to memory of 1720	1600	firefox.exe	49
PID 1600 wrote to memory of 1720	1600	firefox.exe	49
PID 1720 wrote to memory of 1984	1720	firefox.exe	50
PID 1720 wrote to memory of 1984	1720	firefox.exe	50
PID 1720 wrote to memory of 1984	1720	firefox.exe	50
PID 1720 wrote to memory of 1956	1720	firefox.exe	51
PID 1720 wrote to memory of 1956	1720	firefox.exe	51
PID 1720 wrote to memory of 1956	1720	firefox.exe	51
PID 1720 wrote to memory of 1956	1720	firefox.exe	51
PID 1720 wrote to memory of 1956	1720	firefox.exe	51

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe
"C:\Users\Admin\AppData\Local\Temp\536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Users\Admin\AppData\Local\Temp\1013886001\4ce42b1e92.exe
    "C:\Users\Admin\AppData\Local\Temp\1013886001\4ce42b1e92.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:692
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 44
      4⤵
      Loads dropped DLL
      Program crash
      PID:3684
- - C:\Users\Admin\AppData\Local\Temp\1013887001\b183ad1893.exe
    "C:\Users\Admin\AppData\Local\Temp\1013887001\b183ad1893.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2360
- - C:\Users\Admin\AppData\Local\Temp\1013888001\fee1163b84.exe
    "C:\Users\Admin\AppData\Local\Temp\1013888001\fee1163b84.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1860
- - C:\Users\Admin\AppData\Local\Temp\1013889001\579274aa73.exe
    "C:\Users\Admin\AppData\Local\Temp\1013889001\579274aa73.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:912
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2188
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1692
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:884
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1600
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1720
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.0.94919325\67465737" -parentBuildID 20221007134813 -prefsHandle 1196 -prefMapHandle 1116 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f5723abc-3e94-4d93-97b9-9c53762b6076} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 1272 f9d3958 gpu
        6⤵
        
        PID:1984
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.1.1992326530\1998493110" -parentBuildID 20221007134813 -prefsHandle 1512 -prefMapHandle 1508 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac2eaf5e-edd6-43b7-8333-1d8beb7b802d} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 1524 134d7e58 socket
        6⤵
        
        PID:1956
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.2.956598390\1443336794" -childID 1 -isForBrowser -prefsHandle 1932 -prefMapHandle 1928 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {22fe1516-d3a7-4ec2-9a70-62a05aae337b} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 1944 19a70058 tab
        6⤵
        
        PID:1308
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.3.1632997507\1900527505" -childID 2 -isForBrowser -prefsHandle 2724 -prefMapHandle 2720 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb91d76c-ae68-4d39-816f-4fdf384ecdc8} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 2736 e6ce58 tab
        6⤵
        
        PID:1048
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.4.1858089417\1331319318" -childID 3 -isForBrowser -prefsHandle 3736 -prefMapHandle 3728 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {96d78adc-56ec-4dc5-90cb-adc47d879776} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 3744 1ef0fd58 tab
        6⤵
        
        PID:2140
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.5.1827620883\2014886542" -childID 4 -isForBrowser -prefsHandle 3852 -prefMapHandle 3856 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1758e4c7-a12c-4b3b-974d-8beea30c5ed6} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 3764 1ef10658 tab
        6⤵
        
        PID:2492
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1720.6.78156609\51006709" -childID 5 -isForBrowser -prefsHandle 4012 -prefMapHandle 4016 -prefsLen 26351 -prefMapSize 233444 -jsInitHandle 564 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c6d36eb-a1f1-489c-a8d5-f9be1c9e2faf} 1720 "\\.\pipe\gecko-crash-server-pipe.1720" 3944 20351d58 tab
        6⤵
        
        PID:1796
- - C:\Users\Admin\AppData\Local\Temp\1013891001\9f7552d8b3.exe
    "C:\Users\Admin\AppData\Local\Temp\1013891001\9f7552d8b3.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7BQ20K5D\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\activity-stream.discovery_stream.json.tmp

Filesize
31KB

MD5
b6505c286279db29219aefb9a6ae1cb9

SHA1
56d3af0c7423d3d06f86992a678cc954b7a2d608

SHA256
62ee5fd69374b33ed933fb7d76da6b91e0d4be8eb78778e0c2aeb19391c4fe5e

SHA512
e7fd43a4fc57e01082ad6048d3b95122bd7374acc2173143a0b73f864b3d4f37a35115022db65514ca30bd5e038454bba8ae85fbcdbd546710647b75e9587f57

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\1013886001\4ce42b1e92.exe

Filesize
2.5MB

MD5
2a78ce9f3872f5e591d643459cabe476

SHA1
9ac947dfc71a868bc9c2eb2bd78dfb433067682e

SHA256
21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

SHA512
03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1013887001\b183ad1893.exe

Filesize
1.8MB

MD5
8acdb762884b5b158baa97ef82092801

SHA1
5f0e9409918f923e51e7c5443bd595fa3191aa37

SHA256
cebd39057210ff489a2ce3bec47d182efdb42d1a44c6be80919bb7f15a653d8c

SHA512
81a49ca000c783a3c1f86d23ad2d8572f0598a40cbf5feca9e467ca5d544c753a773f8ce481dcab0147711e5eeab743c86db1545a52d7ded51eff82f2690e736

Download Submit
C:\Users\Admin\AppData\Local\Temp\1013888001\fee1163b84.exe

Filesize
1.8MB

MD5
37b82918f398b44c105c640bfd4b4ae8

SHA1
7d3deaf1a4edda230934ef983cc9463bd71e5ac4

SHA256
6383cde311a862695e4beb993b5a2942001d55cac0b5ee80ca604ebde00956b7

SHA512
6fc57c3c156ca660fc5d5b7ac82f74c8ce10e5d73d60c83d7e41b98ddce9232c5c9e1f38dceafbdbdb34a4f11c311be43606fe2b4370272056eaa568081adb0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1013889001\579274aa73.exe

Filesize
946KB

MD5
fc26bdbe9ddeeed584ca0edf20262ab8

SHA1
c8a690c697b674e7cd5b8bcebab365d743fd474b

SHA256
7bc7da7d6376541a7b3579417c4d163d849387a7b6b5439b0c920a5cc2a26b79

SHA512
ad7dfcd10809cf214d9c34ac8014425ff1b8d5075584d13ebe390c32df1635dc1b5505e1d056d6109d8eae7f9365bed4e1b27820239a2c0d58c859ce65c1a560

Download Submit
C:\Users\Admin\AppData\Local\Temp\1013891001\9f7552d8b3.exe

Filesize
1.9MB

MD5
6bdc7e5e568df98f51a6944d9f0249a9

SHA1
8178919986a2a8d9bd1f5870304d31e48abf10db

SHA256
154cf5f9fd1654e63454e3a01100fb0f4b7bb846d17ea315c649700ab942fcd2

SHA512
0c2f871b89b4c4792518db4d273714db193e6cd10463cdff8db3baf7f49256ae491eaaf5c39e5033b5f1767b227011a6f8a95f4685da892c35b1c2d23d28946d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2657.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2679.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
3.0MB

MD5
520ee940832d8a70cef812a75401009c

SHA1
83d76e5b100e044be166e1be2b30bf5f1eaf2332

SHA256
536df3a39899dec8c749ef790bc7d55c8dc60052555c74fa2ed1f8518a2180eb

SHA512
5b6e1e9495849c12e6e268c17347e4b3ce15c9b684e0697c524e5dbb7d8d0f9c5e14bdc2945e1c90949272893b911cef913becad4855fb58516784fd5b0d7217

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
5d7d3a644ce10712e6c3c1c47d8bd1af

SHA1
54a8623a6491344aee385134a1271a82b6ab95f2

SHA256
3fd9439ffa40567406a50104004767f45aea848d4498fdf0ba774fbc727526cb

SHA512
05c2d0b94411974a291ccfa667e088d9497ece4708b5cbf56035818989a7eaf67d9bb79885932be33dbfabaa84d28a1072a239f40c781380f245c86224a7872e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\625c446c-a8f3-4546-b9c8-98625313fc7a

Filesize
733B

MD5
c4fcac816d4442909da31d375dbf5b47

SHA1
de3c323c6d010b98ba7a10792a721260e9252a69

SHA256
e13477792a8b5e462940b10811604cc8f38e011820c50742413bc5617b498514

SHA512
a6516f0d9be9bfbfece886405a089120b979a81d46eee5b80b148bfee1207d4011b247f1e9675b4b233051027381fe8736db38ac704f4ced291b42fd5e1dc351

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js

Filesize
6KB

MD5
41eb8a46c296d35411a615e5c2403c64

SHA1
6f862be960f668cd1bdeb90cdb5c7fcbb2032586

SHA256
770167990747f71c0f4b297fd359511509734f694806e91f0d04d0e3a2450845

SHA512
c2944e00122ba8297497df62a1acf94310c1c1e10912113c84aef3745b2450f790c3531fd47a1a7c5e354d5ed5ab110de344d612c846209e3f45ac8bac14a0b8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js

Filesize
6KB

MD5
ab4fd538ea7baebcce346fbd64f3a359

SHA1
d94692ee572b04cb35f539bdd2c01f8d4116a14e

SHA256
9c3ba51cdd6ffe8cac4a14969a1c9b25d9c53ad2801b62ecabf4377abd9ad067

SHA512
ab6d653ec2ca55b68babd39591c79bb0b3bc3f1bdae5479e605b326925b719166152e3858ec065254a29d566b1cb4369dfc721c3174281fec0f8ee4e95f8e4b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs.js

Filesize
6KB

MD5
6293105080bb45c1c6d2075a0c01e8b4

SHA1
0f39470da9d0d014c40c82014efcab4992e3017a

SHA256
71706bdf969834f8f41a1ef184eec6d65b12e9a40cc4c6c60032f9ef4546bfa7

SHA512
0778ce612499dbee709ae30001d10606092a1382b89203e20b7ea2f330c059f3196022151cc014fbea76c851e6f44089ae1bf95c4c10913051bf28cd07c0d46a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
81b64f9cc9fb57fee0169ac4d699180c

SHA1
453d962b270cd1258a0f4774334329db1b7ad450

SHA256
1d96737b128e9597c0a28d824ad08dea7cee3f52d4ca40133112859629a45087

SHA512
d505817b7d47f492bdc0bc52e3f06a15413e6caef7b0bfa02595f8868c0674984e9ebebdf448d12b1c188d9a40404bc30668672489affae99b496e8e8adbc9bd

Download Submit
\Users\Admin\AppData\Local\Temp\e5sRw03FwdufEE23EdJ33wv4DV2\Y-Cleaner.exe

Filesize
1.4MB

MD5
a8cf5621811f7fac55cfe8cb3fa6b9f6

SHA1
121356839e8138a03141f5f5856936a85bd2a474

SHA256
614a0362ab87cee48d0935b5bb957d539be1d94c6fdeb3fe42fac4fbe182c10c

SHA512
4479d951435f222ca7306774002f030972c9f1715d6aaf512fca9420dd79cb6d08240f80129f213851773290254be34f0ff63c7b1f4d554a7db5f84b69e84bdd

Download Submit
memory/692-46-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/692-82-0x00000000005D0000-0x00000000006D0000-memory.dmp

Filesize
1024KB

Download
memory/1860-85-0x00000000008D0000-0x0000000000F7D000-memory.dmp

Filesize
6.7MB

Download
memory/1860-87-0x00000000008D0000-0x0000000000F7D000-memory.dmp

Filesize
6.7MB

Download
memory/2208-239-0x00000000069A0000-0x000000000704D000-memory.dmp

Filesize
6.7MB

Download
memory/2208-27-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-103-0x00000000069A0000-0x0000000006E2F000-memory.dmp

Filesize
4.6MB

Download
memory/2208-104-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-81-0x00000000069A0000-0x000000000704D000-memory.dmp

Filesize
6.7MB

Download
memory/2208-84-0x00000000069A0000-0x000000000704D000-memory.dmp

Filesize
6.7MB

Download
memory/2208-466-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-63-0x00000000069A0000-0x0000000006E2F000-memory.dmp

Filesize
4.6MB

Download
memory/2208-48-0x00000000012D1000-0x0000000001339000-memory.dmp

Filesize
416KB

Download
memory/2208-465-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-464-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-49-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-45-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-29-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-463-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-28-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-313-0x00000000069A0000-0x000000000721A000-memory.dmp

Filesize
8.5MB

Download
memory/2208-462-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-311-0x00000000069A0000-0x000000000721A000-memory.dmp

Filesize
8.5MB

Download
memory/2208-315-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-461-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-333-0x00000000069A0000-0x000000000721A000-memory.dmp

Filesize
8.5MB

Download
memory/2208-454-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-449-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-339-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-403-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-25-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-22-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-351-0x00000000012D0000-0x00000000015E0000-memory.dmp

Filesize
3.1MB

Download
memory/2208-24-0x00000000012D1000-0x0000000001339000-memory.dmp

Filesize
416KB

Download
memory/2360-88-0x0000000001150000-0x00000000015DF000-memory.dmp

Filesize
4.6MB

Download
memory/2360-64-0x0000000001150000-0x00000000015DF000-memory.dmp

Filesize
4.6MB

Download
memory/2360-185-0x0000000001150000-0x00000000015DF000-memory.dmp

Filesize
4.6MB

Download
memory/2360-287-0x0000000001150000-0x00000000015DF000-memory.dmp

Filesize
4.6MB

Download
memory/2412-2-0x0000000000E51000-0x0000000000EB9000-memory.dmp

Filesize
416KB

Download
memory/2412-18-0x0000000000E50000-0x0000000001160000-memory.dmp

Filesize
3.1MB

Download
memory/2412-20-0x0000000006E30000-0x0000000007140000-memory.dmp

Filesize
3.1MB

Download
memory/2412-10-0x0000000000E50000-0x0000000001160000-memory.dmp

Filesize
3.1MB

Download
memory/2412-5-0x0000000000E50000-0x0000000001160000-memory.dmp

Filesize
3.1MB

Download
memory/2412-3-0x0000000000E50000-0x0000000001160000-memory.dmp

Filesize
3.1MB

Download
memory/2412-23-0x0000000000E51000-0x0000000000EB9000-memory.dmp

Filesize
416KB

Download
memory/2412-1-0x0000000077120000-0x0000000077122000-memory.dmp

Filesize
8KB

Download
memory/2412-0-0x0000000000E50000-0x0000000001160000-memory.dmp

Filesize
3.1MB

Download
memory/2412-19-0x0000000006E30000-0x0000000007140000-memory.dmp

Filesize
3.1MB

Download
memory/3776-337-0x0000000000400000-0x0000000000C7A000-memory.dmp

Filesize
8.5MB

Download
memory/3776-326-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/3776-314-0x0000000000400000-0x0000000000C7A000-memory.dmp

Filesize
8.5MB

Download
memory/3776-338-0x0000000000400000-0x0000000000C7A000-memory.dmp

Filesize
8.5MB

Download
memory/3776-447-0x0000000000400000-0x0000000000C7A000-memory.dmp

Filesize
8.5MB

Download
memory/3776-381-0x0000000000400000-0x0000000000C7A000-memory.dmp

Filesize
8.5MB

Download
memory/3776-349-0x0000000000400000-0x0000000000C7A000-memory.dmp

Filesize
8.5MB

Download