Overview

overview

10

Static

static

3

d986544247...9f.exe

windows7-x64

10

d986544247...9f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-12-2024 03:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe

  • Size

    3.0MB

  • MD5

    ad7f121646aa374af133772519375710

  • SHA1

    4e85ad004aa170ed53b7818b78e0b12e042b18ea

  • SHA256

    d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f

  • SHA512

    fbe1dfd40bc2fa8c6617823d32023dba5625c5e7cb235f87b284f1166a30d64e75781e80b2586e4a6f7ada4cda9df3e17f1d61829705647c71232a2f902c81c3

  • SSDEEP

    49152:6UAh2jV6Tj3t5FH+2Qy0GsO7wXRzFxa73lx5:6UAh2jVej3jFH+2QyQO7ghO35

Score
10/10
amadeygcleanergurculummamilleniumratstealcxmrig9c9aa5stokcredential_accessdiscoveryevasionloaderminerpersistenceratspywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://drive-connect.cyou/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

gurcu

C2

https://api.telegram.org/bot7733030005:AAEneIh4MdJeCVQCr4Pys9pel6q03FCPCi0/sendDocument?chat_id=7538374929&caption=%F0%9F%93%82%20-%20Browser%20data%0A%E2%94%9C%E2%94%80%E2%94%80%20%F0%9F%93%82%20-%20cookies(0.25%20kb

https://api.telegram.org/bot7733030005:AAEneIh4MdJeCVQCr4Pys9pel6q03FCPCi0/sendMessage?chat_id=7538374929

https://api.telegram.org/bot7733030005:AAEneIh4MdJeCVQCr4Pys9pel6q03FCPCi0/getUpdates?offset=-

https://api.telegram.org/bot7733030005:AAEneIh4MdJeCVQCr4Pys9pel6q03FCPCi0/sendDocument?chat_id=7538374929&caption=%F0%9F%93%B8Screenshot%20take

Extracted

Family

lumma

C2

https://drive-connect.cyou/api

https://covery-mover.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • MilleniumRat

    MilleniumRat is a remote access trojan written in C#.

    ratstealermilleniumrat
  • Milleniumrat family
    milleniumrat
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Xmrig family
    xmrig
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs
    evasion
  • XMRig Miner payload 13 IoCs
    miner
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 14 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 24 IoCs
  • Identifies Wine through registry keys 2 TTPs 7 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 10 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist 1 TTPs 1 IoCs
    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
    evasion
  • Runs ping.exe 1 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe
    "C:\Users\Admin\AppData\Local\Temp\d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4732
      • C:\Users\Admin\AppData\Local\Temp\1014611001\WkfyDiO.exe
        "C:\Users\Admin\AppData\Local\Temp\1014611001\WkfyDiO.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3404
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpE4F1.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpE4F1.tmp.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3360
          • C:\Windows\system32\chcp.com
            chcp 65001
            5⤵
              PID:4444
            • C:\Windows\system32\tasklist.exe
              Tasklist /fi "PID eq 3404"
              5⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:740
            • C:\Windows\system32\find.exe
              find ":"
              5⤵
                PID:4760
              • C:\Windows\system32\timeout.exe
                Timeout /T 1 /Nobreak
                5⤵
                • Delays execution with timeout.exe
                PID:1596
              • C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
                "C:\Users\Admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:636
          • C:\Users\Admin\AppData\Local\Temp\1014620001\ae0fa5b2ae.exe
            "C:\Users\Admin\AppData\Local\Temp\1014620001\ae0fa5b2ae.exe"
            3⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:4228
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 636
              4⤵
              • Program crash
              PID:4536
          • C:\Users\Admin\AppData\Local\Temp\1014621001\d875644eb7.exe
            "C:\Users\Admin\AppData\Local\Temp\1014621001\d875644eb7.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1544
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2092
              • C:\Windows\system32\mode.com
                mode 65,10
                5⤵
                  PID:920
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2508
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_7.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:752
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_6.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1844
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_5.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1960
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_4.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4440
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_3.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:8
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_2.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2256
                • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                  7z.exe e extracted/file_1.zip -oextracted
                  5⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2012
                • C:\Windows\system32\attrib.exe
                  attrib +H "in.exe"
                  5⤵
                  • Views/modifies file attributes
                  PID:5048
                • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                  "in.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:4332
                  • C:\Windows\SYSTEM32\attrib.exe
                    attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                    6⤵
                    • Views/modifies file attributes
                    PID:2228
                  • C:\Windows\SYSTEM32\attrib.exe
                    attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                    6⤵
                    • Views/modifies file attributes
                    PID:4436
                  • C:\Windows\SYSTEM32\schtasks.exe
                    schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                    6⤵
                    • Scheduled Task/Job: Scheduled Task
                    PID:5088
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell ping 127.0.0.1; del in.exe
                    6⤵
                    • System Network Configuration Discovery: Internet Connection Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2540
                    • C:\Windows\system32\PING.EXE
                      "C:\Windows\system32\PING.EXE" 127.0.0.1
                      7⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Runs ping.exe
                      PID:3436
            • C:\Users\Admin\AppData\Local\Temp\1014622001\c52ab439ef.exe
              "C:\Users\Admin\AppData\Local\Temp\1014622001\c52ab439ef.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1580
              • C:\Users\Admin\AppData\Local\Temp\1014622001\c52ab439ef.exe
                "C:\Users\Admin\AppData\Local\Temp\1014622001\c52ab439ef.exe"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3828
            • C:\Users\Admin\AppData\Local\Temp\1014623001\06782288f1.exe
              "C:\Users\Admin\AppData\Local\Temp\1014623001\06782288f1.exe"
              3⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              PID:4004
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014623001\06782288f1.exe" & rd /s /q "C:\ProgramData\XBS26PZCBA1V" & exit
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2776
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 10
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:4344
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4004 -s 2024
                4⤵
                • Program crash
                PID:712
            • C:\Users\Admin\AppData\Local\Temp\1014625001\40e93793eb.exe
              "C:\Users\Admin\AppData\Local\Temp\1014625001\40e93793eb.exe"
              3⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              PID:1080
            • C:\Users\Admin\AppData\Local\Temp\1014626001\4f458c340f.exe
              "C:\Users\Admin\AppData\Local\Temp\1014626001\4f458c340f.exe"
              3⤵
              • Modifies Windows Defender Real-time Protection settings
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Windows security modification
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:3360
            • C:\Users\Admin\AppData\Local\Temp\1014627001\b7f8cc6cb2.exe
              "C:\Users\Admin\AppData\Local\Temp\1014627001\b7f8cc6cb2.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4548
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4004 -ip 4004
          1⤵
            PID:2256
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            1⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            PID:3212
          • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
            C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            PID:4388
            • C:\Windows\explorer.exe
              explorer.exe
              2⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4744
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
              2⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1460
              • C:\Windows\system32\PING.EXE
                "C:\Windows\system32\PING.EXE" 127.1.10.1
                3⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3860
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4228 -ip 4228
            1⤵
              PID:1328
            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              1⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              PID:2036
            • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
              C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:4296
              • C:\Windows\explorer.exe
                explorer.exe
                2⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2668
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
                2⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:4332
                • C:\Windows\system32\PING.EXE
                  "C:\Windows\system32\PING.EXE" 127.1.10.1
                  3⤵
                  • System Network Configuration Discovery: Internet Connection Discovery
                  • Runs ping.exe
                  PID:1288

            Network

            MITRE ATT&CK Enterprise v15

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Persistence

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            1
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Scheduled Task/Job

            1
            T1053

            Scheduled Task

            1
            T1053.005

            Defense Evasion

            Hide Artifacts

            1
            T1564

            Hidden Files and Directories

            1
            T1564.001

            Impair Defenses

            2
            T1562

            Disable or Modify Tools

            2
            T1562.001

            Modify Registry

            3
            T1112

            Virtualization/Sandbox Evasion

            2
            T1497

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            3
            T1552

            Credentials In Files

            3
            T1552.001

            Discovery

            Browser Information Discovery

            1
            T1217

            Process Discovery

            1
            T1057

            Query Registry

            7
            T1012

            Remote System Discovery

            1
            T1018

            System Information Discovery

            4
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Internet Connection Discovery

            1
            T1016.001

            Virtualization/Sandbox Evasion

            2
            T1497

            Lateral Movement

            Collection

            Data from Local System

            2
            T1005

            Command and Control

            Web Service

            1
            T1102

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              Filesize

              2KB

              MD5

              6cf293cb4d80be23433eecf74ddb5503

              SHA1

              24fe4752df102c2ef492954d6b046cb5512ad408

              SHA256

              b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

              SHA512

              0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTJXD3SW\download[1].htm
              Filesize

              1B

              MD5

              cfcd208495d565ef66e7dff9f98764da

              SHA1

              b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

              SHA256

              5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

              SHA512

              31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              1KB

              MD5

              276798eeb29a49dc6e199768bc9c2e71

              SHA1

              5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

              SHA256

              cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

              SHA512

              0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

              Download Submit

            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              Filesize

              1KB

              MD5

              6a6f994471855c235733ee58b046728c

              SHA1

              ba8f7125e3169635c2adea1e1ccb6e5225b826bc

              SHA256

              1c582ca54bbcbfbaad9f1840edf604d028fad5f37a3b7f9e3d361a9d22086591

              SHA512

              827d44e3fa94d487fc1b5189ecc2ff46948fabcd18beab4c1785702281b555ae9bc2417dc05129da16671a94542ff1088f5bc02050ac8808cdead9a637aae576

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\1014611001\WkfyDiO.exe
              Filesize

              5.6MB

              MD5

              3442efc1a403eaeee70cc2a6729ee87b

              SHA1

              9fcc1af6ba397c0fcfb979af53e2e76c406e6080

              SHA256

              34443c63e5b3678dfd5df2e83fb1c70dcad8fbaa658a25bcde512e216e8d4a1c

              SHA512

              869bf4a24dbafe05a43872c6ff0ff437685df6dba97519fc1a58ce96ea2166a01162a77043f4ff52d488301e3d7f34f7c9c71cfa19b4ebad512a626c8ca43dca

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\1014620001\ae0fa5b2ae.exe
              Filesize

              1.9MB

              MD5

              5c682cd7d028b24b4cd0f276f3b50f54

              SHA1

              e6e8d03bfd05caff9df36150b7daf6c8a8b799d2

              SHA256

              53957b3c63da49c6bfd73328983d398e81c80c74c5d789d2066ff306769f3277

              SHA512

              616beed27ce126e88f882911c388d31e2c2ef5bd2c1ed05df06c1f3b0939d42787a9b08cf16a9a331301eed0875b55e4d47d99c5d975ead6e00e2b5e846cdfa5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\1014621001\d875644eb7.exe
              Filesize

              4.2MB

              MD5

              3a425626cbd40345f5b8dddd6b2b9efa

              SHA1

              7b50e108e293e54c15dce816552356f424eea97a

              SHA256

              ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

              SHA512

              a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\1014622001\c52ab439ef.exe
              Filesize

              710KB

              MD5

              28e568616a7b792cac1726deb77d9039

              SHA1

              39890a418fb391b823ed5084533e2e24dff021e1

              SHA256

              9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

              SHA512

              85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\1014623001\06782288f1.exe
              Filesize

              384KB

              MD5

              dfd5f78a711fa92337010ecc028470b4

              SHA1

              1a389091178f2be8ce486cd860de16263f8e902e

              SHA256

              da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

              SHA512

              a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\1014625001\40e93793eb.exe
              Filesize

              1.7MB

              MD5

              c70c219d988415347561167abd815428

              SHA1

              7672b4f7f1bec1fb679b75d8b056de1e22cf8c86

              SHA256

              78b460fe07346dc517a238c241ec02d8ae1181f9120fd8d0a88ba6571620fec6

              SHA512

              6cb316fa378dd96d4e67aa5f3ff60a975ddfc4a655dce32cd927dd059a13d419cb028a75982e3e3d72cdfd97f5fe4f4cc795660955a893ff4700bb8513e494e6

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\1014626001\4f458c340f.exe
              Filesize

              2.7MB

              MD5

              1cc25037092edd05264550a21466756e

              SHA1

              1eef4091618c8fbb8b91da7dc3cf854f9704c136

              SHA256

              f2da06bf6fa15a77e0f7d76ac9cd227953373927d1b214888c0df76ab723c01d

              SHA512

              2184a438a27b26aaf56b806ca2507a1e948c80e674141d3c6fc16da4c6572c3bd27951518ffee8344a3cf9f684f80833ab9842cbe3dcb09424c68b650269ce0a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\1014627001\b7f8cc6cb2.exe
              Filesize

              2.5MB

              MD5

              2a78ce9f3872f5e591d643459cabe476

              SHA1

              9ac947dfc71a868bc9c2eb2bd78dfb433067682e

              SHA256

              21a2ac44acd7a640735870eebfd04b8dc57bc66877cb5be3b929299e86a43dae

              SHA512

              03e2cd8161a1394ee535a2ea7d197791ab715d69a02ffab98121ec5ac8150d2b17a9a32a59307042c4bbeffad7425b55efa047651de6ed39277dba80711454f9

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\Costura\A54E036D2DCD19384E8EA53862E0DD8F\64\sqlite.interop.dll
              Filesize

              1.7MB

              MD5

              65ccd6ecb99899083d43f7c24eb8f869

              SHA1

              27037a9470cc5ed177c0b6688495f3a51996a023

              SHA256

              aba67c7e6c01856838b8bc6b0ba95e864e1fdcb3750aa7cdc1bc73511cea6fe4

              SHA512

              533900861fe36cf78b614d6a7ce741ff1172b41cbd5644b4a9542e6ca42702e6fbfb12f0fbaae8f5992320870a15e90b4f7bf180705fc9839db433413860be6d

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gd4jlmu0.psn.ps1
              Filesize

              60B

              MD5

              d17fe0a3f47be24a6453e9ef58c94641

              SHA1

              6ab83620379fc69f80c0242105ddffd7d98d5d9d

              SHA256

              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

              SHA512

              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              Filesize

              3.0MB

              MD5

              ad7f121646aa374af133772519375710

              SHA1

              4e85ad004aa170ed53b7818b78e0b12e042b18ea

              SHA256

              d9865442479ec9a282ff312cd91481710f9b6e21330be30a68fa16bf36c0799f

              SHA512

              fbe1dfd40bc2fa8c6617823d32023dba5625c5e7cb235f87b284f1166a30d64e75781e80b2586e4a6f7ada4cda9df3e17f1d61829705647c71232a2f902c81c3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
              Filesize

              1.6MB

              MD5

              72491c7b87a7c2dd350b727444f13bb4

              SHA1

              1e9338d56db7ded386878eab7bb44b8934ab1bc7

              SHA256

              34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

              SHA512

              583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              Filesize

              458KB

              MD5

              619f7135621b50fd1900ff24aade1524

              SHA1

              6c7ea8bbd435163ae3945cbef30ef6b9872a4591

              SHA256

              344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

              SHA512

              2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
              Filesize

              2.2MB

              MD5

              579a63bebccbacab8f14132f9fc31b89

              SHA1

              fca8a51077d352741a9c1ff8a493064ef5052f27

              SHA256

              0ac3504d5fa0460cae3c0fd9c4b628e1a65547a60563e6d1f006d17d5a6354b0

              SHA512

              4a58ca0f392187a483b9ef652b6e8b2e60d01daa5d331549df9f359d2c0a181e975cf9df79552e3474b9d77f8e37a1cf23725f32d4cdbe4885e257a7625f7b1f

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
              Filesize

              1.7MB

              MD5

              5659eba6a774f9d5322f249ad989114a

              SHA1

              4bfb12aa98a1dc2206baa0ac611877b815810e4c

              SHA256

              e04346fee15c3f98387a3641e0bba2e555a5a9b0200e4b9256b1b77094069ae4

              SHA512

              f93abf2787b1e06ce999a0cbc67dc787b791a58f9ce20af5587b2060d663f26be9f648d116d9ca279af39299ea5d38e3c86271297e47c1438102ca28fce8edc4

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
              Filesize

              1.7MB

              MD5

              5404286ec7853897b3ba00adf824d6c1

              SHA1

              39e543e08b34311b82f6e909e1e67e2f4afec551

              SHA256

              ec94a6666a3103ba6be60b92e843075a2d7fe7d30fa41099c3f3b1e2a5eba266

              SHA512

              c4b78298c42148d393feea6c3941c48def7c92ef0e6baac99144b083937d0a80d3c15bd9a0bf40daa60919968b120d62999fa61af320e507f7e99fbfe9b9ef30

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
              Filesize

              1.7MB

              MD5

              5eb39ba3698c99891a6b6eb036cfb653

              SHA1

              d2f1cdd59669f006a2f1aa9214aeed48bc88c06e

              SHA256

              e77f5e03ae140dda27d73e1ffe43f7911e006a108cf51cbd0e05d73aa92da7c2

              SHA512

              6c4ca20e88d49256ed9cabec0d1f2b00dfcf3d1603b5c95d158d4438c9f1e58495f8dfa200dbe7f49b5b0dd57886517eb3b98c4190484548720dad4b3db6069e

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_4.zip
              Filesize

              1.7MB

              MD5

              7187cc2643affab4ca29d92251c96dee

              SHA1

              ab0a4de90a14551834e12bb2c8c6b9ee517acaf4

              SHA256

              c7e92a1af295307fb92ad534e05fba879a7cf6716f93aefca0ebfcb8cee7a830

              SHA512

              27985d317a5c844871ffb2527d04aa50ef7442b2f00d69d5ab6bbb85cd7be1d7057ffd3151d0896f05603677c2f7361ed021eac921e012d74da049ef6949e3a3

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_5.zip
              Filesize

              1.7MB

              MD5

              b7d1e04629bec112923446fda5391731

              SHA1

              814055286f963ddaa5bf3019821cb8a565b56cb8

              SHA256

              4da77d4ee30ad0cd56cd620f4e9dc4016244ace015c5b4b43f8f37dd8e3a8789

              SHA512

              79fc3606b0fe6a1e31a2ecacc96623caf236bf2be692dadab6ea8ffa4af4231d782094a63b76631068364ac9b6a872b02f1e080636eba40ed019c2949a8e28db

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_6.zip
              Filesize

              1.7MB

              MD5

              0dc4014facf82aa027904c1be1d403c1

              SHA1

              5e6d6c020bfc2e6f24f3d237946b0103fe9b1831

              SHA256

              a29ddd29958c64e0af1a848409e97401307277bb6f11777b1cfb0404a6226de7

              SHA512

              cbeead189918657cc81e844ed9673ee8f743aed29ad9948e90afdfbecacc9c764fbdbfb92e8c8ceb5ae47cee52e833e386a304db0572c7130d1a54fd9c2cc028

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_7.zip
              Filesize

              3.3MB

              MD5

              cea368fc334a9aec1ecff4b15612e5b0

              SHA1

              493d23f72731bb570d904014ffdacbba2334ce26

              SHA256

              07e38cad68b0cdbea62f55f9bc6ee80545c2e1a39983baa222e8af788f028541

              SHA512

              bed35a1cc56f32e0109ea5a02578489682a990b5cefa58d7cf778815254af9849e731031e824adba07c86c8425df58a1967ac84ce004c62e316a2e51a75c8748

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\extracted\in.exe
              Filesize

              1.7MB

              MD5

              83d75087c9bf6e4f07c36e550731ccde

              SHA1

              d5ff596961cce5f03f842cfd8f27dde6f124e3ae

              SHA256

              46db3164bebffc61c201fe1e086bffe129ddfed575e6d839ddb4f9622963fb3f

              SHA512

              044e1f5507e92715ce9df8bb802e83157237a2f96f39bac3b6a444175f1160c4d82f41a0bcecf5feaf1c919272ed7929baef929a8c3f07deecebc44b0435164a

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\file.bin
              Filesize

              3.3MB

              MD5

              045b0a3d5be6f10ddf19ae6d92dfdd70

              SHA1

              0387715b6681d7097d372cd0005b664f76c933c7

              SHA256

              94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

              SHA512

              58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\main\main.bat
              Filesize

              440B

              MD5

              3626532127e3066df98e34c3d56a1869

              SHA1

              5fa7102f02615afde4efd4ed091744e842c63f78

              SHA256

              2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

              SHA512

              dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

              Download Submit

            • C:\Users\Admin\AppData\Local\Temp\tmpE4F1.tmp.bat
              Filesize

              286B

              MD5

              5ba7b2a3aa37399c4445e2a19b223c14

              SHA1

              de75f64a2234442ce8be22310e728033cb697758

              SHA256

              1a610e9eca285b148201247fcd730d3cab3c7520bf7c27a6e59a5656d74a4737

              SHA512

              093532320f66e9974dba8b14b4a707f8f4b266db9367ae1fff9b9ec2cdfc961786a0f94b1dc262ba1125b1206455c4c54b7fde035b4bc000a86c50f370b0ec72

              Download Submit

            • memory/636-92-0x000001E81E9B0000-0x000001E81EA1A000-memory.dmp

              Filesize

              424KB

              Download

            • memory/636-94-0x000001E81EA20000-0x000001E81EAD2000-memory.dmp

              Filesize

              712KB

              Download

            • memory/636-95-0x000001E81EAD0000-0x000001E81EB20000-memory.dmp

              Filesize

              320KB

              Download

            • memory/636-96-0x000001E804D10000-0x000001E804D32000-memory.dmp

              Filesize

              136KB

              Download

            • memory/636-98-0x000001E81F740000-0x000001E81F77A000-memory.dmp

              Filesize

              232KB

              Download

            • memory/636-99-0x000001E804CB0000-0x000001E804CD6000-memory.dmp

              Filesize

              152KB

              Download

            • memory/636-100-0x000001E81F780000-0x000001E81FAAE000-memory.dmp

              Filesize

              3.2MB

              Download

            • memory/636-120-0x000001E81F700000-0x000001E81F712000-memory.dmp

              Filesize

              72KB

              Download

            • memory/1080-331-0x0000000000EE0000-0x0000000001566000-memory.dmp

              Filesize

              6.5MB

              Download

            • memory/1080-326-0x0000000000EE0000-0x0000000001566000-memory.dmp

              Filesize

              6.5MB

              Download

            • memory/2036-400-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/2036-401-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/2668-426-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/2668-414-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/2668-412-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/3212-283-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/3212-281-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/3312-19-0x00000000001B1000-0x0000000000219000-memory.dmp

              Filesize

              416KB

              Download

            • memory/3312-3-0x00000000001B0000-0x00000000004BE000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/3312-1-0x0000000077354000-0x0000000077356000-memory.dmp

              Filesize

              8KB

              Download

            • memory/3312-0-0x00000000001B0000-0x00000000004BE000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/3312-17-0x00000000001B0000-0x00000000004BE000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/3312-4-0x00000000001B0000-0x00000000004BE000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/3312-2-0x00000000001B1000-0x0000000000219000-memory.dmp

              Filesize

              416KB

              Download

            • memory/3360-361-0x00000000004D0000-0x0000000000784000-memory.dmp

              Filesize

              2.7MB

              Download

            • memory/3360-360-0x00000000004D0000-0x0000000000784000-memory.dmp

              Filesize

              2.7MB

              Download

            • memory/3360-385-0x00000000004D0000-0x0000000000784000-memory.dmp

              Filesize

              2.7MB

              Download

            • memory/3360-354-0x00000000004D0000-0x0000000000784000-memory.dmp

              Filesize

              2.7MB

              Download

            • memory/3360-388-0x00000000004D0000-0x0000000000784000-memory.dmp

              Filesize

              2.7MB

              Download

            • memory/3404-52-0x000001AE38540000-0x000001AE385B6000-memory.dmp

              Filesize

              472KB

              Download

            • memory/3404-53-0x000001AE1E4A0000-0x000001AE1E4BE000-memory.dmp

              Filesize

              120KB

              Download

            • memory/3404-54-0x000001AE1E480000-0x000001AE1E48A000-memory.dmp

              Filesize

              40KB

              Download

            • memory/3404-47-0x000001AE1DAB0000-0x000001AE1E052000-memory.dmp

              Filesize

              5.6MB

              Download

            • memory/3404-46-0x00007FFBFC983000-0x00007FFBFC985000-memory.dmp

              Filesize

              8KB

              Download

            • memory/3828-247-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

              Download

            • memory/3828-245-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

              Download

            • memory/4004-278-0x0000000000400000-0x000000000064B000-memory.dmp

              Filesize

              2.3MB

              Download

            • memory/4228-87-0x0000000010000000-0x000000001001C000-memory.dmp

              Filesize

              112KB

              Download

            • memory/4228-279-0x0000000000400000-0x0000000000C85000-memory.dmp

              Filesize

              8.5MB

              Download

            • memory/4228-362-0x0000000000400000-0x0000000000C85000-memory.dmp

              Filesize

              8.5MB

              Download

            • memory/4228-76-0x0000000000400000-0x0000000000C85000-memory.dmp

              Filesize

              8.5MB

              Download

            • memory/4228-152-0x0000000000400000-0x0000000000C85000-memory.dmp

              Filesize

              8.5MB

              Download

            • memory/4228-333-0x0000000000400000-0x0000000000C85000-memory.dmp

              Filesize

              8.5MB

              Download

            • memory/4296-415-0x00007FF61D340000-0x00007FF61D7D0000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/4332-230-0x00007FF66BEB0000-0x00007FF66C340000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/4332-233-0x00007FF66BEB0000-0x00007FF66C340000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/4388-307-0x00007FF61D340000-0x00007FF61D7D0000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/4388-285-0x00007FF61D340000-0x00007FF61D7D0000-memory.dmp

              Filesize

              4.6MB

              Download

            • memory/4548-390-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

              Download

            • memory/4732-21-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-427-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-432-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-264-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-25-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-328-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-431-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-389-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-430-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-429-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-91-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-24-0x0000000000B11000-0x0000000000B79000-memory.dmp

              Filesize

              416KB

              Download

            • memory/4732-18-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-363-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-44-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-45-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-20-0x0000000000B11000-0x0000000000B79000-memory.dmp

              Filesize

              416KB

              Download

            • memory/4732-22-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-23-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-396-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-397-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4732-398-0x0000000000B10000-0x0000000000E1E000-memory.dmp

              Filesize

              3.1MB

              Download

            • memory/4744-294-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/4744-292-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/4744-286-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/4744-304-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/4744-288-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/4744-327-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/4744-289-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/4744-291-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/4744-306-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/4744-293-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/4744-287-0x0000000140000000-0x0000000140770000-memory.dmp

              Filesize

              7.4MB

              Download

            • memory/4744-305-0x0000000002480000-0x00000000024A0000-memory.dmp

              Filesize

              128KB

              Download