Overview

overview

10

Static

static

3

7439a1cdf0...04.exe

windows7-x64

10

7439a1cdf0...04.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    18-12-2024 16:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7439a1cdf0d05d91d25d3be874ee54557494af5f6b2fc3373654c87266828504.exe

  • Size

    2.9MB

  • MD5

    b406ea5a7e49fac393c76ae7902269db

  • SHA1

    b37dbbbe5b1aa93515c2347c328b372ef0149cbb

  • SHA256

    7439a1cdf0d05d91d25d3be874ee54557494af5f6b2fc3373654c87266828504

  • SHA512

    b495218372ffe3369a13def84318913638a96dba8295b77d23c821acb8ef4eca3c08beb45d0dd1a450ad339039b1f1589783fa58f3d495854d7081908e52c4e1

  • SSDEEP

    49152:A2FzteCwImhdzbDf9BzYJ7+zI8AJ/WWs:A2LeCwImhdzbDfTE7+x

Score
10/10
amadeylummastealc9c9aa5default_valencigafed3aacredential_accessdiscoveryevasionpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

Extracted

Family

lumma

C2

https://shineugler.biz/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 10 IoCs
    evasion
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 20 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 41 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 64 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 3 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 59 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1208
      • C:\Users\Admin\AppData\Local\Temp\7439a1cdf0d05d91d25d3be874ee54557494af5f6b2fc3373654c87266828504.exe
        "C:\Users\Admin\AppData\Local\Temp\7439a1cdf0d05d91d25d3be874ee54557494af5f6b2fc3373654c87266828504.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:604
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2820
          • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
            "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1284
            • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
              "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
              5⤵
              • Executes dropped EXE
              PID:2016
            • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
              "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2852
          • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
            "C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe"
            4⤵
            • Executes dropped EXE
            PID:1152
          • C:\Users\Admin\AppData\Local\Temp\1016974001\8aa2410bbb.exe
            "C:\Users\Admin\AppData\Local\Temp\1016974001\8aa2410bbb.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2912
            • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
              "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:1364
              • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
                "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Checks processor information in registry
                • Suspicious behavior: EnumeratesProcesses
                PID:996
              • C:\Users\Admin\AppData\Local\Temp\1001527001\legs.exe
                "C:\Users\Admin\AppData\Local\Temp\1001527001\legs.exe"
                6⤵
                • Executes dropped EXE
                PID:2164
              • C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe
                "C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:1668
                • C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
                  "C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2712
              • C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
                "C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:2896
                • C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe
                  "C:\Users\Admin\AppData\Local\Temp\fc9e0aaab7\defnur.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2540
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main
                    8⤵
                    • Blocklisted process makes network request
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:1112
              • C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe
                "C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                PID:2260
              • C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe
                "C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2056
                • C:\Users\Admin\AppData\Local\Temp\onefile_2056_133790142006578000\stub.exe
                  C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2876
              • C:\Users\Admin\AppData\Local\Temp\1006343001\goldddd123.exe
                "C:\Users\Admin\AppData\Local\Temp\1006343001\goldddd123.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2360
                • C:\Users\Admin\AppData\Local\Temp\1006343001\goldddd123.exe
                  "C:\Users\Admin\AppData\Local\Temp\1006343001\goldddd123.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:268
              • C:\Users\Admin\AppData\Local\Temp\1006591001\sintv.exe
                "C:\Users\Admin\AppData\Local\Temp\1006591001\sintv.exe"
                6⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1588
                • C:\Windows\System32\certutil.exe
                  "C:\Windows\System32\certutil.exe" -silent -importPFX -p "" -f "C:\Users\Admin\AppData\Local\Temp\tmpE217.tmp"
                  7⤵
                    PID:2384
                • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
                  "C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"
                  6⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:2356
                  • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
                    "C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe"
                    7⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies system certificate store
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2980
            • C:\Users\Admin\AppData\Local\Temp\1016981001\eb32880204.exe
              "C:\Users\Admin\AppData\Local\Temp\1016981001\eb32880204.exe"
              4⤵
              • Executes dropped EXE
              PID:1752
            • C:\Users\Admin\AppData\Local\Temp\1016982001\595125fdfd.exe
              "C:\Users\Admin\AppData\Local\Temp\1016982001\595125fdfd.exe"
              4⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2476
            • C:\Users\Admin\AppData\Local\Temp\1016983001\6a2682b058.exe
              "C:\Users\Admin\AppData\Local\Temp\1016983001\6a2682b058.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              PID:332
              • C:\Users\Admin\AppData\Local\Temp\1016983001\6a2682b058.exe
                "C:\Users\Admin\AppData\Local\Temp\1016983001\6a2682b058.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2900
            • C:\Users\Admin\AppData\Local\Temp\1016984001\a05a0f2358.exe
              "C:\Users\Admin\AppData\Local\Temp\1016984001\a05a0f2358.exe"
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2456
              • C:\Windows\system32\cmd.exe
                cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                5⤵
                • Loads dropped DLL
                PID:1820
                • C:\Windows\system32\mode.com
                  mode 65,10
                  6⤵
                    PID:352
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1492
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_7.zip -oextracted
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2400
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_6.zip -oextracted
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2496
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_5.zip -oextracted
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2280
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_4.zip -oextracted
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2480
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_3.zip -oextracted
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1704
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_2.zip -oextracted
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2796
                  • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                    7z.exe e extracted/file_1.zip -oextracted
                    6⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2892
                  • C:\Windows\system32\attrib.exe
                    attrib +H "in.exe"
                    6⤵
                    • Views/modifies file attributes
                    PID:2552
                  • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                    "in.exe"
                    6⤵
                    • Executes dropped EXE
                    PID:2752
                    • C:\Windows\system32\attrib.exe
                      attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      7⤵
                      • Views/modifies file attributes
                      PID:2296
                    • C:\Windows\system32\attrib.exe
                      attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                      7⤵
                      • Views/modifies file attributes
                      PID:2864
                    • C:\Windows\system32\schtasks.exe
                      schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                      7⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:2368
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell ping 127.0.0.1; del in.exe
                      7⤵
                      • System Network Configuration Discovery: Internet Connection Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1564
                      • C:\Windows\system32\PING.EXE
                        "C:\Windows\system32\PING.EXE" 127.0.0.1
                        8⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Runs ping.exe
                        PID:1688
              • C:\Users\Admin\AppData\Local\Temp\1016985001\090e24763f.exe
                "C:\Users\Admin\AppData\Local\Temp\1016985001\090e24763f.exe"
                4⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1560
              • C:\Users\Admin\AppData\Local\Temp\1016986001\60108cce6a.exe
                "C:\Users\Admin\AppData\Local\Temp\1016986001\60108cce6a.exe"
                4⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1324
                • C:\Users\Admin\AppData\Local\Temp\TR3EY4DZ0CU5PA7YJIL.exe
                  "C:\Users\Admin\AppData\Local\Temp\TR3EY4DZ0CU5PA7YJIL.exe"
                  5⤵
                  • Modifies Windows Defender Real-time Protection settings
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Windows security modification
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1716
                • C:\Users\Admin\AppData\Local\Temp\TXEEO9MLKHULLBBS9R.exe
                  "C:\Users\Admin\AppData\Local\Temp\TXEEO9MLKHULLBBS9R.exe"
                  5⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:900
          • C:\Windows\SysWOW64\dialer.exe
            "C:\Windows\system32\dialer.exe"
            2⤵
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:2488
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {5C056CA6-A6EF-4062-A6EF-7116310DAFF0} S-1-5-21-3063565911-2056067323-3330884624-1000:KHBTHJFA\Admin:Interactive:[1]
          1⤵
          • Loads dropped DLL
          PID:1128
          • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
            C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            PID:2148
            • C:\Windows\explorer.exe
              explorer.exe
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:856
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
              3⤵
              • Drops file in System32 directory
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2224
              • C:\Windows\system32\PING.EXE
                "C:\Windows\system32\PING.EXE" 127.1.10.1
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:768
          • C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
            C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
            2⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            PID:2084
            • C:\Windows\explorer.exe
              explorer.exe
              3⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1956
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell ping 127.1.10.1; del Intel_PTT_EK_Recertification.exe
              3⤵
              • Drops file in System32 directory
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:944
              • C:\Windows\system32\PING.EXE
                "C:\Windows\system32\PING.EXE" 127.1.10.1
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:896

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Hide Artifacts

        1
        T1564

        Hidden Files and Directories

        1
        T1564.001

        Impair Defenses

        2
        T1562

        Disable or Modify Tools

        2
        T1562.001

        Modify Registry

        4
        T1112

        Subvert Trust Controls

        1
        T1553

        Install Root Certificate

        1
        T1553.004

        Virtualization/Sandbox Evasion

        3
        T1497

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        5
        T1552

        Credentials In Files

        5
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        Query Registry

        7
        T1012

        Remote System Discovery

        1
        T1018

        System Information Discovery

        4
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Internet Connection Discovery

        1
        T1016.001

        Virtualization/Sandbox Evasion

        3
        T1497

        Lateral Movement

        Collection

        Data from Local System

        4
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
          Filesize

          307KB

          MD5

          68a99cf42959dc6406af26e91d39f523

          SHA1

          f11db933a83400136dc992820f485e0b73f1b933

          SHA256

          c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

          SHA512

          7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1001527001\legs.exe
          Filesize

          758KB

          MD5

          75cf470500d65ce4411790e09e650806

          SHA1

          91aca1838bc6e3868d25e44308f58124b749167d

          SHA256

          f29a920dd390574c50df03e8f909a8f81a1894af912af2d92a9baf4b57cf1c04

          SHA512

          1c281fe53742a338becb9aa4efd2a7e418a66949a7f3d156440e02e2351548f6ff0ead5d93aae157509f57d0b4cc3584a9ab623c6446ea389b45b49d0df85c48

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1003013001\AllNew.exe
          Filesize

          429KB

          MD5

          c07e06e76de584bcddd59073a4161dbb

          SHA1

          08954ac6f6cf51fd5d9d034060a9ae25a8448971

          SHA256

          cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9

          SHA512

          e92c9fcd0448591738daedb19e8225ff05da588b48d1f15479ec8af62acd3ea52b5d4ba3e3b0675c2aa1705185f5523dcafdf14137c6e2984588069a2e05309f

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1004899001\am209.exe
          Filesize

          429KB

          MD5

          ce27255f0ef33ce6304e54d171e6547c

          SHA1

          e594c6743d869c852bf7a09e7fe8103b25949b6e

          SHA256

          82c683a7f6e0b4a99a6d3ab519d539a3b0651953c7a71f5309b9d08e4daa7c3c

          SHA512

          96cfafbab9138517532621d0b5f3d4a529806cfdf6191c589e6fb6ebf471e9df0777fb74e9abbfe4e8cd8821944ad02b1f09775195e190ee8ca5d3fd151d20d9

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1005242001\v_dolg.exe
          Filesize

          3.6MB

          MD5

          378706614b22957208e09fc84fceece8

          SHA1

          d35e1f89f36aed26553b665f791cd69d82136fb8

          SHA256

          df6e6d5bead4aa34f8e0dd325400a5829265b0f615cd1da48d155cc30b89ad6d

          SHA512

          bef7a09ce1ffd0a0b169a6ec7c143ca322c929139ca0af40353502ae22fed455fe10a9b80ba93cc399a88add94f921b7aa801033ddae351f8f8d477781ca476e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1006252001\roblox.exe
          Filesize

          10.7MB

          MD5

          6898eace70e2da82f257bc78cb081b2f

          SHA1

          5ac5ed21436d8b4c59c0b62836d531844c571d6d

          SHA256

          bcdd8b7c9ec736765d4596332c0fec1334b035d4456df1ec25b569f9b6431a23

          SHA512

          ca719707417a095fe092837e870aefc7e8874ef351e27b5b41e40f46a9e2f6cb2ba915858bc3c99a14c2f1288c71c7ddd9c2adee6588d6b43cd3ba276e1585d2

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1006591001\sintv.exe
          Filesize

          4.5MB

          MD5

          38fcaa23700e62fb0b3fc2591f82cc80

          SHA1

          abedd6ec573a6fede05d15920f3ac3763062c75c

          SHA256

          fb829a6a8535a443932cd167e8301b5e74c60702b5f7fade7e9f13a736ce72b0

          SHA512

          5da88a61c716a9891cb225f36f275040d69915c4c731c2a5c042d5c997ca39241a3e9d6646569468d477f47db42462c21b58f2de7f56a84cb145e6cee478eeef

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1006664001\Out.exe
          Filesize

          2.5MB

          MD5

          7ff947867bc70055adffa2164a741b01

          SHA1

          cff424168c2f6bcef107ebc9bd65590f3ead76ae

          SHA256

          b6d6628d2dc7dea808eef05180c27abe10a1af245d624aacdacccc52a1eb7b40

          SHA512

          da507d1847056d0dc2c122c45ecbea4901a81c06890bcdbffc2f18ad4b96f0ac2c2fa9ebde1a315828c74a97af653062a8c50ce70c9b6d6966c48871150747ee

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
          Filesize

          3.1MB

          MD5

          f9b9f98592292b5cbf59c7a60e9ebaee

          SHA1

          59cc872fd0a11b259cc5b70893f35e9b5a7c8cbb

          SHA256

          5688e9e0becc622c573af2a1af4ee0676ef3907e38a9258a7801b46b7ad64665

          SHA512

          f27e4a96173aeb064f47d44ff445b1e15f6d4f39a4ad711c019bb29692caea56eb910970d22bc13ac5c57a256d71e77b12aa60c8405335a239781c57cb0eaf8e

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
          Filesize

          17.6MB

          MD5

          3c224e3fc892719dc1e302378e533579

          SHA1

          0a65062e1426a95bfeca355398b6fdc4912fb6b1

          SHA256

          64cc7f7906fe1ebf0b6977892abd9aa36f5e525cb241964c3986ee9e1a18312d

          SHA512

          554a26e9654eccce831e4adcee49d5e2507956935e562b134a86f332d867debfcd1f64fdb88fccb2e1eee810975d565dbc6ea1376516817ee38765e4bd733a49

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1016974001\8aa2410bbb.exe
          Filesize

          2.9MB

          MD5

          adb82f61953bedf4b2eda53ca8e26ed7

          SHA1

          905dd9713e5dc58f0f4e1a5c36dc76c42823e734

          SHA256

          7f7d4d11aa9ce238909c3f93f50e46ff9296860da623022a0f3d37d3ca1dd0e8

          SHA512

          17a427293b613bb4e8f1709e0153528a26aebc608c8b4e2a13e1ca72efa8b7da9c7086a8c7cf5ad416e52125879fb30f87b0232b8b3e2324c663b1f9efe315d8

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1016981001\eb32880204.exe
          Filesize

          758KB

          MD5

          afd936e441bf5cbdb858e96833cc6ed3

          SHA1

          3491edd8c7caf9ae169e21fb58bccd29d95aefef

          SHA256

          c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

          SHA512

          928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1016982001\595125fdfd.exe
          Filesize

          1.9MB

          MD5

          e7eb9a61aec1e191dcc006e605c7628e

          SHA1

          f931ceab7be44e9efb12b7ff292e0227eadebce2

          SHA256

          0428284ddb962526e13dcf1be7707e0ce1acfcca7eba4dc33a03dc8503c03253

          SHA512

          73856a2a132ea5786860d07b36bd3293facc0562f2b630a08036932331d1e91417e87753815c25d534fa2eb0f6d76e8039a3af6eb407294711eae5bb0b1a1ba5

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1016983001\6a2682b058.exe
          Filesize

          747KB

          MD5

          8a9cb17c0224a01bd34b46495983c50a

          SHA1

          00296ea6a56f6e10a0f1450a20c5fb329b8856c1

          SHA256

          3d51b9523b387859bc0d94246dfb216cfa82f9d650c8d11be11ed67f70e7440b

          SHA512

          1472e4670f469c43227b965984ecc223a526f6284363d8e08a3b5b55e602ccce62df4bc49939ee5bd7df7b0c26e20da896b084eccab767f8728e6bf14d71c840

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1016984001\a05a0f2358.exe
          Filesize

          4.2MB

          MD5

          3a425626cbd40345f5b8dddd6b2b9efa

          SHA1

          7b50e108e293e54c15dce816552356f424eea97a

          SHA256

          ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

          SHA512

          a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1016985001\090e24763f.exe
          Filesize

          4.2MB

          MD5

          8841698b335573b0abe7875b85b653d6

          SHA1

          e74926dcb5b7e996d4f4961a763d2c4d8e8e24d0

          SHA256

          490fc3ac1830a381350813ad614c258eb761886aad612879a592461edffd719b

          SHA512

          2f8941aaf2724687e70f4c742ac2f3a2009df18776d8e182a3042eb33422463df109e1e666d8f8a66cd7f6312e86aa9dd4a127c5559e04cbd57a6da51077e037

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\1016986001\60108cce6a.exe
          Filesize

          1.8MB

          MD5

          ab319afa60cadbafd45f46b07484fd03

          SHA1

          3bba5171e2e000c0e4c3e33ae1b20ba96e28fb0d

          SHA256

          68f4cfa9038f190598f1e5fe4b2d069ce63e01d1133c2845ee8cacb97798ee2b

          SHA512

          612ed711a96bfb8dd0c87cfef531bb6bc20aa675194c1403c05f1aa4745e3e3b28bcb8f33d639977367d090cba1948cc211af25df3c8bc09db93bb119eb3aba5

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\CabCA43.tmp
          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\TR3EY4DZ0CU5PA7YJIL.exe
          Filesize

          1.7MB

          MD5

          4b286a4c9eeff77633d1569f9a4def47

          SHA1

          26a5f3284d3a6226087d9f912f8244842e1aed5e

          SHA256

          1f8fda9aaebda90ca930eb9a5fda2da3c4d5571acb0ef5bd9ab0af46edd0acc7

          SHA512

          341eb09b0d0c757f9e85ad392a43a0ad565e02b8b21b0bbd57b1385fb3a9e2965ceb28db5fa65eeb09b09ca8e47e10f4533808d98bb56311fccb1324a79809ae

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\TXEEO9MLKHULLBBS9R.exe
          Filesize

          2.8MB

          MD5

          53255a4e52bac509d13e48fe99717cb0

          SHA1

          763d5cf8a29bad2c20eb0270392e02426afe8e82

          SHA256

          86c5ad704dccd2f1a4175b66e019550a68ebcd538ef9ad6f9aee743a613940af

          SHA512

          5a1a5fad42a71a6bc795f82ab29a025e5b5076310cbbfa5fb845af5cd9149348c523493bf3d675a9941019a05eddd108a4601cf77ca6b8f8e7fd74cba244fb1d

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\TarCAD3.tmp
          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\TmpE090.tmp
          Filesize

          2KB

          MD5

          8214f636b7423574f72ce3726c840052

          SHA1

          fed489fc4e4c46b197074148ac838a172f5f8d1c

          SHA256

          f2225f84b9d08fa84011f8b974833abd17e292223ee0b1839ce8203f30bb9b2e

          SHA512

          c3b1b8712c21a6a2ebae139a18e2898333ed3a432b0aeb1ed5f0df6a6420e6c9335a80f7be6bf077f7cbd1156388e39a873b49cce3210303043276b81ae37d52

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\main\file.bin
          Filesize

          3.3MB

          MD5

          045b0a3d5be6f10ddf19ae6d92dfdd70

          SHA1

          0387715b6681d7097d372cd0005b664f76c933c7

          SHA256

          94b392e94fa47d1b9b7ae6a29527727268cc2e3484e818c23608f8835bc1104d

          SHA512

          58255a755531791b888ffd9b663cc678c63d5caa932260e9546b1b10a8d54208334725c14529116b067bcf5a5e02da85e015a3bed80092b7698a43dab0168c7b

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\main\main.bat
          Filesize

          440B

          MD5

          3626532127e3066df98e34c3d56a1869

          SHA1

          5fa7102f02615afde4efd4ed091744e842c63f78

          SHA256

          2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

          SHA512

          dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HHT8UDCABBDOCKCCNFTW.temp
          Filesize

          7KB

          MD5

          5424ed4fb89180a0a72004e983a82a80

          SHA1

          69e2cf799718620f1611e02ff285d805f292e541

          SHA256

          ffddd7077cdb9148d83a01216ac3520cf009c230bb562def2a2817237fc1c636

          SHA512

          955f17378bffc1883fe592e4d3340f810243f076676e049d6738a7b3de5d4826c7d89d3a2e36ed4ae0847bbbac3575b423a3057736f1e793c1ff6a4bb60604f6

          Download Submit

        • C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll
          Filesize

          124KB

          MD5

          0d3418372c854ee228b78e16ea7059be

          SHA1

          c0a29d4e74d39308a50f4fd21d0cca1f98cb02c1

          SHA256

          885bf0b3b12b77ef3f953fbb48def1b45079faa2a4d574ee16afdbafa1de3ac7

          SHA512

          e30dced307e04ae664367a998cd1ba36349e99e363f70897b5d90c898de2c69c393182c3afba63a74956b5e6f49f0635468e88ed31dd1e3c86c21e987ddd2c19

          Download Submit

        • \ProgramData\mozglue.dll
          Filesize

          593KB

          MD5

          c8fd9be83bc728cc04beffafc2907fe9

          SHA1

          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

          SHA256

          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

          SHA512

          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

          Download Submit

        • \ProgramData\nss3.dll
          Filesize

          2.0MB

          MD5

          1cc453cdf74f31e4d913ff9c10acdde2

          SHA1

          6e85eae544d6e965f15fa5c39700fa7202f3aafe

          SHA256

          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

          SHA512

          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

          Download Submit

        • \Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          Filesize

          2.9MB

          MD5

          b406ea5a7e49fac393c76ae7902269db

          SHA1

          b37dbbbe5b1aa93515c2347c328b372ef0149cbb

          SHA256

          7439a1cdf0d05d91d25d3be874ee54557494af5f6b2fc3373654c87266828504

          SHA512

          b495218372ffe3369a13def84318913638a96dba8295b77d23c821acb8ef4eca3c08beb45d0dd1a450ad339039b1f1589783fa58f3d495854d7081908e52c4e1

          Download Submit

        • \Users\Admin\AppData\Local\Temp\main\7z.exe
          Filesize

          458KB

          MD5

          619f7135621b50fd1900ff24aade1524

          SHA1

          6c7ea8bbd435163ae3945cbef30ef6b9872a4591

          SHA256

          344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

          SHA512

          2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

          Download Submit

        • memory/604-0-0x0000000000AC0000-0x0000000000DE0000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/604-16-0x00000000067F0000-0x0000000006B10000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/604-18-0x00000000067F0000-0x0000000006B10000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/604-22-0x0000000000AC0000-0x0000000000DE0000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/604-5-0x0000000000AC0000-0x0000000000DE0000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/604-4-0x0000000000AC0000-0x0000000000DE0000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/604-3-0x0000000000AC0000-0x0000000000DE0000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/604-2-0x0000000000AC1000-0x0000000000AEF000-memory.dmp

          Filesize

          184KB

          Download

        • memory/604-1-0x0000000077410000-0x0000000077412000-memory.dmp

          Filesize

          8KB

          Download

        • memory/944-757-0x0000000001E90000-0x0000000001E98000-memory.dmp

          Filesize

          32KB

          Download

        • memory/944-756-0x000000001B610000-0x000000001B8F2000-memory.dmp

          Filesize

          2.9MB

          Download

        • memory/996-118-0x0000000000FD0000-0x0000000001231000-memory.dmp

          Filesize

          2.4MB

          Download

        • memory/996-349-0x0000000000FD0000-0x0000000001231000-memory.dmp

          Filesize

          2.4MB

          Download

        • memory/996-220-0x0000000061E00000-0x0000000061EF3000-memory.dmp

          Filesize

          972KB

          Download

        • memory/1128-683-0x000000013FA70000-0x000000013FF00000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/1128-447-0x000000013FA70000-0x000000013FF00000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/1128-446-0x000000013FA70000-0x000000013FF00000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/1152-60-0x0000000000330000-0x00000000014C6000-memory.dmp

          Filesize

          17.6MB

          Download

        • memory/1284-303-0x0000000000510000-0x0000000000532000-memory.dmp

          Filesize

          136KB

          Download

        • memory/1284-43-0x0000000000820000-0x0000000000B40000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/1284-301-0x0000000005480000-0x00000000055D6000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/1364-736-0x0000000006610000-0x0000000006871000-memory.dmp

          Filesize

          2.4MB

          Download

        • memory/1364-297-0x0000000006D30000-0x000000000757D000-memory.dmp

          Filesize

          8.3MB

          Download

        • memory/1364-97-0x0000000001340000-0x000000000166B000-memory.dmp

          Filesize

          3.2MB

          Download

        • memory/1364-365-0x0000000006D30000-0x000000000757D000-memory.dmp

          Filesize

          8.3MB

          Download

        • memory/1364-117-0x0000000006610000-0x0000000006871000-memory.dmp

          Filesize

          2.4MB

          Download

        • memory/1364-364-0x0000000001340000-0x000000000166B000-memory.dmp

          Filesize

          3.2MB

          Download

        • memory/1364-243-0x0000000001340000-0x000000000166B000-memory.dmp

          Filesize

          3.2MB

          Download

        • memory/1364-116-0x0000000006610000-0x0000000006871000-memory.dmp

          Filesize

          2.4MB

          Download

        • memory/1364-289-0x0000000001340000-0x000000000166B000-memory.dmp

          Filesize

          3.2MB

          Download

        • memory/1564-445-0x00000000027A0000-0x00000000027A8000-memory.dmp

          Filesize

          32KB

          Download

        • memory/1564-444-0x000000001B720000-0x000000001BA02000-memory.dmp

          Filesize

          2.9MB

          Download

        • memory/1588-610-0x0000000000BA0000-0x0000000001030000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/1716-711-0x0000000000140000-0x00000000005AC000-memory.dmp

          Filesize

          4.4MB

          Download

        • memory/1716-709-0x0000000000140000-0x00000000005AC000-memory.dmp

          Filesize

          4.4MB

          Download

        • memory/1820-435-0x000000013F550000-0x000000013F9E0000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/1820-612-0x000000013F550000-0x000000013F9E0000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/1820-436-0x000000013F550000-0x000000013F9E0000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/2148-448-0x000000013FA70000-0x000000013FF00000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/2148-468-0x000000013FA70000-0x000000013FF00000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/2260-336-0x0000000000400000-0x0000000000C4D000-memory.dmp

          Filesize

          8.3MB

          Download

        • memory/2260-346-0x0000000000400000-0x0000000000C4D000-memory.dmp

          Filesize

          8.3MB

          Download

        • memory/2260-381-0x0000000000400000-0x0000000000C4D000-memory.dmp

          Filesize

          8.3MB

          Download

        • memory/2260-345-0x0000000000400000-0x0000000000C4D000-memory.dmp

          Filesize

          8.3MB

          Download

        • memory/2260-609-0x0000000000400000-0x0000000000C4D000-memory.dmp

          Filesize

          8.3MB

          Download

        • memory/2260-307-0x0000000000400000-0x0000000000C4D000-memory.dmp

          Filesize

          8.3MB

          Download

        • memory/2260-299-0x0000000000400000-0x0000000000C4D000-memory.dmp

          Filesize

          8.3MB

          Download

        • memory/2476-248-0x0000000004C10000-0x0000000005010000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/2476-247-0x0000000004C10000-0x0000000005010000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/2476-251-0x0000000074E80000-0x0000000074EC7000-memory.dmp

          Filesize

          284KB

          Download

        • memory/2476-219-0x0000000000110000-0x00000000005E0000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2476-256-0x0000000000110000-0x00000000005E0000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2476-249-0x0000000077220000-0x00000000773C9000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/2488-261-0x0000000074E80000-0x0000000074EC7000-memory.dmp

          Filesize

          284KB

          Download

        • memory/2488-259-0x0000000077220000-0x00000000773C9000-memory.dmp

          Filesize

          1.7MB

          Download

        • memory/2488-258-0x0000000001B80000-0x0000000001F80000-memory.dmp

          Filesize

          4.0MB

          Download

        • memory/2488-254-0x0000000000080000-0x000000000008A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/2752-439-0x000000013F550000-0x000000013F9E0000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/2752-437-0x000000013F550000-0x000000013F9E0000-memory.dmp

          Filesize

          4.6MB

          Download

        • memory/2820-109-0x0000000001030000-0x0000000001350000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2820-77-0x0000000006160000-0x000000000648B000-memory.dmp

          Filesize

          3.2MB

          Download

        • memory/2820-21-0x0000000001030000-0x0000000001350000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2820-25-0x0000000001030000-0x0000000001350000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2820-175-0x0000000006160000-0x000000000648B000-memory.dmp

          Filesize

          3.2MB

          Download

        • memory/2820-382-0x0000000001030000-0x0000000001350000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2820-24-0x0000000001030000-0x0000000001350000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2820-300-0x0000000001030000-0x0000000001350000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2820-23-0x0000000001031000-0x000000000105F000-memory.dmp

          Filesize

          184KB

          Download

        • memory/2820-218-0x0000000006890000-0x0000000006D60000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2820-27-0x0000000001030000-0x0000000001350000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2820-28-0x0000000001030000-0x0000000001350000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2820-217-0x0000000006890000-0x0000000006D60000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2820-44-0x0000000001030000-0x0000000001350000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2820-45-0x0000000001030000-0x0000000001350000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2820-46-0x0000000001030000-0x0000000001350000-memory.dmp

          Filesize

          3.1MB

          Download

        • memory/2820-343-0x0000000006890000-0x0000000006D60000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2820-78-0x0000000006160000-0x000000000648B000-memory.dmp

          Filesize

          3.2MB

          Download

        • memory/2820-344-0x0000000006890000-0x0000000006D60000-memory.dmp

          Filesize

          4.8MB

          Download

        • memory/2852-319-0x0000000000400000-0x0000000000456000-memory.dmp

          Filesize

          344KB

          Download

        • memory/2852-332-0x0000000000400000-0x0000000000456000-memory.dmp

          Filesize

          344KB

          Download

        • memory/2852-327-0x0000000000400000-0x0000000000456000-memory.dmp

          Filesize

          344KB

          Download

        • memory/2852-329-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2852-325-0x0000000000400000-0x0000000000456000-memory.dmp

          Filesize

          344KB

          Download

        • memory/2852-323-0x0000000000400000-0x0000000000456000-memory.dmp

          Filesize

          344KB

          Download

        • memory/2852-321-0x0000000000400000-0x0000000000456000-memory.dmp

          Filesize

          344KB

          Download

        • memory/2852-330-0x0000000000400000-0x0000000000456000-memory.dmp

          Filesize

          344KB

          Download

        • memory/2900-350-0x0000000000400000-0x0000000000455000-memory.dmp

          Filesize

          340KB

          Download

        • memory/2900-358-0x0000000000400000-0x0000000000455000-memory.dmp

          Filesize

          340KB

          Download

        • memory/2900-352-0x0000000000400000-0x0000000000455000-memory.dmp

          Filesize

          340KB

          Download

        • memory/2900-363-0x0000000000400000-0x0000000000455000-memory.dmp

          Filesize

          340KB

          Download

        • memory/2900-361-0x0000000000400000-0x0000000000455000-memory.dmp

          Filesize

          340KB

          Download

        • memory/2900-360-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2900-354-0x0000000000400000-0x0000000000455000-memory.dmp

          Filesize

          340KB

          Download

        • memory/2900-356-0x0000000000400000-0x0000000000455000-memory.dmp

          Filesize

          340KB

          Download

        • memory/2912-216-0x00000000066D0000-0x00000000069FB000-memory.dmp

          Filesize

          3.2MB

          Download

        • memory/2912-79-0x00000000001B0000-0x00000000004DB000-memory.dmp

          Filesize

          3.2MB

          Download

        • memory/2912-93-0x00000000066D0000-0x00000000069FB000-memory.dmp

          Filesize

          3.2MB

          Download

        • memory/2912-95-0x00000000066D0000-0x00000000069FB000-memory.dmp

          Filesize

          3.2MB

          Download

        • memory/2912-94-0x00000000001B0000-0x00000000004DB000-memory.dmp

          Filesize

          3.2MB

          Download