Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2d7162fd5c...6f.exe

windows7-x64

10

2d7162fd5c...6f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/12/2024, 02:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2d7162fd5c1c73fae8b484ff0f467f125446448342f217adb95944ffbca2916f.exe

  • Size

    2.9MB

  • MD5

    d7d1046efd8b7b38c0d01767bfc7a7cb

  • SHA1

    7296ffd07d7f26e142a56a83146cbc873ac8f2a2

  • SHA256

    2d7162fd5c1c73fae8b484ff0f467f125446448342f217adb95944ffbca2916f

  • SHA512

    edf21de575b5cca0afafc97261935533d54c3fa1b6cd0b50fddd074d7db3020a8f13ab9b289d29100de3e2119f029300dbff1f84d3ebf7f2d777b549e50736ca

  • SSDEEP

    49152:IJ01Z+B4sOfKbmJfnwNxjbZugO+Vyk7b2eRMHhg3psW:IJ0zQ4sKKbinwNLugO+VyouSZsW

Score
10/10
amadeycryptbotlummastealc9c9aa5fed3aastokdiscoveryevasionexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

cryptbot

Extracted

Family

lumma

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Cryptbot family
    cryptbot
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Stealc family
    stealc
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Enumerates VirtualBox registry keys 2 TTPs 3 IoCs
    evasion
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 17 IoCs
    evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 34 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 35 IoCs
  • Identifies Wine through registry keys 2 TTPs 17 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 57 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 31 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1232
      • C:\Users\Admin\AppData\Local\Temp\2d7162fd5c1c73fae8b484ff0f467f125446448342f217adb95944ffbca2916f.exe
        "C:\Users\Admin\AppData\Local\Temp\2d7162fd5c1c73fae8b484ff0f467f125446448342f217adb95944ffbca2916f.exe"
        2⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2444
        • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
          "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2724
          • C:\Users\Admin\AppData\Local\Temp\1007336001\12cdc5fd27.exe
            "C:\Users\Admin\AppData\Local\Temp\1007336001\12cdc5fd27.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:848
          • C:\Users\Admin\AppData\Local\Temp\1007337001\a2423dabcd.exe
            "C:\Users\Admin\AppData\Local\Temp\1007337001\a2423dabcd.exe"
            4⤵
            • Suspicious use of NtCreateUserProcessOtherParentProcess
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1864
          • C:\Users\Admin\AppData\Local\Temp\1007338001\460db93e31.exe
            "C:\Users\Admin\AppData\Local\Temp\1007338001\460db93e31.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Loads dropped DLL
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1516
            • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
              "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Loads dropped DLL
              • Adds Run key to start application
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2232
              • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
                "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2644
                • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
                  "C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2696
              • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
                "C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe"
                6⤵
                • Executes dropped EXE
                PID:1996
              • C:\Users\Admin\AppData\Local\Temp\1016974001\8c4176494d.exe
                "C:\Users\Admin\AppData\Local\Temp\1016974001\8c4176494d.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:304
              • C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe
                "C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                PID:1584
              • C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe
                "C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:2996
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\dzvjaznkg"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2012
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2352
              • C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe
                "C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:680
              • C:\Users\Admin\AppData\Local\Temp\1017279001\0a6cc2158d.exe
                "C:\Users\Admin\AppData\Local\Temp\1017279001\0a6cc2158d.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2496
                • C:\Users\Admin\AppData\Local\Temp\1017279001\0a6cc2158d.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017279001\0a6cc2158d.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2696
              • C:\Users\Admin\AppData\Local\Temp\1017280001\f900ddb2d8.exe
                "C:\Users\Admin\AppData\Local\Temp\1017280001\f900ddb2d8.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1656
              • C:\Users\Admin\AppData\Local\Temp\1017281001\447266401a.exe
                "C:\Users\Admin\AppData\Local\Temp\1017281001\447266401a.exe"
                6⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2164
              • C:\Users\Admin\AppData\Local\Temp\1017282001\b53b92b055.exe
                "C:\Users\Admin\AppData\Local\Temp\1017282001\b53b92b055.exe"
                6⤵
                • Enumerates VirtualBox registry keys
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:264
              • C:\Users\Admin\AppData\Local\Temp\1017283001\ee69ca2cf4.exe
                "C:\Users\Admin\AppData\Local\Temp\1017283001\ee69ca2cf4.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1148
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\kzfnlct"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1868
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2364
              • C:\Users\Admin\AppData\Local\Temp\1017284001\d30c4878fe.exe
                "C:\Users\Admin\AppData\Local\Temp\1017284001\d30c4878fe.exe"
                6⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:1292
              • C:\Users\Admin\AppData\Local\Temp\1017285001\32c68ad5e9.exe
                "C:\Users\Admin\AppData\Local\Temp\1017285001\32c68ad5e9.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:2552
                • C:\Users\Admin\AppData\Local\Temp\1017285001\32c68ad5e9.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017285001\32c68ad5e9.exe"
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1524
              • C:\Users\Admin\AppData\Local\Temp\1017286001\c1e58b6654.exe
                "C:\Users\Admin\AppData\Local\Temp\1017286001\c1e58b6654.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:692
                • C:\Windows\system32\cmd.exe
                  cmd /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
                  7⤵
                  • Loads dropped DLL
                  PID:2984
                  • C:\Windows\system32\mode.com
                    mode 65,10
                    8⤵
                      PID:1484
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e file.zip -p24291711423417250691697322505 -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3020
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_7.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3028
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_6.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2312
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_5.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1740
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_4.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2016
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_3.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1416
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_2.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:996
                    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
                      7z.exe e extracted/file_1.zip -oextracted
                      8⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of AdjustPrivilegeToken
                      PID:916
                    • C:\Windows\system32\attrib.exe
                      attrib +H "in.exe"
                      8⤵
                      • Views/modifies file attributes
                      PID:884
                    • C:\Users\Admin\AppData\Local\Temp\main\in.exe
                      "in.exe"
                      8⤵
                      • Executes dropped EXE
                      PID:2256
                      • C:\Windows\system32\attrib.exe
                        attrib +H +S C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        9⤵
                        • Views/modifies file attributes
                        PID:2128
                      • C:\Windows\system32\attrib.exe
                        attrib +H C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe
                        9⤵
                        • Views/modifies file attributes
                        PID:1888
                      • C:\Windows\system32\schtasks.exe
                        schtasks /f /CREATE /TN "Intel_PTT_EK_Recertification" /TR "C:\Users\Admin\AppData\Roaming\Intel_PTT_EK_Recertification.exe" /SC MINUTE
                        9⤵
                        • Scheduled Task/Job: Scheduled Task
                        PID:1968
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell ping 127.0.0.1; del in.exe
                        9⤵
                        • System Network Configuration Discovery: Internet Connection Discovery
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1900
                        • C:\Windows\system32\PING.EXE
                          "C:\Windows\system32\PING.EXE" 127.0.0.1
                          10⤵
                          • System Network Configuration Discovery: Internet Connection Discovery
                          • Runs ping.exe
                          PID:2424
                • C:\Users\Admin\AppData\Local\Temp\1017287001\e8cba4c5ff.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017287001\e8cba4c5ff.exe"
                  6⤵
                  • Enumerates VirtualBox registry keys
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:2928
                • C:\Users\Admin\AppData\Local\Temp\1017288001\633e0bbd23.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017288001\633e0bbd23.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:2156
                • C:\Users\Admin\AppData\Local\Temp\1017289001\5ce4fd0b11.exe
                  "C:\Users\Admin\AppData\Local\Temp\1017289001\5ce4fd0b11.exe"
                  6⤵
                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                  • Checks BIOS information in registry
                  • Executes dropped EXE
                  • Identifies Wine through registry keys
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  • System Location Discovery: System Language Discovery
                  PID:1144
            • C:\Users\Admin\AppData\Local\Temp\1007339001\3e76b3ea55.exe
              "C:\Users\Admin\AppData\Local\Temp\1007339001\3e76b3ea55.exe"
              4⤵
              • Enumerates VirtualBox registry keys
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:2592
        • C:\Windows\SysWOW64\dialer.exe
          "C:\Windows\system32\dialer.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2144
        • C:\Windows\SysWOW64\dialer.exe
          "C:\Windows\system32\dialer.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1548

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Command and Scripting Interpreter

      1
      T1059

      PowerShell

      1
      T1059.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Scheduled Task/Job

      1
      T1053

      Scheduled Task

      1
      T1053.005

      Defense Evasion

      Hide Artifacts

      1
      T1564

      Hidden Files and Directories

      1
      T1564.001

      Modify Registry

      2
      T1112

      Subvert Trust Controls

      1
      T1553

      Install Root Certificate

      1
      T1553.004

      Virtualization/Sandbox Evasion

      3
      T1497

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      3
      T1552.001

      Discovery

      Browser Information Discovery

      1
      T1217

      Query Registry

      6
      T1012

      Remote System Discovery

      1
      T1018

      System Information Discovery

      2
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      System Network Configuration Discovery

      1
      T1016

      Internet Connection Discovery

      1
      T1016.001

      Virtualization/Sandbox Evasion

      3
      T1497

      Lateral Movement

      Collection

      Data from Local System

      3
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\1007336001\12cdc5fd27.exe
        Filesize

        2.8MB

        MD5

        dfc4ac821d77ac74e88a8d6806f3b381

        SHA1

        328c4646185f83623b64acc275314337cb8507af

        SHA256

        f1fa0545bde183d84cb9b24d6635ffb5ab98bd398659e92adcbb5dc90064531d

        SHA512

        5aee1cf473a623a0b6c659a337d1960e395d67c94fc54a230b9b70936f2ad2bf983547f9c76e13ff20c37fb34dd8185cd8e5d96979f91f9749626e6fa902a2fe

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1007337001\a2423dabcd.exe
        Filesize

        1.9MB

        MD5

        d6070b7d0ec34e67a998dbe217c6c746

        SHA1

        64e771f2bcb20e9ccc89c8b4a9cf1b36e431d491

        SHA256

        10b27d9cb387fa4ac371de8767d5204925ca4da9c490ea8e2491b1a60c49fd85

        SHA512

        52bc768f8654cef43e62abfdba30878313aea5893d80759c633d84ce01c701b05e6f24c995f3a2568ab16ca69e6c1223b7e39c74c509fd6607bfa5e9418784f3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1007338001\460db93e31.exe
        Filesize

        2.8MB

        MD5

        0afe3bc3b68ddb4ebb3878a01a8bcd9a

        SHA1

        aa25366b2677ee9e0029c3e12f9063742227fe1b

        SHA256

        f3e3c4115bd289a528c02aae90a563e6b5dd6009e125d1fb142bcc7218cf068d

        SHA512

        b8067a96567d3d73af408581a6b041758bcd77f8752d8a176a1253e978d832ced0e83f2775fb951f728ae06f11c6231171fe480ad454370116c47f45fbb52bab

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1007339001\3e76b3ea55.exe
        Filesize

        4.3MB

        MD5

        aa1d9bfcb4fee4ff65cf6209fbc83204

        SHA1

        3334182b3bf48e928683a9c0a87d25ea57e8d70b

        SHA256

        dc645ba585c2d41ec553cefd46bd3dab212882cb07097905f9ed071e8882b161

        SHA512

        aec316f0ea02349b57a5e75a972edf70b8aea705a7c74f67452a5840834fca0cf70c3d099ca003bab73a25186e6f03298ea68440a03216fb40ece74b82f71d68

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1016920001\Cq6Id6x.exe
        Filesize

        3.1MB

        MD5

        f9b9f98592292b5cbf59c7a60e9ebaee

        SHA1

        59cc872fd0a11b259cc5b70893f35e9b5a7c8cbb

        SHA256

        5688e9e0becc622c573af2a1af4ee0676ef3907e38a9258a7801b46b7ad64665

        SHA512

        f27e4a96173aeb064f47d44ff445b1e15f6d4f39a4ad711c019bb29692caea56eb910970d22bc13ac5c57a256d71e77b12aa60c8405335a239781c57cb0eaf8e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1016945001\x0qQ2DH.exe
        Filesize

        17.6MB

        MD5

        3c224e3fc892719dc1e302378e533579

        SHA1

        0a65062e1426a95bfeca355398b6fdc4912fb6b1

        SHA256

        64cc7f7906fe1ebf0b6977892abd9aa36f5e525cb241964c3986ee9e1a18312d

        SHA512

        554a26e9654eccce831e4adcee49d5e2507956935e562b134a86f332d867debfcd1f64fdb88fccb2e1eee810975d565dbc6ea1376516817ee38765e4bd733a49

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1016974001\8c4176494d.exe
        Filesize

        2.8MB

        MD5

        016f86f0d66ebb15269ed87eb14429bc

        SHA1

        6c6a325414f3c7c17728461f02b078c27a999a27

        SHA256

        ba265a9b0c7cd5c04311a2c739fb40e0f01690bc82a4625c33e42f1388789589

        SHA512

        c3d6ae18c5ad276d2073e5d9b8389242b592f106b76c26e9b7d5f9510823e56ec530794583e10205e63e211ce118e91956498c11aba9744b4a9d85052c8e60a2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1017019001\VR6f3vF.exe
        Filesize

        1.8MB

        MD5

        ff279f4e5b1c6fbda804d2437c2dbdc8

        SHA1

        2feb3762c877a5ae3ca60eeebc37003ad0844245

        SHA256

        e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

        SHA512

        c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1017024001\kf5cl0F.exe
        Filesize

        21KB

        MD5

        14becdf1e2402e9aa6c2be0e6167041e

        SHA1

        72cbbae6878f5e06060a0038b25ede93b445f0df

        SHA256

        7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

        SHA512

        16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1017027001\ANEDNjf.exe
        Filesize

        1.8MB

        MD5

        25fb9c54265bbacc7a055174479f0b70

        SHA1

        4af069a2ec874703a7e29023d23a1ada491b584e

        SHA256

        552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

        SHA512

        7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1017279001\0a6cc2158d.exe
        Filesize

        758KB

        MD5

        afd936e441bf5cbdb858e96833cc6ed3

        SHA1

        3491edd8c7caf9ae169e21fb58bccd29d95aefef

        SHA256

        c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

        SHA512

        928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1017282001\b53b92b055.exe
        Filesize

        4.3MB

        MD5

        d6cfec5f8c250d92d751030c95d46aec

        SHA1

        70439cf2611f97c84af487c44b88703d004a2bca

        SHA256

        0200c5657794ccc0916aae772004b7f72a793b77dc807b51b2f88e597813f611

        SHA512

        a939f9af174d37e3d32d0794b1f14110deffd7847b884a79b5fd300bcc7c30ce285f6dbbc41ad6ab5bd237bb6353efb7ddee903a8ec155a10840dec8c25d9bbb

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1017285001\32c68ad5e9.exe
        Filesize

        747KB

        MD5

        8a9cb17c0224a01bd34b46495983c50a

        SHA1

        00296ea6a56f6e10a0f1450a20c5fb329b8856c1

        SHA256

        3d51b9523b387859bc0d94246dfb216cfa82f9d650c8d11be11ed67f70e7440b

        SHA512

        1472e4670f469c43227b965984ecc223a526f6284363d8e08a3b5b55e602ccce62df4bc49939ee5bd7df7b0c26e20da896b084eccab767f8728e6bf14d71c840

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1017286001\c1e58b6654.exe
        Filesize

        4.2MB

        MD5

        3a425626cbd40345f5b8dddd6b2b9efa

        SHA1

        7b50e108e293e54c15dce816552356f424eea97a

        SHA256

        ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

        SHA512

        a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\1017288001\633e0bbd23.exe
        Filesize

        1.8MB

        MD5

        e4df8d6d78a56d3e55389122ad4462f1

        SHA1

        52285e11ba9da28304f4c50fc1b426289da7e96c

        SHA256

        db1b86e4c5f75b2bd9ddaf1b3a259fbd27145dcd3e666278b0e16cc973f1ce21

        SHA512

        6649dcdae7235930f0656c9e03e37e2c9e080e54417659c8861452e79dde18446d1d7e9e28a33fab4e7562d3d987f12a9ad2aafae298b9ae5db0829fd0859bbb

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
        Filesize

        2.9MB

        MD5

        d7d1046efd8b7b38c0d01767bfc7a7cb

        SHA1

        7296ffd07d7f26e142a56a83146cbc873ac8f2a2

        SHA256

        2d7162fd5c1c73fae8b484ff0f467f125446448342f217adb95944ffbca2916f

        SHA512

        edf21de575b5cca0afafc97261935533d54c3fa1b6cd0b50fddd074d7db3020a8f13ab9b289d29100de3e2119f029300dbff1f84d3ebf7f2d777b549e50736ca

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Cab9A4E.tmp
        Filesize

        70KB

        MD5

        49aebf8cbd62d92ac215b2923fb1b9f5

        SHA1

        1723be06719828dda65ad804298d0431f6aff976

        SHA256

        b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

        SHA512

        bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\Tar9A70.tmp
        Filesize

        181KB

        MD5

        4ea6026cf93ec6338144661bf1202cd1

        SHA1

        a1dec9044f750ad887935a01430bf49322fbdcb7

        SHA256

        8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

        SHA512

        6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\main\main.bat
        Filesize

        440B

        MD5

        3626532127e3066df98e34c3d56a1869

        SHA1

        5fa7102f02615afde4efd4ed091744e842c63f78

        SHA256

        2a0e18ef585db0802269b8c1ddccb95ce4c0bac747e207ee6131dee989788bca

        SHA512

        dcce66d6e24d5a4a352874144871cd73c327e04c1b50764399457d8d70a9515f5bc0a650232763bf34d4830bab70ee4539646e7625cfe5336a870e311043b2bd

        Download Submit

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
        Filesize

        7KB

        MD5

        f1de791a1546ea08223a11366e4cfb14

        SHA1

        5b4f64699cce91af8118d8becb458f41f2ede88c

        SHA256

        82ade044edd58d493b3efc7e0b022446af1bf7923004ff7fa87265f495709a1c

        SHA512

        1467a86d0b6096906e14b9b17de41a0b4145b890471db25898818ba883ff9531e5ee8a8ed4029fcb8e1c39fc2b08511d20605ed731fb2e3ad81cb3dae795ae49

        Download Submit

      • memory/304-242-0x0000000000240000-0x0000000000550000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/304-241-0x0000000000240000-0x0000000000550000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/680-341-0x00000000000B0000-0x000000000055B000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/848-44-0x0000000000CA0000-0x00000000011A2000-memory.dmp

        Filesize

        5.0MB

        Download

      • memory/848-43-0x0000000000CA0000-0x00000000011A2000-memory.dmp

        Filesize

        5.0MB

        Download

      • memory/1148-412-0x00000000013D0000-0x00000000013DC000-memory.dmp

        Filesize

        48KB

        Download

      • memory/1516-106-0x0000000006950000-0x0000000006C62000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/1516-108-0x0000000000220000-0x0000000000532000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/1516-95-0x0000000000220000-0x0000000000532000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/1584-282-0x0000000000A20000-0x0000000000EC6000-memory.dmp

        Filesize

        4.6MB

        Download

      • memory/1584-262-0x0000000000A20000-0x0000000000EC6000-memory.dmp

        Filesize

        4.6MB

        Download

      • memory/1656-378-0x00000000001E0000-0x000000000068B000-memory.dmp

        Filesize

        4.7MB

        Download

      • memory/1864-67-0x0000000004D90000-0x0000000005190000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1864-75-0x00000000012E0000-0x00000000017A2000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/1864-70-0x0000000074BD0000-0x0000000074C17000-memory.dmp

        Filesize

        284KB

        Download

      • memory/1864-68-0x0000000076E10000-0x0000000076FB9000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/1864-66-0x0000000004D90000-0x0000000005190000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/1864-64-0x00000000012E0000-0x00000000017A2000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/1900-547-0x000000001B680000-0x000000001B962000-memory.dmp

        Filesize

        2.9MB

        Download

      • memory/1900-548-0x00000000028E0000-0x00000000028E8000-memory.dmp

        Filesize

        32KB

        Download

      • memory/1996-168-0x0000000000FA0000-0x0000000002136000-memory.dmp

        Filesize

        17.6MB

        Download

      • memory/2144-77-0x0000000076E10000-0x0000000076FB9000-memory.dmp

        Filesize

        1.7MB

        Download

      • memory/2144-76-0x0000000001EC0000-0x00000000022C0000-memory.dmp

        Filesize

        4.0MB

        Download

      • memory/2144-79-0x0000000074BD0000-0x0000000074C17000-memory.dmp

        Filesize

        284KB

        Download

      • memory/2144-72-0x0000000000080000-0x000000000008A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/2164-380-0x0000000001190000-0x0000000001636000-memory.dmp

        Filesize

        4.6MB

        Download

      • memory/2232-260-0x00000000068A0000-0x0000000006D46000-memory.dmp

        Filesize

        4.6MB

        Download

      • memory/2232-145-0x0000000000870000-0x0000000000B82000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-146-0x0000000000870000-0x0000000000B82000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-238-0x0000000006300000-0x0000000006610000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-187-0x0000000000870000-0x0000000000B82000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-243-0x0000000000870000-0x0000000000B82000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-397-0x0000000000870000-0x0000000000B82000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-263-0x0000000006300000-0x0000000006610000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-152-0x0000000000870000-0x0000000000B82000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-239-0x0000000006300000-0x0000000006610000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-111-0x0000000000870000-0x0000000000B82000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-167-0x0000000000870000-0x0000000000B82000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-360-0x0000000000870000-0x0000000000B82000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-308-0x00000000068A0000-0x0000000006D46000-memory.dmp

        Filesize

        4.6MB

        Download

      • memory/2232-298-0x0000000000870000-0x0000000000B82000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2232-261-0x00000000068A0000-0x0000000006D46000-memory.dmp

        Filesize

        4.6MB

        Download

      • memory/2232-265-0x0000000006300000-0x0000000006610000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2444-3-0x0000000000810000-0x0000000000B29000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2444-4-0x0000000000810000-0x0000000000B29000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2444-2-0x0000000000811000-0x000000000083F000-memory.dmp

        Filesize

        184KB

        Download

      • memory/2444-0-0x0000000000810000-0x0000000000B29000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2444-1-0x0000000077000000-0x0000000077002000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2444-17-0x0000000000810000-0x0000000000B29000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2592-128-0x0000000001000000-0x0000000001B61000-memory.dmp

        Filesize

        11.4MB

        Download

      • memory/2592-151-0x0000000001000000-0x0000000001B61000-memory.dmp

        Filesize

        11.4MB

        Download

      • memory/2592-149-0x0000000001000000-0x0000000001B61000-memory.dmp

        Filesize

        11.4MB

        Download

      • memory/2592-148-0x0000000001000000-0x0000000001B61000-memory.dmp

        Filesize

        11.4MB

        Download

      • memory/2644-171-0x0000000000480000-0x00000000004A2000-memory.dmp

        Filesize

        136KB

        Download

      • memory/2644-170-0x00000000057B0000-0x0000000005906000-memory.dmp

        Filesize

        1.3MB

        Download

      • memory/2644-144-0x0000000000950000-0x0000000000C70000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2696-333-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2696-335-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2696-183-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2696-173-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2696-175-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2696-177-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2696-179-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2696-181-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2696-186-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2696-184-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2696-337-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2696-338-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2696-340-0x0000000000400000-0x0000000000456000-memory.dmp

        Filesize

        344KB

        Download

      • memory/2724-42-0x0000000006840000-0x0000000006D42000-memory.dmp

        Filesize

        5.0MB

        Download

      • memory/2724-21-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-45-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-61-0x0000000006840000-0x0000000006D02000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2724-169-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-80-0x0000000006840000-0x0000000006D42000-memory.dmp

        Filesize

        5.0MB

        Download

      • memory/2724-281-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-127-0x0000000006070000-0x0000000006382000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-65-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-110-0x0000000006840000-0x0000000006D02000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2724-93-0x0000000006070000-0x0000000006382000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-39-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-342-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-109-0x0000000006840000-0x0000000006D02000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2724-40-0x0000000006840000-0x0000000006D42000-memory.dmp

        Filesize

        5.0MB

        Download

      • memory/2724-379-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-153-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-23-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-150-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-63-0x0000000006840000-0x0000000006D02000-memory.dmp

        Filesize

        4.8MB

        Download

      • memory/2724-20-0x0000000000E51000-0x0000000000E7F000-memory.dmp

        Filesize

        184KB

        Download

      • memory/2724-19-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-147-0x0000000006840000-0x00000000073A1000-memory.dmp

        Filesize

        11.4MB

        Download

      • memory/2724-222-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-140-0x0000000000E50000-0x0000000001169000-memory.dmp

        Filesize

        3.1MB

        Download

      • memory/2724-125-0x0000000006840000-0x00000000073A1000-memory.dmp

        Filesize

        11.4MB

        Download

      • memory/2996-280-0x0000000000BA0000-0x0000000000BAC000-memory.dmp

        Filesize

        48KB

        Download