Overview

overview

10

Static

static

3

0d54050f59...0b.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/04/2025, 11:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0d54050f598fbe2cec0529f19e1728ea28dd956fc3d0f96e5a62581b33c3820b.exe

  • Size

    5.6MB

  • MD5

    8c0cdf1a4ee51d2a70b1ad2fa1624f48

  • SHA1

    b8c626c1bb599377fae94fe9baa1868b20d3d161

  • SHA256

    0d54050f598fbe2cec0529f19e1728ea28dd956fc3d0f96e5a62581b33c3820b

  • SHA512

    8c7363af5f6a3dd1bfad280f70fcc1a58957d3b293184d0191673f1798135ea9cb4debb79da130bff78da02e38bb3fd00c39fd068bc1f3c0bddfb0b5ba9b0559

  • SSDEEP

    98304:Sn2sfDd0a4CqexnO8GJ8152W2iyrjhL1wf8fJ/Gy2umJXi5AP7upRucGU0DYhGej:9sf506qyO8v1gayhfJOCyXi5ATupRucB

Score
10/10
amadeydarkvisionlummastormkitty092155bootkitdefense_evasiondiscoveryexecutionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

5.21

Botnet

092155

C2

http://176.113.115.6

Attributes
  • install_dir

    bb556cff4a

  • install_file

    rapes.exe

  • strings_key

    a131b127e996a898cd19ffb2d92e481b

  • url_paths

    /Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

C2

https://wxayfarer.live/ALosnz

https://esccapewz.run/ANSbwqy

https://travewlio.shop/ZNxbHi

https://touvrlane.bet/ASKwjq

https://sighbtseeing.shop/ASJnzh

https://advennture.top/GKsiio

https://targett.top/dsANGt

https://holidamyup.today/AOzkns

https://triplooqp.world/APowko

https://jumpstarbt.live/trop

https://soursopsf.run/gsoiao

https://changeaie.top/geps

https://easyupgw.live/eosz

https://liftally.top/xasj

https://upmodini.digital/gokk

https://salaccgfa.top/gsooz

https://zestmodp.top/zeda

https://xcelmodo.run/nahd

https://clarmodq.top/qoxo

https://uchangeaie.top/geps

Extracted

Family

darkvision

C2

82.29.67.160

Attributes
  • url

    http://107.174.192.179/data/003

    https://grabify.link/ZATFQO

    http://107.174.192.179/clean

  • user_agent

    Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Amadey family
    amadey
  • DarkVision Rat

    DarkVision Rat is a trojan written in C++.

    ratdarkvision
  • Darkvision family
    darkvision
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 1 IoCs
  • Stormkitty family
    stormkitty
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    defense_evasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Downloads MZ/PE file 12 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 31 IoCs
  • Identifies Wine through registry keys 2 TTPs 9 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\0d54050f598fbe2cec0529f19e1728ea28dd956fc3d0f96e5a62581b33c3820b.exe
    "C:\Users\Admin\AppData\Local\Temp\0d54050f598fbe2cec0529f19e1728ea28dd956fc3d0f96e5a62581b33c3820b.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5368
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\T7a95.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\T7a95.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:452
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1q83T4.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1q83T4.exe
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3600
        • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
          "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Downloads MZ/PE file
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4944
          • C:\Users\Admin\AppData\Local\Temp\10497130101\fd67EIq.exe
            "C:\Users\Admin\AppData\Local\Temp\10497130101\fd67EIq.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:6112
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "setup" /t REG_SZ /d "C:\Users\Admin\AppData\Local\setup.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              PID:12980
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "setup" /t REG_SZ /d "C:\Users\Admin\AppData\Local\setup.exe"
                7⤵
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                PID:13016
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:13120
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                7⤵
                  PID:7352
              • C:\Users\Admin\AppData\Local\setup.exe
                "C:\Users\Admin\AppData\Local\setup.exe"
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:7228
            • C:\Users\Admin\AppData\Local\Temp\10512750101\9d6d0e7df6.exe
              "C:\Users\Admin\AppData\Local\Temp\10512750101\9d6d0e7df6.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Writes to the Master Boot Record (MBR)
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5920
            • C:\Users\Admin\AppData\Local\Temp\10514460101\D3fQA0J.exe
              "C:\Users\Admin\AppData\Local\Temp\10514460101\D3fQA0J.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:6124
            • C:\Users\Admin\AppData\Local\Temp\10530610101\wjtk7Ga.exe
              "C:\Users\Admin\AppData\Local\Temp\10530610101\wjtk7Ga.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:1900
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:960
            • C:\Users\Admin\AppData\Local\Temp\10534020101\lWUwEmq.exe
              "C:\Users\Admin\AppData\Local\Temp\10534020101\lWUwEmq.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:4668
              • C:\Users\Admin\AppData\Local\Temp\10534020101\lWUwEmq.exe
                "C:\Users\Admin\AppData\Local\Temp\10534020101\lWUwEmq.exe"
                6⤵
                • Executes dropped EXE
                PID:452
            • C:\Users\Admin\AppData\Local\Temp\10534240101\9sWdA2p.exe
              "C:\Users\Admin\AppData\Local\Temp\10534240101\9sWdA2p.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:4940
            • C:\Users\Admin\AppData\Local\Temp\10534250101\f8d6ab14a2.exe
              "C:\Users\Admin\AppData\Local\Temp\10534250101\f8d6ab14a2.exe"
              5⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Checks BIOS information in registry
              • Executes dropped EXE
              • Identifies Wine through registry keys
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:3980
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 828
                6⤵
                • Program crash
                PID:5248
            • C:\Users\Admin\AppData\Local\Temp\10534260101\D3fQA0J.exe
              "C:\Users\Admin\AppData\Local\Temp\10534260101\D3fQA0J.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              PID:5664
            • C:\Users\Admin\AppData\Local\Temp\10534270101\lWUwEmq.exe
              "C:\Users\Admin\AppData\Local\Temp\10534270101\lWUwEmq.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:4452
              • C:\Users\Admin\AppData\Local\Temp\10534270101\lWUwEmq.exe
                "C:\Users\Admin\AppData\Local\Temp\10534270101\lWUwEmq.exe"
                6⤵
                • Executes dropped EXE
                PID:4816
            • C:\Users\Admin\AppData\Local\Temp\10534280101\UZPt0hR.exe
              "C:\Users\Admin\AppData\Local\Temp\10534280101\UZPt0hR.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: MapViewOfSection
              PID:5200
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c powershell.exe Add-MpPreference -ExclusionPath 'C:'
                6⤵
                  PID:4968
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe Add-MpPreference -ExclusionPath 'C:'
                    7⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:728
                • C:\Windows\system32\svchost.exe
                  "C:\Windows\system32\svchost.exe"
                  6⤵
                  • Downloads MZ/PE file
                  • Adds Run key to start application
                  PID:3440
                  • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                    "C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe" ""
                    7⤵
                    • Sets service image path in registry
                    • Executes dropped EXE
                    • Suspicious behavior: LoadsDriver
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4156
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell Remove-MpPreference -ExclusionPath C:\
                      8⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:12764
                  • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                    "C:\Users\Admin\AppData\Local\Temp\\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe" ""
                    7⤵
                    • Deletes itself
                    • Executes dropped EXE
                    PID:1320
              • C:\Users\Admin\AppData\Local\Temp\10534290101\fd67EIq.exe
                "C:\Users\Admin\AppData\Local\Temp\10534290101\fd67EIq.exe"
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5352
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                  6⤵
                    PID:5956
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
                    6⤵
                      PID:8328
                  • C:\Users\Admin\AppData\Local\Temp\10534310101\wjtk7Ga.exe
                    "C:\Users\Admin\AppData\Local\Temp\10534310101\wjtk7Ga.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:12660
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      PID:12740
                  • C:\Users\Admin\AppData\Local\Temp\10534320101\353c778bc2.exe
                    "C:\Users\Admin\AppData\Local\Temp\10534320101\353c778bc2.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:13184
                    • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                      "C:\Users\Admin\AppData\Local\Temp\10534320101\353c778bc2.exe"
                      6⤵
                      • Downloads MZ/PE file
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:5196
                  • C:\Users\Admin\AppData\Local\Temp\10534330101\db8a44bde4.exe
                    "C:\Users\Admin\AppData\Local\Temp\10534330101\db8a44bde4.exe"
                    5⤵
                    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                    • Checks BIOS information in registry
                    • Executes dropped EXE
                    • Identifies Wine through registry keys
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    PID:6216
                    • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                      "C:\Users\Admin\AppData\Local\Temp\10534330101\db8a44bde4.exe"
                      6⤵
                      • Downloads MZ/PE file
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:5248
                  • C:\Users\Admin\AppData\Local\Temp\10534340101\7861bd7807.exe
                    "C:\Users\Admin\AppData\Local\Temp\10534340101\7861bd7807.exe"
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:7944
                    • C:\Users\Admin\AppData\Local\Temp\is-8UH16.tmp\7861bd7807.tmp
                      "C:\Users\Admin\AppData\Local\Temp\is-8UH16.tmp\7861bd7807.tmp" /SL5="$F0050,28467627,844800,C:\Users\Admin\AppData\Local\Temp\10534340101\7861bd7807.exe"
                      6⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of FindShellTrayWindow
                      PID:5924
                  • C:\Users\Admin\AppData\Local\Temp\10534350101\bbf2ef63ee.exe
                    "C:\Users\Admin\AppData\Local\Temp\10534350101\bbf2ef63ee.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    PID:5140
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                      6⤵
                      • System Location Discovery: System Language Discovery
                      PID:8312
                  • C:\Users\Admin\AppData\Local\Temp\10534360101\68b3e78814.exe
                    "C:\Users\Admin\AppData\Local\Temp\10534360101\68b3e78814.exe"
                    5⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:8468
              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2X4635.exe
                C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2X4635.exe
                3⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4408
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
            1⤵
            • Suspicious use of WriteProcessMemory
            PID:1644
            • C:\Windows\system32\rundll32.exe
              rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\"
              2⤵
                PID:5428
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\"
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:5216
              • C:\Windows\system32\rundll32.exe
                rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\"
                2⤵
                  PID:5640
              • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                1⤵
                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                • Checks BIOS information in registry
                • Executes dropped EXE
                • Identifies Wine through registry keys
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:2780
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3980 -ip 3980
                1⤵
                  PID:5372
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
                  1⤵
                    PID:5572
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c C:\ProgramData\{A332F586-BC6E-46FF-BB3B-A67E49F41010}\aitstatic.exe {1CF6DD21-C538-4D1C-883F-AD3AF450FA11}
                    1⤵
                      PID:6124
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\setup.exe
                      1⤵
                        PID:13036
                      • C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                        C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:6592

                      Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Command and Scripting Interpreter

                      1
                      T1059

                      PowerShell

                      1
                      T1059.001

                      Persistence

                      Boot or Logon Autostart Execution

                      2
                      T1547

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Pre-OS Boot

                      1
                      T1542

                      Bootkit

                      1
                      T1542.003

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      2
                      T1547

                      Registry Run Keys / Startup Folder

                      2
                      T1547.001

                      Defense Evasion

                      Modify Registry

                      2
                      T1112

                      Pre-OS Boot

                      1
                      T1542

                      Bootkit

                      1
                      T1542.003

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Credential Access

                      Unsecured Credentials

                      1
                      T1552

                      Credentials In Files

                      1
                      T1552.001

                      Discovery

                      Query Registry

                      6
                      T1012

                      System Information Discovery

                      3
                      T1082

                      System Location Discovery

                      1
                      T1614

                      System Language Discovery

                      1
                      T1614.001

                      Virtualization/Sandbox Evasion

                      2
                      T1497

                      Lateral Movement

                      Collection

                      Data from Local System

                      1
                      T1005

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\ProgramData\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\tzutil.exe
                        Filesize

                        1.9MB

                        MD5

                        09b76f9fe13fab0c3aa4cc61cc8c9946

                        SHA1

                        2b186dd57a68770b6ffbdc5034638f7176be66c2

                        SHA256

                        eb1ac70c8524ab7b487d8dccb2faceac4f447701a17a34a164b228828fe76f98

                        SHA512

                        5ce231d18dda1575826cf4499603499ab5e1fa34ac23581336eb050388b28f3bb65885efd4a75037cae5a1968d938ce7c9a3e68f4aa2be916efd709c32710f50

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                        Filesize

                        2KB

                        MD5

                        d85ba6ff808d9e5444a4b369f5bc2730

                        SHA1

                        31aa9d96590fff6981b315e0b391b575e4c0804a

                        SHA256

                        84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                        SHA512

                        8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\BLDESBJ5\service[1].htm
                        Filesize

                        1B

                        MD5

                        cfcd208495d565ef66e7dff9f98764da

                        SHA1

                        b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                        SHA256

                        5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                        SHA512

                        31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        Filesize

                        944B

                        MD5

                        d670b8afc1f95fa27664d1d5e1aedbd9

                        SHA1

                        812b6782aaaae476d0fc15084109ab1b353db9b1

                        SHA256

                        f51a65f1321a8bf64493baf04ab9d3c3eaa2643f007947cca51c8be012765cf4

                        SHA512

                        8d05512ae3a77e4c4caf8cc4e19e22e0a4a646bffd3cec3518e45bdb7aeb9feac44837b12e03a60046f5558e91729aa646b2c8ac8192d9e6e98feecdbe6eaa07

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10497130101\fd67EIq.exe
                        Filesize

                        8.8MB

                        MD5

                        85dc6d6dcfa018c2f451cc0ca8c77458

                        SHA1

                        f7519fa0df4f69cbda5f3a7dfb4e457381f8e5c8

                        SHA256

                        acf4882beae2b481c9bbbe10900688099a1018de9a95217dd31243072ab8f93e

                        SHA512

                        93f7d1de428f45e3038960a83e1752863d69b21e4286eb25a2b02777e4161def6fb3275d219ed9cf044b73c4ba34c33f81fe52358c10d93a9000950dc7c0da79

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10512750101\9d6d0e7df6.exe
                        Filesize

                        2.1MB

                        MD5

                        17c9f37fe8c2b01370cb2a9464697351

                        SHA1

                        03d217ee6aa6383a8b61f550f945c69687e03192

                        SHA256

                        a4507a54200b84987456f9b2ea1f7a4ae9f1aedddc3beff51ac2127e025eb03b

                        SHA512

                        12c950b89813f17bf4db1e46d7445a7663a57ee50f4e52377f40c0d1e661ab3fcae909dc969cbab6c3135f414c26b7a2f749ae3697df9c5c4e4ffa25107bcc24

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10514460101\D3fQA0J.exe
                        Filesize

                        7.0MB

                        MD5

                        e130f55133c41e91984ba551d9316d28

                        SHA1

                        b3dc5d47c1f2dee238bd6b020cad759411ab5fdb

                        SHA256

                        b3cead0b7588d6fb88833bc5ae6d74338ab3727c5fec307d4332b36df8a50604

                        SHA512

                        90cde01dee2191a011811c80c6b6d978d4001a097493f72aceb84094dbfd59343beaa3a3d398f0c53bef0e9a1585f6b794dc5bb98e73ea58df2375310884f219

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10530610101\wjtk7Ga.exe
                        Filesize

                        1.2MB

                        MD5

                        a14da6f0e2c99c95fb0a9d8119ead545

                        SHA1

                        76b0e5532cff13732244078ceb2172fd5c59359d

                        SHA256

                        713fea7f14920d085472ba42d1f0f1e53c9a7e97a17dcdd3f050322c26536901

                        SHA512

                        7009e4ec7ca828ff006885f8e475d3d3df364f5c3fef4023226f8feb0dea83aedfc52b45cb2151f914ae36ffb4428b83c3697d6ef7aadb9810551a3b9e406e8d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10534020101\lWUwEmq.exe
                        Filesize

                        969KB

                        MD5

                        0202dd8e050fb3a710058c27979616ce

                        SHA1

                        7d6483b579e0a967c9be38255daf8a1259f6a726

                        SHA256

                        d82a8853d27dcbff8ab358516c4719c77ae7e788dbdc28543ace7894ec1d37ae

                        SHA512

                        8c7d15c206247aceb43063257e0eab8dd71c0c446037d1240c43cbc07adeb08982016975edfad6b7728462ef190f7396cb73d477d51cf25f4cf343ccc1058411

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10534240101\9sWdA2p.exe
                        Filesize

                        1.1MB

                        MD5

                        5adca22ead4505f76b50a154b584df03

                        SHA1

                        8c7325df64b83926d145f3d36900b415b8c0fa65

                        SHA256

                        aa7105a237dc64c8eb179f18d54641e5d7b9ab7da7bf71709a0d773f20154778

                        SHA512

                        6192d61e777c59aa80c236b2f3e961795b7ff9971327c4e3270803d356ecf38949811df680a372259a9638ccdb90fc1271fb844f1f35656d5b317c96081f396e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10534280101\UZPt0hR.exe
                        Filesize

                        1.2MB

                        MD5

                        6ac21d5d2a54b525ecf721d6f80805ad

                        SHA1

                        cd2b809f222906c533ab712139101c6188a08552

                        SHA256

                        e4094a03164aecf804eef2b9690796761b195786062273eaeb8bf7be0c18045d

                        SHA512

                        cc6e30e7a62ee5c55b338b38467a9032129ae2ef0b6f7b1e0ff8b679936772c5e6f0d8b7341f06fb69fea310680c1b79f4a8282d8a1ebfe1f9cc4cc6605b2968

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10534300101\qhjMWht.exe
                        Filesize

                        1.8MB

                        MD5

                        155b5a37e0139ae41470d962cb52d724

                        SHA1

                        8205240e38cd52ceacf9ea8c3341df000e9d3d1e

                        SHA256

                        7d97bf7503ab66494f677393827135a6bab046e140994562b851af8e8e5e9d72

                        SHA512

                        91daf5395c85dad4894b350544e26767856b3af2e3e34f2eebe71410b9f9ceb7a88c518beda22ed280ca1efc90e045acd68ad37ae4ae01529e33433905632fc7

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10534320101\353c778bc2.exe
                        Filesize

                        4.6MB

                        MD5

                        e32f4fc9d054ccc1fd8c8fd68979c6c7

                        SHA1

                        9fcdaf1b2bfdac3343b80252d995478732a10850

                        SHA256

                        461e1f5800aa7ea4dfde430e451cb2066fb50bff789c1cd6a66dc5237ff67058

                        SHA512

                        d73baa6feb0f2ac51afa968ffee180801e8be9142bd93147cef8df6c4f7d08692846804397fc8fa76efee016c4bf076dc3552c07c6531fdaaeeb9b2e65c10bb5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10534330101\db8a44bde4.exe
                        Filesize

                        4.4MB

                        MD5

                        b81372fbe5f89edc83e0796834c79f9b

                        SHA1

                        7e6722477b99321abaf367bb746bb9700547779e

                        SHA256

                        050d51423936edd03085a1c6b60cf57ece160cfa6ff21dad8c2ba0dd4ffdff72

                        SHA512

                        c264e9307f556f72feea5a9e9978eb957a6d58cd04cbe44d66e04ca6cd37941a488849ae5a01fa423c4961b16f2d2b8a0fe6cd9ff4f15328f5d159187ca592ad

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10534340101\7861bd7807.exe
                        Filesize

                        28.1MB

                        MD5

                        8bb05367683f7234d44082d6d218eb93

                        SHA1

                        642be518acd284344d6b3a688508ad011fba5601

                        SHA256

                        64c648cb4e1778ea36c85eeeef3744ee724e1852b2cf0c02c30202db4c4a949c

                        SHA512

                        36de01e264cd36aa2a27d1d7f737d34838d38f7513df339cbef53e943d9cbf886ad054e74c73ef6013e0faff37031e0acbec90e18087a348bb3446b5f55864a3

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10534350101\bbf2ef63ee.exe
                        Filesize

                        1.2MB

                        MD5

                        10df43a9bcda80911d9e23b6cdb590cc

                        SHA1

                        e750427f684fe5539465ca69d7ec870a64b04d2e

                        SHA256

                        e0a860108cfd2512018cf3d093810822ccad69b6bd25f8f0fc6080f882e36d2c

                        SHA512

                        6875986d8d7ec4721fcf3f06295d8cd5d2e48f6f2825fcc64bee4d13cd2d3444cd2bf4a6d52e366ce65fae8a386b77727182cf6b175187f214b1033d694d322e

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10534360101\68b3e78814.exe
                        Filesize

                        716KB

                        MD5

                        57a5e092cf652a8d2579752b0b683f9a

                        SHA1

                        6aad447f87ab12c73411dec5f34149034c3027fc

                        SHA256

                        29054ff2ce08e589dcc28d1e831f0c99659148f1faaabc81913207c4d12b4a34

                        SHA512

                        5759fc4bf73a54899fb060df243cdd1c1629504b20695d7116317a1941ef1f86449c9c3388d5a48bc7e4223207c985eadba1950e15c045d15890423701ba1b1f

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\10534360101\68b3e78814.exe
                        Filesize

                        358KB

                        MD5

                        e604fe68e20a0540ee70bb4bd2d897d0

                        SHA1

                        00a4d755d8028dbe2867789898b1736f0b17b31c

                        SHA256

                        6262dac7e6839a9300b48f50d6d87011fc3e9baae5bbcec14ba00b7a6da6f361

                        SHA512

                        996216993cc5e07e73d6b3c6485263537377c6b5af94a8b681216e7c5f8383672408998d4186a73f5fe83d94f48bf0a54d6a7c2ca82d3aa825ade2462db0bd89

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3X74g.exe
                        Filesize

                        1.7MB

                        MD5

                        62c2f6a6ae4c78f9240beccae91020c3

                        SHA1

                        35078abe500fc8b4ebdcfc8de9dc2848718b4f23

                        SHA256

                        66e08b6b7fad24013ac2200151dea987731f5064dd09e615ce8fa050d62aabb6

                        SHA512

                        bb6d1fe6607ff8f2371a1e4bee4ba69f02c54b5786e0504486c4140f1340aec07b5aca2d6b50a1af8b11de706b67ef96a202a74316ab3cf20a3d1995a6d7324d

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\T7a95.exe
                        Filesize

                        3.8MB

                        MD5

                        158aca79e5c63c579a0e456b7768e70a

                        SHA1

                        b6722bd4b12d6895b84e6ac2c2ce82bc2cde733f

                        SHA256

                        f234ff5f670eade99cc9a931219adb59bf420d8ddbedd81074e9fc3aee279d41

                        SHA512

                        bb91cb58099a965d3c4aaa2a7c87ea296875527d365e98a8a0b40d5beb58315fc1c360d51168730fb692dd8a8dcec9f044e9ccfe84bba1ea627ed0b2264dd1ce

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1q83T4.exe
                        Filesize

                        2.1MB

                        MD5

                        0878c9c962789a52137bf5f64f5d3d14

                        SHA1

                        112c1651518f105b2a000f7b4f56f2db2d0244f5

                        SHA256

                        f9423858966857d2b126e78f229a68eeb543a0daac726b1bd543930203aa8b21

                        SHA512

                        56a796ef137236e86089bc086b77675b0313a030af07bccb4c818c2d7a1f0150a92d265e3bd6a881f1517c3bc969e4943d3e8c83f005bddd705e33bbf1808dc5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2X4635.exe
                        Filesize

                        1.8MB

                        MD5

                        e7bebd6f06227a8825028a0abcfd6948

                        SHA1

                        97233057a7aba38e8c9ff1700fd5fc946e04e8c0

                        SHA256

                        898faa4dabc117d84fb9ce92a7f483f43ee349739a9f66db0bda3ef949733a1d

                        SHA512

                        66bea25614ddbc502462b025c92f6c354eb73a8055f158388b151c00f2943118f0cb3719453c968317fed53894b1e6523760896bb55b3714cdbbe6fec6421007

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u5kgvubd.t4l.ps1
                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\is-8UH16.tmp\7861bd7807.tmp
                        Filesize

                        3.4MB

                        MD5

                        e4c43138ccb8240276872fd1aec369be

                        SHA1

                        cb867b89b8bf19a405a5eee8aa7fe07964f1c16c

                        SHA256

                        46be5e3f28a5e4ed63d66b901d927c25944b4da36effea9c97fb05994360edf5

                        SHA512

                        f25ad4d0442d6bbd3bdf3320db0869404faba2cab2425bcb265721889b31a67c97ae5b464e09932f49addd4d2575a5e0672c06b9ab9bdecbdd2fe9c766c2ec91

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\svchost015.exe
                        Filesize

                        2.9MB

                        MD5

                        b826dd92d78ea2526e465a34324ebeea

                        SHA1

                        bf8a0093acfd2eb93c102e1a5745fb080575372e

                        SHA256

                        7824b50acdd144764dac7445a4067b35cf0fef619e451045ab6c1f54f5653a5b

                        SHA512

                        1ac4b731b9b31cabf3b1c43aee37206aee5326c8e786abe2ab38e031633b778f97f2d6545cf745c3066f3bd47b7aaf2ded2f9955475428100eaf271dd9aeef17

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\{425F784E-921A-4CC0-AE87-06A3B0393A0E}\w32tm.exe
                        Filesize

                        1.3MB

                        MD5

                        15bdc4bd67925ef33b926843b3b8154b

                        SHA1

                        646af399ef06ac70e6bd43afe0f978f0f51a75fd

                        SHA256

                        4f0b2c61bccfd9aa3db301ee4e15607df41ded533757de34c986a0ff25b6246d

                        SHA512

                        eac0736a06d0835758318d594d3560ee6be82889020a173463943956dd400d08cf1174a4c722dc45a3f3c034131982f4b19ff27db1163838afbfac37f397eaf8

                        Download Submit

                      • memory/452-163-0x0000000000400000-0x0000000000420000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/728-271-0x000001E116D60000-0x000001E116D82000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/960-145-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                        Download

                      • memory/960-144-0x0000000000400000-0x0000000000464000-memory.dmp

                        Filesize

                        400KB

                        Download

                      • memory/2780-171-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/2780-173-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/3440-269-0x000002730D9A0000-0x000002730DA11000-memory.dmp

                        Filesize

                        452KB

                        Download

                      • memory/3440-260-0x0000000000E20000-0x0000000000E22000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/3440-261-0x000002730D9A0000-0x000002730DA11000-memory.dmp

                        Filesize

                        452KB

                        Download

                      • memory/3440-270-0x000002730D9A0000-0x000002730DA11000-memory.dmp

                        Filesize

                        452KB

                        Download

                      • memory/3440-268-0x000002730D9A0000-0x000002730DA11000-memory.dmp

                        Filesize

                        452KB

                        Download

                      • memory/3600-28-0x0000000000C60000-0x000000000112B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/3600-14-0x0000000000C60000-0x000000000112B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/3980-192-0x0000000000400000-0x00000000008C0000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/3980-189-0x0000000000400000-0x00000000008C0000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/4156-314-0x0000000000810000-0x0000000000998000-memory.dmp

                        Filesize

                        1.5MB

                        Download

                      • memory/4156-310-0x0000000140000000-0x000000014043E000-memory.dmp

                        Filesize

                        4.2MB

                        Download

                      • memory/4156-316-0x0000000000810000-0x0000000000998000-memory.dmp

                        Filesize

                        1.5MB

                        Download

                      • memory/4156-317-0x0000000000810000-0x0000000000998000-memory.dmp

                        Filesize

                        1.5MB

                        Download

                      • memory/4156-318-0x0000000000810000-0x0000000000998000-memory.dmp

                        Filesize

                        1.5MB

                        Download

                      • memory/4156-315-0x0000000000810000-0x0000000000998000-memory.dmp

                        Filesize

                        1.5MB

                        Download

                      • memory/4156-312-0x0000000000810000-0x0000000000998000-memory.dmp

                        Filesize

                        1.5MB

                        Download

                      • memory/4156-319-0x0000000000810000-0x0000000000998000-memory.dmp

                        Filesize

                        1.5MB

                        Download

                      • memory/4156-313-0x0000000000810000-0x0000000000998000-memory.dmp

                        Filesize

                        1.5MB

                        Download

                      • memory/4408-35-0x0000000000790000-0x0000000000C52000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/4408-33-0x0000000000790000-0x0000000000C52000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/4940-166-0x0000000000F60000-0x0000000000FCB000-memory.dmp

                        Filesize

                        428KB

                        Download

                      • memory/4944-37-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/4944-36-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/4944-190-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/4944-29-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/4944-78-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/4944-309-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/4944-98-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/4944-124-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/4944-235-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/5200-257-0x0000000000400000-0x0000000000685000-memory.dmp

                        Filesize

                        2.5MB

                        Download

                      • memory/5664-230-0x0000000002D70000-0x0000000002DD1000-memory.dmp

                        Filesize

                        388KB

                        Download

                      • memory/5920-77-0x0000000000400000-0x00000000008C0000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/5920-234-0x0000000000400000-0x00000000008C0000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/5920-174-0x0000000000400000-0x00000000008C0000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/5920-123-0x0000000000400000-0x00000000008C0000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/5920-300-0x0000000000400000-0x00000000008C0000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/5920-75-0x0000000000400000-0x00000000008C0000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/5920-80-0x0000000000400000-0x00000000008C0000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/6112-60-0x0000000009500000-0x00000000097C2000-memory.dmp

                        Filesize

                        2.8MB

                        Download

                      • memory/6112-59-0x0000000005C60000-0x0000000005C6A000-memory.dmp

                        Filesize

                        40KB

                        Download

                      • memory/6112-18187-0x0000000001970000-0x000000000198A000-memory.dmp

                        Filesize

                        104KB

                        Download

                      • memory/6112-55-0x0000000000A40000-0x0000000001318000-memory.dmp

                        Filesize

                        8.8MB

                        Download

                      • memory/6112-56-0x0000000006290000-0x0000000006834000-memory.dmp

                        Filesize

                        5.6MB

                        Download

                      • memory/6112-61-0x0000000005630000-0x0000000005636000-memory.dmp

                        Filesize

                        24KB

                        Download

                      • memory/6112-18188-0x0000000003350000-0x0000000003356000-memory.dmp

                        Filesize

                        24KB

                        Download

                      • memory/6112-57-0x0000000005BB0000-0x0000000005C42000-memory.dmp

                        Filesize

                        584KB

                        Download

                      • memory/6112-58-0x0000000005D80000-0x0000000005E1C000-memory.dmp

                        Filesize

                        624KB

                        Download

                      • memory/6124-100-0x0000000002C70000-0x0000000002CD1000-memory.dmp

                        Filesize

                        388KB

                        Download

                      • memory/6124-99-0x0000000000E70000-0x0000000000E71000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/6216-18233-0x0000000000400000-0x0000000000CF0000-memory.dmp

                        Filesize

                        8.9MB

                        Download

                      • memory/6216-18240-0x0000000000400000-0x0000000000CF0000-memory.dmp

                        Filesize

                        8.9MB

                        Download

                      • memory/6592-18253-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/6592-18255-0x0000000000760000-0x0000000000C2B000-memory.dmp

                        Filesize

                        4.8MB

                        Download

                      • memory/13120-18278-0x0000000000400000-0x0000000000492000-memory.dmp

                        Filesize

                        584KB

                        Download

                      • memory/13184-18215-0x0000000000400000-0x0000000000E92000-memory.dmp

                        Filesize

                        10.6MB

                        Download

                      • memory/13184-18202-0x0000000000400000-0x0000000000E92000-memory.dmp

                        Filesize

                        10.6MB

                        Download