Overview

overview

10

Static

static

7

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-05-2024 16:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    37c4dd5f70108da529c94b3cf3679c1821d77427c3646359ddd14a6731245125.exe

  • Size

    1.5MB

  • MD5

    5815ed41dd36397d6345fbe7a69205a4

  • SHA1

    bcfdbf441963739bbfe4f9e30f5138ecaefc426c

  • SHA256

    37c4dd5f70108da529c94b3cf3679c1821d77427c3646359ddd14a6731245125

  • SHA512

    3ba585bc9353a957beb564b61632e8f25c1d767b66c1e589106c5fce3da1412d5f4eaf1078c85f8f5f4edcd962fac9e3466223d4798b0802c48af1b68764afb6

  • SSDEEP

    49152:y23wkVw7SmUvj/JPSTG41Ol9jNy4hcqq6bpaHU6:yOlPPWJGy4u6dv6

Score
10/10
amadeylummaredlineriseprostealcxmrigzgrat1@cloudytteamdiscoveryevasionexecutioninfostealerminerpersistenceratspywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.20

C2

http://5.42.96.141

http://5.42.96.7
Attributes
  • install_dir

    908f070dff

  • install_file

    explorku.exe

  • strings_key

    b25a9385246248a95c600f9a061438e1

  • url_paths

    /go34ko8/index.php

rc4.plain
rc4.plain

Extracted

Family

risepro

C2

147.45.47.126:58709

Extracted

Family

redline

Botnet

@CLOUDYTTEAM

C2

185.172.128.33:8970

Extracted

Family

redline

Botnet

1

C2

185.215.113.67:26260

Extracted

Family

stealc

C2

http://49.13.229.86

Attributes
  • url_path

    /c73eed764cc59dcb.php

Extracted

Family

lumma

C2

https://zippyfinickysofwps.shop/api

https://acceptabledcooeprs.shop/api

https://obsceneclassyjuwks.shop/api

https://miniaturefinerninewjs.shop/api

https://plaintediousidowsko.shop/api

https://sweetsquarediaslw.shop/api

https://holicisticscrarws.shop/api

https://boredimperissvieos.shop/api

https://smallelementyjdui.shop/api

https://sofaprivateawarderysj.shop/api

https://lineagelasserytailsd.shop/api

https://tendencyportionjsuk.shop/api

https://headraisepresidensu.shop/api

https://appetitesallooonsj.shop/api

https://minorittyeffeoos.shop/api

https://prideconstituiiosjk.shop/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detect ZGRat V1 3 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 6 IoCs
  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • XMRig Miner payload 4 IoCs
    miner
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs
    evasion
  • Downloads MZ/PE file
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Checks BIOS information in registry 2 TTPs 18 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 7 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 38 IoCs
  • Identifies Wine through registry keys 2 TTPs 4 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 41 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 5 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 15 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 5 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\37c4dd5f70108da529c94b3cf3679c1821d77427c3646359ddd14a6731245125.exe
    "C:\Users\Admin\AppData\Local\Temp\37c4dd5f70108da529c94b3cf3679c1821d77427c3646359ddd14a6731245125.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Checks whether UAC is enabled
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
      "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Suspicious use of WriteProcessMemory
      PID:1708
      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
        "C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe"
        3⤵
          PID:836
        • C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
          "C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe"
          3⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Checks computer location settings
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3932
          • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
            "C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe"
            4⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:1040
            • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
              "C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2480
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                • Checks computer location settings
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3896
                • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe"
                  7⤵
                  • Executes dropped EXE
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1092
                • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                  "C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe"
                  7⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4560
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
                  7⤵
                    PID:4980
                    • C:\Windows\SysWOW64\choice.exe
                      choice /C Y /N /D Y /T 3
                      8⤵
                        PID:4068
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2480 -s 360
                    6⤵
                    • Program crash
                    PID:5024
                • C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
                  "C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe"
                  5⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:2608
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                      PID:972
                  • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe"
                    5⤵
                    • Executes dropped EXE
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4504
                  • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                    "C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe"
                    5⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of WriteProcessMemory
                    PID:1300
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installg.bat" "
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2588
                      • C:\Windows\SysWOW64\sc.exe
                        Sc stop GameServerClient
                        7⤵
                        • Launches sc.exe
                        PID:4364
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService remove GameServerClient confirm
                        7⤵
                        • Executes dropped EXE
                        PID:4488
                      • C:\Windows\SysWOW64\sc.exe
                        Sc delete GameSyncLink
                        7⤵
                        • Launches sc.exe
                        PID:4904
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService remove GameSyncLink confirm
                        7⤵
                        • Executes dropped EXE
                        PID:1172
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService install GameSyncLink "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                        7⤵
                        • Executes dropped EXE
                        PID:2448
                      • C:\Program Files (x86)\GameSyncLink\GameService.exe
                        GameService start GameSyncLink
                        7⤵
                        • Executes dropped EXE
                        PID:3212
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installc.bat" "
                      6⤵
                        PID:940
                        • C:\Windows\SysWOW64\sc.exe
                          Sc stop GameServerClientC
                          7⤵
                          • Launches sc.exe
                          PID:1328
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService remove GameServerClientC confirm
                          7⤵
                          • Executes dropped EXE
                          PID:4860
                        • C:\Windows\SysWOW64\sc.exe
                          Sc delete PiercingNetLink
                          7⤵
                          • Launches sc.exe
                          PID:4932
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService remove PiercingNetLink confirm
                          7⤵
                          • Executes dropped EXE
                          PID:1976
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService install PiercingNetLink "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                          7⤵
                          • Executes dropped EXE
                          PID:4652
                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          GameService start PiercingNetLink
                          7⤵
                          • Executes dropped EXE
                          PID:1804
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\GameSyncLink\installm.bat" "
                        6⤵
                          PID:1608
                          • C:\Windows\SysWOW64\sc.exe
                            Sc delete GameSyncLinks
                            7⤵
                            • Launches sc.exe
                            PID:456
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService remove GameSyncLinks confirm
                            7⤵
                            • Executes dropped EXE
                            PID:644
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService install GameSyncLinks "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                            7⤵
                            • Executes dropped EXE
                            PID:3752
                          • C:\Program Files (x86)\GameSyncLink\GameService.exe
                            GameService start GameSyncLinks
                            7⤵
                            • Executes dropped EXE
                            PID:564
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "
                          6⤵
                            PID:4628
                        • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe"
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:1664
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            6⤵
                            • Checks processor information in registry
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5000
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 1352
                              7⤵
                              • Program crash
                              PID:1480
                        • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                          "C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe"
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:3464
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            6⤵
                              PID:1452
                          • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                            "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe"
                            5⤵
                            • Checks computer location settings
                            • Executes dropped EXE
                            PID:4664
                            • C:\Windows\SysWOW64\schtasks.exe
                              "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN NewB.exe /TR "C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe" /F
                              6⤵
                              • Creates scheduled task(s)
                              PID:1652
                      • C:\Users\Admin\1000006002\b728b1e812.exe
                        "C:\Users\Admin\1000006002\b728b1e812.exe"
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        PID:936
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2480 -ip 2480
                    1⤵
                      PID:4556
                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                      "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                      1⤵
                      • Executes dropped EXE
                      PID:904
                      • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                        "C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:4088
                        • C:\Windows\Temp\99133.exe
                          "C:\Windows\Temp\99133.exe" --list-devices
                          3⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:3236
                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                      "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                      1⤵
                      • Executes dropped EXE
                      PID:2352
                      • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                        "C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe"
                        2⤵
                        • Executes dropped EXE
                        PID:4944
                    • C:\Program Files (x86)\GameSyncLink\GameService.exe
                      "C:\Program Files (x86)\GameSyncLink\GameService.exe"
                      1⤵
                      • Executes dropped EXE
                      PID:4600
                      • C:\Windows\System32\Conhost.exe
                        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        2⤵
                          PID:1328
                        • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                          "C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe"
                          2⤵
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          PID:2580
                          • C:\Windows\Temp\390277.exe
                            "C:\Windows\Temp\390277.exe" --http-port 14343 -o xmr.2miners.com:2222 -u 83dQM82bj4yY83XKGKHnbHTzqgY4FUt2pi1JS15u7rTs8v84mTU5ny5MiRoSeyduBUAQKFZ6MsvbMHYTisNeThDM3BqQ59y --coin XMR -t 1 --no-color -p x
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            PID:1988
                      • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                        C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5104
                      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                        C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        PID:1020
                      • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                        C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                        1⤵
                        • Executes dropped EXE
                        PID:4248
                      • C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                        C:\Users\Admin\AppData\Local\Temp\7af68cdb52\axplons.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious behavior: EnumeratesProcesses
                        PID:880
                      • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                        C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                        1⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Checks whether UAC is enabled
                        PID:452
                      • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                        C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                        1⤵
                        • Executes dropped EXE
                        PID:2372
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5000 -ip 5000
                        1⤵
                          PID:4432

                        Network

                        MITRE ATT&CK Matrix ATT&CK v13

                        Initial Access

                        Execution

                        System Services

                        1
                        T1569

                        Service Execution

                        1
                        T1569.002

                        Scheduled Task/Job

                        1
                        T1053

                        Persistence

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Scheduled Task/Job

                        1
                        T1053

                        Privilege Escalation

                        Create or Modify System Process

                        1
                        T1543

                        Windows Service

                        1
                        T1543.003

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Scheduled Task/Job

                        1
                        T1053

                        Defense Evasion

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        Impair Defenses

                        1
                        T1562

                        Modify Registry

                        2
                        T1112

                        Subvert Trust Controls

                        1
                        T1553

                        Install Root Certificate

                        1
                        T1553.004

                        Credential Access

                        Unsecured Credentials

                        2
                        T1552

                        Credentials In Files

                        2
                        T1552.001

                        Discovery

                        Query Registry

                        6
                        T1012

                        Virtualization/Sandbox Evasion

                        2
                        T1497

                        System Information Discovery

                        5
                        T1082

                        Lateral Movement

                        Collection

                        Data from Local System

                        2
                        T1005

                        Exfiltration

                        Command and Control

                        Impact

                        Service Stop

                        1
                        T1489

                        Resource Development

                        Reconnaissance

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Program Files (x86)\GameSyncLink\GameService.exe
                          Filesize

                          288KB

                          MD5

                          d9ec6f3a3b2ac7cd5eef07bd86e3efbc

                          SHA1

                          e1908caab6f938404af85a7df0f80f877a4d9ee6

                          SHA256

                          472232ca821b5c2ef562ab07f53638bc2cc82eae84cea13fbe674d6022b6481c

                          SHA512

                          1b6b8702dca3cb90fe64c4e48f2477045900c5e71dd96b84f673478bab1089febfa186bfc55aebd721ca73db1669145280ebb4e1862d3b9dc21f712cd76a07c4

                          Download Submit
                        • C:\Program Files (x86)\GameSyncLink\GameSyncLink.exe
                          Filesize

                          2.5MB

                          MD5

                          e6943a08bb91fc3086394c7314be367d

                          SHA1

                          451d2e171f906fa6c43f8b901cd41b0283d1fa40

                          SHA256

                          aafdcfe5386452f4924cfcc23f2cf7eccf3f868947ad7291a77b2eca2af0c873

                          SHA512

                          505d3c76988882602f06398e747c4e496ecad9df1b7959069b87c8111c4d9118484f4d6baef5f671466a184c8caec362d635da210fa0987ccb746cbeea218d2a

                          Download Submit
                        • C:\Program Files (x86)\GameSyncLink\GameSyncLinks.exe
                          Filesize

                          6.2MB

                          MD5

                          1bacbebf6b237c75dbe5610d2d9e1812

                          SHA1

                          3ca5768a9cf04a2c8e157d91d4a1b118668f5cf1

                          SHA256

                          c3747b167c70fd52b16fb93a4f815e7a4ee27cf67d2c7d55ea9d1edc7969c67d

                          SHA512

                          f6438eced6915890d5d15d853c3ad6856de949b7354dcea97b1cf40d0c8aed767c8e45730e64ab0368f3606da5e95fd1d4db9cc21e613d517f37ddebbd0fa1fe

                          Download Submit
                        • C:\Program Files (x86)\GameSyncLink\PiercingNetLink.exe
                          Filesize

                          13.2MB

                          MD5

                          72b396a9053dff4d804e07ee1597d5e3

                          SHA1

                          5ec4fefa66771613433c17c11545c6161e1552d5

                          SHA256

                          d0b206f0f47a9f8593b6434dc27dadde8480a902e878882fa8c73fc7fe01b11d

                          SHA512

                          ad96c9ca2feae7af7fcf01a843d5aa6cbdde0520d68dedff44554a17639c6c66b2301d73daf272708cb76c22eae2d5c89db23af45105c4f0e35f4787f98e192b

                          Download Submit
                        • C:\Program Files (x86)\GameSyncLink\installc.bat
                          Filesize

                          301B

                          MD5

                          998ab24316795f67c26aca0f1b38c8ce

                          SHA1

                          a2a6dc94e08c086fe27f8c08cb8178e7a64f200d

                          SHA256

                          a468b43795f1083fb37b12787c5ff29f8117c26ac35af470084e00c48280442e

                          SHA512

                          7c9c2ade898a8defb6510ddd15730bec859d4474071eb6b8e8738ea6089764f81924ad2a6ebf0479d4fed7d61890edaa38f4bfbf70a4e6b30d33aa5bfc5b5c75

                          Download Submit
                        • C:\Program Files (x86)\GameSyncLink\installg.bat
                          Filesize

                          284B

                          MD5

                          5dee3cbf941c5dbe36b54690b2a3c240

                          SHA1

                          82b9f1ad3ca523f3794e052f7e67ecdcd1ae87e1

                          SHA256

                          98370b86626b8fd7a7cac96693348045b081326c49e2421113f49a5ea3588edb

                          SHA512

                          9ee431d485e2f09268a22b287b0960859d2f22db8c7e61309a042999c436b3de74f5d75837b739e01122a796ad65bc6468d009ec6ddf4962f4ff288155410556

                          Download Submit
                        • C:\Program Files (x86)\GameSyncLink\installm.bat
                          Filesize

                          218B

                          MD5

                          94b87b86dc338b8f0c4e5869496a8a35

                          SHA1

                          2584e6496d048068f61ac72f5c08b54ad08627c3

                          SHA256

                          2928d8e9a41f39d3802cfd2900d8edeb107666baa942d9c0ffbfd0234b5e5bfc

                          SHA512

                          b67eb73fe51d4dba990789f1e0123e902dac6d26569851c3d51ca0a575221ce317f973999d962669016017d8f81a01f11bd977609e66bb1b244334bce2db5d5d

                          Download Submit
                        • C:\Users\Admin\1000006002\b728b1e812.exe
                          Filesize

                          2.2MB

                          MD5

                          cd048c69ab3469eaf050dfb286a1d132

                          SHA1

                          b771aa847d5c90931d078aaceb717fd68adcee04

                          SHA256

                          00c6cef95c0120b06ad96c9693f3a4d2a22061e82121881d3d02c42e317b1f12

                          SHA512

                          c10beaaf545b1b9fb951f4ec4d84fcfd77f5345ebc56ffd1a0160276aba7104dc3d43193a13943db2d58c5ceb7c8e23ce99c7234721880dc600c13bb864fd3f8

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000003001\alex.exe
                          Filesize

                          2.7MB

                          MD5

                          31841361be1f3dc6c2ce7756b490bf0f

                          SHA1

                          ff2506641a401ac999f5870769f50b7326f7e4eb

                          SHA256

                          222393a4ab4b2ae83ca861faee6df02ac274b2f2ca0bed8db1783dd61f2f37ee

                          SHA512

                          53d66fa19e8db360042dadc55caaa9a1ca30a9d825e23ed2a58f32834691eb2aaaa27a4471e3fc4d13e201accc43160436ed0e9939df1cc227a62a09a2ae0019

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000004001\gold.exe
                          Filesize

                          402KB

                          MD5

                          7f981db325bfed412599b12604bd00ab

                          SHA1

                          9f8a8fd9df3af3a4111e429b639174229c0c10cd

                          SHA256

                          043839a678bed1b10be00842eae413f5ecd1cad7a0eaa384dd80bc1dcd31e69b

                          SHA512

                          a5be61416bc60669523e15213098a6d3bb5a2393612b57863fedfa1ff974bc110e0b7e8aadc97d0c9830a80798518616f9edfb65ae22334a362a743b6af3a82d

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000005001\amers.exe
                          Filesize

                          1.8MB

                          MD5

                          747c45cc02d882d04c799315ce96083a

                          SHA1

                          16f7f9427c3abf5fb24fb30f8280d684a9ae4229

                          SHA256

                          031d8544c34de2a9fce2e3b2d8402ddca604178a2868254d9cca00c045d7c930

                          SHA512

                          63278b4a4fc36c29dd6d827417d2873bf1c60827b2c818db8c6f9654aef700bb159f0d0eb6ca969d653d0e8ebf6f55e39069874b4b2185d62a649528257703a9

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000005001\redline1.exe
                          Filesize

                          304KB

                          MD5

                          9faf597de46ed64912a01491fe550d33

                          SHA1

                          49203277926355afd49393782ae4e01802ad48af

                          SHA256

                          0854678d655668c8ebb949c990166e26a4c04aef4ecf0191a95693ca150a9715

                          SHA512

                          ef8a7a8566eaf962c4e21d49d9c1583ed2cdc9c2751ce75133a9765d2fa6dc511fc6cc99ea871eb83d50bd08a31cb0b25c03f27b8e6f351861231910a6cf1a1e

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000006001\install.exe
                          Filesize

                          4.2MB

                          MD5

                          0f52e5e68fe33694d488bfe7a1a71529

                          SHA1

                          11d7005bd72cb3fd46f24917bf3fc5f3203f361f

                          SHA256

                          efd29c35766c607aa15d1cb83dec625739791b1616ad37d5b47e78cdb8a42ca8

                          SHA512

                          238fbb1c04eef2f2005cb7abf0223e3cd062d9d2840966292e19dcaa495609e134a0bdc35389ae9925ecfc787a13772d3ac7b29058579f702bc849dd0343c400

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000007001\swizzhis.exe
                          Filesize

                          1.0MB

                          MD5

                          808c0214e53b576530ee5b4592793bb0

                          SHA1

                          3fb03784f5dab1e99d5453664bd3169eff495c97

                          SHA256

                          434b1a9bd966d204eef1f4cddb7b73a91ebc5aaf4ac9b4ddd999c6444d92eb61

                          SHA512

                          2db3b4cb0233230e7c21cd820bde5de00286fbaedd3fe4dcefb6c66fe6867431f0ee1753fc18dcb89b2a18e888bd15d4d2de29b1d5cd93e425e3fcfe508c79c0

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000010001\lumma1.exe
                          Filesize

                          1.2MB

                          MD5

                          56e7d98642cfc9ec438b59022c2d58d7

                          SHA1

                          26526f702e584d8c8b629b2db5d282c2125665d7

                          SHA256

                          a2aa61942bae116f8c855fda0e9a991dba92b3a1e2f147aee0e7e2be1bdea383

                          SHA512

                          0be0b11de472029bd4e2268cddb5ddb381f7f275dfe50c47b9c836980e5cbfa7f71fe78804ef2180ee110ca9cf36944ec8b8b22babb31a1fc7a6585f79932a1f

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\1000015001\NewB.exe
                          Filesize

                          418KB

                          MD5

                          0099a99f5ffb3c3ae78af0084136fab3

                          SHA1

                          0205a065728a9ec1133e8a372b1e3864df776e8c

                          SHA256

                          919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226

                          SHA512

                          5ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd
                          Filesize

                          208B

                          MD5

                          2dbc71afdfa819995cded3cc0b9e2e2e

                          SHA1

                          60e1703c3fd4fe0fba9f1e65e10a61e0e72d9faf

                          SHA256

                          5a0070457636d37c11deb3148f6914583148fe45a66f44d7852f007ed5aad0ac

                          SHA512

                          0c59fa999ed912e6e747017c4e4c73f37ed7a72654f95eaea3db899308468e8756621db6e4edfd79e456ec69ce2e3e880817410b6aab1d01414f6300240d8b52

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\908f070dff\explorku.exe
                          Filesize

                          1.5MB

                          MD5

                          5815ed41dd36397d6345fbe7a69205a4

                          SHA1

                          bcfdbf441963739bbfe4f9e30f5138ecaefc426c

                          SHA256

                          37c4dd5f70108da529c94b3cf3679c1821d77427c3646359ddd14a6731245125

                          SHA512

                          3ba585bc9353a957beb564b61632e8f25c1d767b66c1e589106c5fce3da1412d5f4eaf1078c85f8f5f4edcd962fac9e3466223d4798b0802c48af1b68764afb6

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\Tmp979C.tmp
                          Filesize

                          2KB

                          MD5

                          1420d30f964eac2c85b2ccfe968eebce

                          SHA1

                          bdf9a6876578a3e38079c4f8cf5d6c79687ad750

                          SHA256

                          f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

                          SHA512

                          6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

                          Download Submit
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-4124900551-4068476067-3491212533-1000\76b53b3ec448f7ccdda2063b15d2bfc3_310807ab-751f-4d81-ae09-b202eaf21e19
                          Filesize

                          2KB

                          MD5

                          c3bd016703556529e17e6627095e53b5

                          SHA1

                          41c95b0a8456fbf9d21d76e85449b22a4448ac2a

                          SHA256

                          26bc6bda3530f3061d43221d2697ed858668668d1a1751b5301be475b09ea935

                          SHA512

                          8c275022986ef3b36002b99885bdaaaf90c4f0455178e983686e9cf1598976269a71651a65a15c1864cc0e51e44253d5cea6726e440652dc2102f912b61fa343

                          Download Submit
                        • C:\Users\Admin\AppData\Roaming\configurationValue\keks.exe
                          Filesize

                          304KB

                          MD5

                          0c582da789c91878ab2f1b12d7461496

                          SHA1

                          238bd2408f484dd13113889792d6e46d6b41c5ba

                          SHA256

                          a6ab532816fbb0c9664c708746db35287aaa85cbb417bef2eafcd9f5eaf7cf67

                          SHA512

                          a1b7c5c13462a7704ea2aea5025d1cb16ddd622fe1e2de3bbe08337c271a4dc8b9be2eae58a4896a7df3ad44823675384dbc60bdc737c54b173909be7a0a086a

                          Download Submit
                        • C:\Users\Admin\AppData\Roaming\configurationValue\trf.exe
                          Filesize

                          750KB

                          MD5

                          20ae0bb07ba77cb3748aa63b6eb51afb

                          SHA1

                          87c468dc8f3d90a63833d36e4c900fa88d505c6d

                          SHA256

                          daf6ae706fc78595f0d386817a0f8a3a7eb4ec8613219382b1cbaa7089418e7d

                          SHA512

                          db315e00ce2b2d5a05cb69541ee45aade4332e424c4955a79d2b7261ab7bd739f02dc688224f031a7a030c92fa915d029538e236dbd3c28b8d07d1265a52e5b2

                          Download Submit
                        • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                          Filesize

                          2KB

                          MD5

                          425d1698cf2c3d8df8b419ca63ad4773

                          SHA1

                          337d26694ab542d4a075d71b4b14bb23d3cd42d9

                          SHA256

                          396a476efe715fc3621669f347d7ec6f2a7b2b820dd74bad3bd8a6e973a0911d

                          SHA512

                          0542a627290dfba6da25482570d87ab4d2b45f5be9a724f7e1e3ddfd87745e6c2543d4a2e48a9de63e7738d84296ab5dc2cb52108a688243ff9306eb2da36339

                          Download Submit
                        • C:\Users\Admin\Desktop\Microsoft Edge.lnk
                          Filesize

                          2KB

                          MD5

                          8d412ab4f0391078124d379a0d2a043f

                          SHA1

                          4613ca21ffd56174dfa76ec20ee4e6910a20a141

                          SHA256

                          507fb5ca981d5973db973768c70e4940591d49b95eafb22392bc279a2842f8ea

                          SHA512

                          554054158319a5379a587c3f3e76e7a6f77f9fc48623c1761072de34d00b79b5f0e501b5c773bfc5edb61c55d23defa5fd6f518a0c3c80c482d38b3ff6f8ad15

                          Download Submit
                        • C:\Users\Public\Desktop\Google Chrome.lnk
                          Filesize

                          2KB

                          MD5

                          2154471ee95b28cec3d0050632a6ea19

                          SHA1

                          5a4e8ddcbb9d9863e9c9f450fca90448f1dcc305

                          SHA256

                          8a56104819a595229abaa45637c86ddfa4e6292c2db9231a648b0b5dcb02db64

                          SHA512

                          8d22d30f9d87fbb6a5111e50f9a152280f92dcd65190b493028ec63700edd5d83c88f4d8797f6574fa1151768bd9af1688afcbb9df86577beddeef25e3a6d31f

                          Download Submit
                        • C:\Users\Public\Desktop\Google Chrome.lnk
                          Filesize

                          2KB

                          MD5

                          c5abba6cee6b54803c81812b5b4003cd

                          SHA1

                          22bdd89e879fc4ca488d19a8af7bd399f02b6341

                          SHA256

                          14a90a730a9e331651d3a83efae9d238aa531d210d007bbae1413b2b74d72cd3

                          SHA512

                          8a3bf42abb36af0c08bfa2331b85163a50cf333dc890a7d3dded0d2fa5aaa97ad8030d0b67bfa8a8d600101b7c4867fb32c962f3d96b0bac45de65ab4b5d3fcc

                          Download Submit
                        • C:\Windows\Temp\390277.exe
                          Filesize

                          6.0MB

                          MD5

                          5cdb390aaba8caad929f5891f86cf8d7

                          SHA1

                          324a43fa56dffe541c0414f253faf2bf34ad9fa4

                          SHA256

                          1dfe2dd5f1bd757e852a271e0dc34f96aa9418983e9c8aded545302d2d69de44

                          SHA512

                          9e8dab07b840d9b0949a539e70cfa155ad08b34c73ae7f2810909f4bf5e1ddcee79f9630a9422083d244322d1afd9d91ade9fc4d75324bc4e45ee67a4900bbe9

                          Download Submit
                        • C:\Windows\Temp\99133.exe
                          Filesize

                          2.0MB

                          MD5

                          5c9e996ee95437c15b8d312932e72529

                          SHA1

                          eb174c76a8759f4b85765fa24d751846f4a2d2ef

                          SHA256

                          0eecdbfabaaef36f497e944a6ceb468d01824f3ae6457b4ae4b3ac8e95eebb55

                          SHA512

                          935102aad64da7eeb3e4b172488b3a0395298d480f885ecedc5d8325f0a9eabeea8ba1ece512753ac170a03016c80ba4990786ab608b4de0b11e6343fbf2192b

                          Download Submit
                        • C:\Windows\Temp\cudart64_101.dll
                          Filesize

                          398KB

                          MD5

                          1d7955354884a9058e89bb8ea34415c9

                          SHA1

                          62c046984afd51877ecadad1eca209fda74c8cb1

                          SHA256

                          111f216aef35f45086888c3f0a30bb9ab48e2b333daeddafd3a76be037a22a6e

                          SHA512

                          7eb8739841c476cda3cf4c8220998bc8c435c04a89c4bbef27b8f3b904762dede224552b4204d35935562aa73f258c4e0ddb69d065f732cb06cc357796cdd1b2

                          Download Submit
                        • memory/452-448-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/452-455-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/880-456-0x0000000000BA0000-0x0000000001038000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/880-444-0x0000000000BA0000-0x0000000001038000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/936-86-0x0000000000820000-0x0000000000EBA000-memory.dmp
                          Filesize

                          6.6MB

                          Download
                        • memory/936-279-0x0000000000820000-0x0000000000EBA000-memory.dmp
                          Filesize

                          6.6MB

                          Download
                        • memory/936-81-0x0000000000820000-0x0000000000EBA000-memory.dmp
                          Filesize

                          6.6MB

                          Download
                        • memory/936-85-0x0000000000820000-0x0000000000EBA000-memory.dmp
                          Filesize

                          6.6MB

                          Download
                        • memory/936-87-0x0000000000820000-0x0000000000EBA000-memory.dmp
                          Filesize

                          6.6MB

                          Download
                        • memory/936-88-0x0000000000820000-0x0000000000EBA000-memory.dmp
                          Filesize

                          6.6MB

                          Download
                        • memory/936-83-0x0000000000820000-0x0000000000EBA000-memory.dmp
                          Filesize

                          6.6MB

                          Download
                        • memory/936-84-0x0000000000820000-0x0000000000EBA000-memory.dmp
                          Filesize

                          6.6MB

                          Download
                        • memory/936-79-0x0000000000820000-0x0000000000EBA000-memory.dmp
                          Filesize

                          6.6MB

                          Download
                        • memory/936-82-0x0000000000820000-0x0000000000EBA000-memory.dmp
                          Filesize

                          6.6MB

                          Download
                        • memory/972-154-0x0000000000400000-0x0000000000458000-memory.dmp
                          Filesize

                          352KB

                          Download
                        • memory/972-149-0x0000000000400000-0x0000000000458000-memory.dmp
                          Filesize

                          352KB

                          Download
                        • memory/1020-418-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1020-415-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1020-417-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1020-416-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1020-413-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1020-420-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1020-411-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1020-410-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1020-412-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1040-380-0x0000000000BA0000-0x0000000001038000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/1040-424-0x0000000000BA0000-0x0000000001038000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/1040-278-0x0000000000BA0000-0x0000000001038000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/1040-408-0x0000000000BA0000-0x0000000001038000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/1040-399-0x0000000000BA0000-0x0000000001038000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/1040-402-0x0000000000BA0000-0x0000000001038000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/1040-403-0x0000000000BA0000-0x0000000001038000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/1040-61-0x0000000000BA0000-0x0000000001038000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/1092-259-0x000000001C840000-0x000000001C85E000-memory.dmp
                          Filesize

                          120KB

                          Download
                        • memory/1092-269-0x000000001F820000-0x000000001F9E2000-memory.dmp
                          Filesize

                          1.8MB

                          Download
                        • memory/1092-219-0x000000001ED90000-0x000000001EDCC000-memory.dmp
                          Filesize

                          240KB

                          Download
                        • memory/1092-217-0x000000001EE40000-0x000000001EF4A000-memory.dmp
                          Filesize

                          1.0MB

                          Download
                        • memory/1092-218-0x000000001ED30000-0x000000001ED42000-memory.dmp
                          Filesize

                          72KB

                          Download
                        • memory/1092-257-0x000000001C8A0000-0x000000001C916000-memory.dmp
                          Filesize

                          472KB

                          Download
                        • memory/1092-145-0x0000000000720000-0x00000000007E0000-memory.dmp
                          Filesize

                          768KB

                          Download
                        • memory/1092-270-0x000000001FF20000-0x0000000020448000-memory.dmp
                          Filesize

                          5.2MB

                          Download
                        • memory/1204-5-0x00000000009F0000-0x0000000000ED5000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1204-4-0x00000000009F0000-0x0000000000ED5000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1204-0-0x00000000009F0000-0x0000000000ED5000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1204-7-0x00000000009F0000-0x0000000000ED5000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1204-3-0x00000000009F0000-0x0000000000ED5000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1204-6-0x00000000009F0000-0x0000000000ED5000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1204-20-0x00000000009F0000-0x0000000000ED5000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1204-1-0x00000000009F0000-0x0000000000ED5000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1204-2-0x00000000009F0000-0x0000000000ED5000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1452-359-0x0000000000400000-0x0000000000458000-memory.dmp
                          Filesize

                          352KB

                          Download
                        • memory/1452-357-0x0000000000400000-0x0000000000458000-memory.dmp
                          Filesize

                          352KB

                          Download
                        • memory/1664-287-0x00000000011F0000-0x00000000011F1000-memory.dmp
                          Filesize

                          4KB

                          Download
                        • memory/1708-25-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1708-28-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1708-26-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1708-89-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1708-24-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1708-23-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1708-21-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1708-27-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1708-22-0x0000000000670000-0x0000000000B55000-memory.dmp
                          Filesize

                          4.9MB

                          Download
                        • memory/1988-394-0x000001E48FA00000-0x000001E48FA20000-memory.dmp
                          Filesize

                          128KB

                          Download
                        • memory/2608-148-0x0000000000B20000-0x0000000000B21000-memory.dmp
                          Filesize

                          4KB

                          Download
                        • memory/2608-150-0x0000000000B20000-0x0000000000B21000-memory.dmp
                          Filesize

                          4KB

                          Download
                        • memory/3464-358-0x0000000000BD0000-0x0000000000BD1000-memory.dmp
                          Filesize

                          4KB

                          Download
                        • memory/3896-105-0x0000000000400000-0x0000000000592000-memory.dmp
                          Filesize

                          1.6MB

                          Download
                        • memory/3932-46-0x0000000000EE0000-0x0000000001378000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/3932-47-0x0000000077524000-0x0000000077526000-memory.dmp
                          Filesize

                          8KB

                          Download
                        • memory/3932-60-0x0000000000EE0000-0x0000000001378000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/4504-361-0x00000000080C0000-0x00000000085EC000-memory.dmp
                          Filesize

                          5.2MB

                          Download
                        • memory/4504-360-0x00000000079C0000-0x0000000007B82000-memory.dmp
                          Filesize

                          1.8MB

                          Download
                        • memory/4504-195-0x00000000009F0000-0x0000000000A42000-memory.dmp
                          Filesize

                          328KB

                          Download
                        • memory/4560-183-0x00000000065D0000-0x000000000660C000-memory.dmp
                          Filesize

                          240KB

                          Download
                        • memory/4560-172-0x0000000006AE0000-0x00000000070F8000-memory.dmp
                          Filesize

                          6.1MB

                          Download
                        • memory/4560-140-0x0000000000500000-0x0000000000552000-memory.dmp
                          Filesize

                          328KB

                          Download
                        • memory/4560-142-0x00000000053A0000-0x0000000005944000-memory.dmp
                          Filesize

                          5.6MB

                          Download
                        • memory/4560-281-0x0000000006880000-0x00000000068E6000-memory.dmp
                          Filesize

                          408KB

                          Download
                        • memory/4560-184-0x0000000006740000-0x000000000678C000-memory.dmp
                          Filesize

                          304KB

                          Download
                        • memory/4560-143-0x0000000004E90000-0x0000000004F22000-memory.dmp
                          Filesize

                          584KB

                          Download
                        • memory/4560-173-0x0000000006630000-0x000000000673A000-memory.dmp
                          Filesize

                          1.0MB

                          Download
                        • memory/4560-174-0x0000000006570000-0x0000000006582000-memory.dmp
                          Filesize

                          72KB

                          Download
                        • memory/4560-366-0x0000000007200000-0x0000000007250000-memory.dmp
                          Filesize

                          320KB

                          Download
                        • memory/4560-169-0x0000000006360000-0x000000000637E000-memory.dmp
                          Filesize

                          120KB

                          Download
                        • memory/4560-147-0x0000000004E40000-0x0000000004E4A000-memory.dmp
                          Filesize

                          40KB

                          Download
                        • memory/4560-168-0x0000000005A50000-0x0000000005AC6000-memory.dmp
                          Filesize

                          472KB

                          Download
                        • memory/5000-288-0x0000000000400000-0x000000000063B000-memory.dmp
                          Filesize

                          2.2MB

                          Download
                        • memory/5000-286-0x0000000000400000-0x000000000063B000-memory.dmp
                          Filesize

                          2.2MB

                          Download
                        • memory/5104-422-0x0000000000BA0000-0x0000000001038000-memory.dmp
                          Filesize

                          4.6MB

                          Download
                        • memory/5104-414-0x0000000000BA0000-0x0000000001038000-memory.dmp
                          Filesize

                          4.6MB

                          Download