amadey | e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874

Analysis

max time kernel
159s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25-11-2022 23:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874.exe
Size

178KB
MD5

aa0ca41353719bd4ebda52e09c2f9687
SHA1

a3ab2faaf47d31ba52eeea318ab332fedc10a3c9
SHA256

e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874
SHA512

45258810926cc432f3e5ed0f3c4b2f703d2e199be958e35bcfde175b8825d2abeb433789212a6355effc37ed2a33149d918314a9b62c1132b39958fd3af46144
SSDEEP

3072:WtaQXMYrEDcwid5B9PTQxmTsdmYGifXCZpUS69:yDEDcwk5TJTI/fSra

Score

10^/10

amadey redline smokeloader pops backdoor collection discovery infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.50

77.73.134.65/o7VsjdSa2f/index.php

193.56.146.194/h49vlBP/index.php

Extracted

Family

redline

Botnet

pops

31.41.244.14:4694

Attributes

auth_value
c377eb074ac3f12f85b0ff38d543b16d

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Amadey credential stealer module 6 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dll	amadey_cred_module
behavioral1/memory/2220-250-0x0000000000960000-0x0000000000984000-memory.dmp	amadey_cred_module
C:\Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dll	amadey_cred_module
C:\Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dll	amadey_cred_module
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll	amadey_cred_module
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll	amadey_cred_module

Detects Smokeloader packer 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1560-133-0x00000000008A0000-0x00000000008A9000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000141001\laba.exe	family_redline
C:\Users\Admin\AppData\Local\Temp\1000141001\laba.exe	family_redline
behavioral1/memory/4692-235-0x0000000000800000-0x0000000000828000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

107 2220 rundll32.exe
111 4228 rundll32.exe
Downloads MZ/PE file

flow	pid	process
107	2220	rundll32.exe
111	4228	rundll32.exe

Executes dropped EXE 11 IoCs

Processes:

950C.exeA22C.exeB25A.exeB941.exeBCEB.exegntuud.exerovwer.exelaba.exelinda5.exerovwer.exegntuud.exe

pid	process
3964	950C.exe
4240	A22C.exe
3496	B25A.exe
3088	B941.exe
4828	BCEB.exe
4536	gntuud.exe
1696	rovwer.exe
4692	laba.exe
364	linda5.exe
3120	rovwer.exe
3132	gntuud.exe

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

linda5.exeBCEB.exeA22C.exegntuud.exerovwer.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	linda5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	BCEB.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	A22C.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	gntuud.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	rovwer.exe

Loads dropped DLL 5 IoCs

Processes:

rundll32.exerundll32.exerundll32.exe

pid process

1992 rundll32.exe
1992 rundll32.exe
2220 rundll32.exe
2220 rundll32.exe
4228 rundll32.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
1992	rundll32.exe
1992	rundll32.exe
2220	rundll32.exe
2220	rundll32.exe
4228	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

rovwer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\linda5.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000142001\\linda5.exe"	rovwer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\laba.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000141001\\laba.exe"	rovwer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Suspicious use of SetThreadContext 1 IoCs

Processes:

B25A.exe

description pid process target process

PID 3496 set thread context of 3976 3496 B25A.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4772 3964 WerFault.exe 950C.exe
5012 3496 WerFault.exe B25A.exe
4132 4828 WerFault.exe BCEB.exe

description	pid	process	target process
PID 3496 set thread context of 3976	3496	B25A.exe	vbc.exe

pid	pid_target	process	target process
4772	3964	WerFault.exe	950C.exe
5012	3496	WerFault.exe	B25A.exe
4132	4828	WerFault.exe	BCEB.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2808 schtasks.exe
4728 schtasks.exe
Modifies registry class 1 IoCs

Processes:

linda5.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings linda5.exe

pid	process
2808	schtasks.exe
4728	schtasks.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	linda5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874.exe

pid	process
1560	e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874.exe
1560	e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874.exe
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3048

pid	process
3048

Suspicious behavior: MapViewOfSection 19 IoCs

Processes:

e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874.exe

pid	process
1560	e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874.exe
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048
3048

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

B941.exe

description	pid	process
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeDebugPrivilege	3088	B941.exe
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048
Token: SeShutdownPrivilege	3048
Token: SeCreatePagefilePrivilege	3048

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

B25A.exeA22C.exeBCEB.exegntuud.exerovwer.exe

description	pid	process	target process
PID 3048 wrote to memory of 3964	3048		950C.exe
PID 3048 wrote to memory of 3964	3048		950C.exe
PID 3048 wrote to memory of 3964	3048		950C.exe
PID 3048 wrote to memory of 4240	3048		A22C.exe
PID 3048 wrote to memory of 4240	3048		A22C.exe
PID 3048 wrote to memory of 4240	3048		A22C.exe
PID 3048 wrote to memory of 3496	3048		B25A.exe
PID 3048 wrote to memory of 3496	3048		B25A.exe
PID 3048 wrote to memory of 3496	3048		B25A.exe
PID 3048 wrote to memory of 3088	3048		B941.exe
PID 3048 wrote to memory of 3088	3048		B941.exe
PID 3496 wrote to memory of 3976	3496	B25A.exe	vbc.exe
PID 3496 wrote to memory of 3976	3496	B25A.exe	vbc.exe
PID 3496 wrote to memory of 3976	3496	B25A.exe	vbc.exe
PID 3496 wrote to memory of 3976	3496	B25A.exe	vbc.exe
PID 3048 wrote to memory of 4828	3048		BCEB.exe
PID 3048 wrote to memory of 4828	3048		BCEB.exe
PID 3048 wrote to memory of 4828	3048		BCEB.exe
PID 3496 wrote to memory of 3976	3496	B25A.exe	vbc.exe
PID 3048 wrote to memory of 3824	3048		explorer.exe
PID 3048 wrote to memory of 3824	3048		explorer.exe
PID 3048 wrote to memory of 3824	3048		explorer.exe
PID 3048 wrote to memory of 3824	3048		explorer.exe
PID 3048 wrote to memory of 1192	3048		explorer.exe
PID 3048 wrote to memory of 1192	3048		explorer.exe
PID 3048 wrote to memory of 1192	3048		explorer.exe
PID 3048 wrote to memory of 2268	3048		explorer.exe
PID 3048 wrote to memory of 2268	3048		explorer.exe
PID 3048 wrote to memory of 2268	3048		explorer.exe
PID 3048 wrote to memory of 2268	3048		explorer.exe
PID 3048 wrote to memory of 4788	3048		explorer.exe
PID 3048 wrote to memory of 4788	3048		explorer.exe
PID 3048 wrote to memory of 4788	3048		explorer.exe
PID 3048 wrote to memory of 3364	3048		explorer.exe
PID 3048 wrote to memory of 3364	3048		explorer.exe
PID 3048 wrote to memory of 3364	3048		explorer.exe
PID 3048 wrote to memory of 3364	3048		explorer.exe
PID 3048 wrote to memory of 2448	3048		explorer.exe
PID 3048 wrote to memory of 2448	3048		explorer.exe
PID 3048 wrote to memory of 2448	3048		explorer.exe
PID 3048 wrote to memory of 2448	3048		explorer.exe
PID 3048 wrote to memory of 1372	3048		explorer.exe
PID 3048 wrote to memory of 1372	3048		explorer.exe
PID 3048 wrote to memory of 1372	3048		explorer.exe
PID 3048 wrote to memory of 1372	3048		explorer.exe
PID 3048 wrote to memory of 644	3048		explorer.exe
PID 3048 wrote to memory of 644	3048		explorer.exe
PID 3048 wrote to memory of 644	3048		explorer.exe
PID 3048 wrote to memory of 1472	3048		explorer.exe
PID 3048 wrote to memory of 1472	3048		explorer.exe
PID 3048 wrote to memory of 1472	3048		explorer.exe
PID 3048 wrote to memory of 1472	3048		explorer.exe
PID 4240 wrote to memory of 4536	4240	A22C.exe	gntuud.exe
PID 4240 wrote to memory of 4536	4240	A22C.exe	gntuud.exe
PID 4240 wrote to memory of 4536	4240	A22C.exe	gntuud.exe
PID 4828 wrote to memory of 1696	4828	BCEB.exe	rovwer.exe
PID 4828 wrote to memory of 1696	4828	BCEB.exe	rovwer.exe
PID 4828 wrote to memory of 1696	4828	BCEB.exe	rovwer.exe
PID 4536 wrote to memory of 2808	4536	gntuud.exe	schtasks.exe
PID 4536 wrote to memory of 2808	4536	gntuud.exe	schtasks.exe
PID 4536 wrote to memory of 2808	4536	gntuud.exe	schtasks.exe
PID 1696 wrote to memory of 4728	1696	rovwer.exe	schtasks.exe
PID 1696 wrote to memory of 4728	1696	rovwer.exe	schtasks.exe
PID 1696 wrote to memory of 4728	1696	rovwer.exe	schtasks.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874.exe
"C:\Users\Admin\AppData\Local\Temp\e3802d7d7902cfafe14ed996e4e3496d20904cf1d20197b416ff856e97463874.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1560

C:\Users\Admin\AppData\Local\Temp\950C.exe
C:\Users\Admin\AppData\Local\Temp\950C.exe
1⤵
- Executes dropped EXE
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3964 -s 436
2⤵
- Program crash
PID:4772

C:\Users\Admin\AppData\Local\Temp\A22C.exe
C:\Users\Admin\AppData\Local\Temp\A22C.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4240

C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exe
"C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4536

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exe" /F
3⤵
- Creates scheduled task(s)
PID:2808

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3964 -ip 3964
1⤵
PID:2832

C:\Users\Admin\AppData\Local\Temp\B25A.exe
C:\Users\Admin\AppData\Local\Temp\B25A.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3496 -s 248
2⤵
- Program crash
PID:5012

C:\Users\Admin\AppData\Local\Temp\B941.exe
C:\Users\Admin\AppData\Local\Temp\B941.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3088

C:\Users\Admin\AppData\Local\Temp\BCEB.exe
C:\Users\Admin\AppData\Local\Temp\BCEB.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4828

C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
"C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1696

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe" /F
3⤵
- Creates scheduled task(s)
PID:4728

C:\Users\Admin\AppData\Local\Temp\1000141001\laba.exe
"C:\Users\Admin\AppData\Local\Temp\1000141001\laba.exe"
3⤵
- Executes dropped EXE
PID:4692

C:\Users\Admin\AppData\Local\Temp\1000142001\linda5.exe
"C:\Users\Admin\AppData\Local\Temp\1000142001\linda5.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:364

C:\Windows\SysWOW64\control.exe
"C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\U9MAZ.CPl",
4⤵
PID:4624

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\U9MAZ.CPl",
5⤵
- Loads dropped DLL
PID:1992

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll, Main
3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_win_path
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1140
2⤵
- Program crash
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3496 -ip 3496
1⤵
PID:3656

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3824

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1192

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2268

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4788

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3364

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:2448

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1372

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:644

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4828 -ip 4828
1⤵
PID:5092

C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
1⤵
- Executes dropped EXE
PID:3120

C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exe
1⤵
- Executes dropped EXE
PID:3132

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000141001\laba.exe
Filesize
137KB

MD5
9299834655f07e6896b1ff0b9e92c7b4

SHA1
acba1e9262b4aebf020758e30326afdc99c714ad

SHA256
fe105a23e4bee42b0401669d6ce9d34dbc7816a6cbef7c7108e11adc3c339257

SHA512
7ab23ac1eedb82044946bb9e6afb308580d434be45f3ebd18c5fc90cd98281738e4f50e75a3506315785e60d93e90cc4facc285fe7760985dfe0fd47771bc650

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000141001\laba.exe
Filesize
137KB

MD5
9299834655f07e6896b1ff0b9e92c7b4

SHA1
acba1e9262b4aebf020758e30326afdc99c714ad

SHA256
fe105a23e4bee42b0401669d6ce9d34dbc7816a6cbef7c7108e11adc3c339257

SHA512
7ab23ac1eedb82044946bb9e6afb308580d434be45f3ebd18c5fc90cd98281738e4f50e75a3506315785e60d93e90cc4facc285fe7760985dfe0fd47771bc650

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000142001\linda5.exe
Filesize
1.5MB

MD5
085838048cd6b08b82f4075fc7c41830

SHA1
a2038496a31dca55daa707d8b7fbe157035ee488

SHA256
31ee8e4ad660aed91f56ddb6a259d9ba8fea9660ce7b92c26aa4f26f8933be52

SHA512
8e5072338e33250c7d1a6b16c09524c2bba9541a4dfbc68c20bd033c2724be4ca7e7b371d01ec5350dc0fc2949656e8dc7911533d546a9af3408d6e21afea819

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000142001\linda5.exe
Filesize
1.5MB

MD5
085838048cd6b08b82f4075fc7c41830

SHA1
a2038496a31dca55daa707d8b7fbe157035ee488

SHA256
31ee8e4ad660aed91f56ddb6a259d9ba8fea9660ce7b92c26aa4f26f8933be52

SHA512
8e5072338e33250c7d1a6b16c09524c2bba9541a4dfbc68c20bd033c2724be4ca7e7b371d01ec5350dc0fc2949656e8dc7911533d546a9af3408d6e21afea819

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
Filesize
237KB

MD5
56ea74271bbecfd918a3fc9c8bbc4b78

SHA1
481a10efd5171276b3680d4c5fdee480b9ff4571

SHA256
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4

SHA512
1ac13ffdc21eeb464f5e6e2fd2cb6b7ea3cf869142e2634622fe3d1ea5935f26f412b2feaa08a9fc6c85e04285970d2d37f306f7faf25a3ed77e8ebf36545cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
Filesize
237KB

MD5
56ea74271bbecfd918a3fc9c8bbc4b78

SHA1
481a10efd5171276b3680d4c5fdee480b9ff4571

SHA256
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4

SHA512
1ac13ffdc21eeb464f5e6e2fd2cb6b7ea3cf869142e2634622fe3d1ea5935f26f412b2feaa08a9fc6c85e04285970d2d37f306f7faf25a3ed77e8ebf36545cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\50c1695437\rovwer.exe
Filesize
237KB

MD5
56ea74271bbecfd918a3fc9c8bbc4b78

SHA1
481a10efd5171276b3680d4c5fdee480b9ff4571

SHA256
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4

SHA512
1ac13ffdc21eeb464f5e6e2fd2cb6b7ea3cf869142e2634622fe3d1ea5935f26f412b2feaa08a9fc6c85e04285970d2d37f306f7faf25a3ed77e8ebf36545cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\950C.exe
Filesize
1.0MB

MD5
fc78f5650188734808f725d0934650a1

SHA1
e5184b4aa5de2d1121572fbfd3c2f05bf2b9a000

SHA256
319ead10ec14192ea1ba28c3079e72a581bbdbb13a67a3ccbe3066dfec86179a

SHA512
d74f0f7e0fb32d3ac0ef09fdd6762032044bb48ca298ee68e9e7cfd327db812bff460efe89495778febddeb5fdb3d8aa3d6c1f61d1aff34dcaa0a2bf07f2f3f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\950C.exe
Filesize
1.0MB

MD5
fc78f5650188734808f725d0934650a1

SHA1
e5184b4aa5de2d1121572fbfd3c2f05bf2b9a000

SHA256
319ead10ec14192ea1ba28c3079e72a581bbdbb13a67a3ccbe3066dfec86179a

SHA512
d74f0f7e0fb32d3ac0ef09fdd6762032044bb48ca298ee68e9e7cfd327db812bff460efe89495778febddeb5fdb3d8aa3d6c1f61d1aff34dcaa0a2bf07f2f3f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\A22C.exe
Filesize
780KB

MD5
d53cf9d2e7b6410bec5b8960643cbbc8

SHA1
55afb898ddcb5ef0af47ba7a82d8b820d7496dd6

SHA256
dfe955ab261dff65d5bfc3989342fb0bb9d4418485889a8b8062fef8eb5be708

SHA512
d5605e3f6160192b739aad221512307767d38984512f0dd917403daf9111f0d71c3305128fe0e0365cd5f180349146fba02006d646ae8793461459d6e2baa1b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\A22C.exe
Filesize
780KB

MD5
d53cf9d2e7b6410bec5b8960643cbbc8

SHA1
55afb898ddcb5ef0af47ba7a82d8b820d7496dd6

SHA256
dfe955ab261dff65d5bfc3989342fb0bb9d4418485889a8b8062fef8eb5be708

SHA512
d5605e3f6160192b739aad221512307767d38984512f0dd917403daf9111f0d71c3305128fe0e0365cd5f180349146fba02006d646ae8793461459d6e2baa1b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\B25A.exe
Filesize
3.7MB

MD5
27b75158dcfeba6b3419bdbb15397584

SHA1
8a135c4fc3fa7e06bf29537f9cb0298cc2f1c1de

SHA256
a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4

SHA512
eb9acc530d9c20dc26a00489572fe5b21075181f5f25d6598ebd5292aef5bbce9c2dc89fac04201ea7ce5c5faec545e44c02e54356ae6dfda7d2f70255a930b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\B25A.exe
Filesize
3.7MB

MD5
27b75158dcfeba6b3419bdbb15397584

SHA1
8a135c4fc3fa7e06bf29537f9cb0298cc2f1c1de

SHA256
a6ffd97ca5d47f2251a53ccd3ab891a9fec5b7d0f316b4c11e7d88f19765b1b4

SHA512
eb9acc530d9c20dc26a00489572fe5b21075181f5f25d6598ebd5292aef5bbce9c2dc89fac04201ea7ce5c5faec545e44c02e54356ae6dfda7d2f70255a930b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\B941.exe
Filesize
1.5MB

MD5
e54cf4fa4b8a924821d1a4211ff9fcd6

SHA1
5ffc606600bc3bae28b1e046d8aff1f93283bc90

SHA256
780b9aea585f02238fa3ab45dfd1a6ec9a1af46749b96c64a752173a8265faa6

SHA512
e73681d30c6637951303c782521385fe3fc4b92177f1fa129689e1a3336fbe15f8adbb55fee352cce858c5983c19f29ba23a4b586105da7f0c184676643d12d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\B941.exe
Filesize
1.5MB

MD5
e54cf4fa4b8a924821d1a4211ff9fcd6

SHA1
5ffc606600bc3bae28b1e046d8aff1f93283bc90

SHA256
780b9aea585f02238fa3ab45dfd1a6ec9a1af46749b96c64a752173a8265faa6

SHA512
e73681d30c6637951303c782521385fe3fc4b92177f1fa129689e1a3336fbe15f8adbb55fee352cce858c5983c19f29ba23a4b586105da7f0c184676643d12d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\BCEB.exe
Filesize
237KB

MD5
56ea74271bbecfd918a3fc9c8bbc4b78

SHA1
481a10efd5171276b3680d4c5fdee480b9ff4571

SHA256
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4

SHA512
1ac13ffdc21eeb464f5e6e2fd2cb6b7ea3cf869142e2634622fe3d1ea5935f26f412b2feaa08a9fc6c85e04285970d2d37f306f7faf25a3ed77e8ebf36545cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\BCEB.exe
Filesize
237KB

MD5
56ea74271bbecfd918a3fc9c8bbc4b78

SHA1
481a10efd5171276b3680d4c5fdee480b9ff4571

SHA256
0e8c52d547666ed8fcb291fa742fbf2f5ec0b8a5f59ec009ad9781c9d2a2c0f4

SHA512
1ac13ffdc21eeb464f5e6e2fd2cb6b7ea3cf869142e2634622fe3d1ea5935f26f412b2feaa08a9fc6c85e04285970d2d37f306f7faf25a3ed77e8ebf36545cc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\U9MAZ.CPl
Filesize
1.8MB

MD5
2db33d3114a29c94b38fb9e4e2ee6e16

SHA1
05f9ed07cb1fd7bcd304a26c61854734d963343b

SHA256
65c6a99a6758a3ee8e04edda297a0a01279092e65d0dcbe679dec82683f20c19

SHA512
3a3273ce26fb0c46908e54b6d84cda0136669af6d47d1657da637ad84d6a39cbea2c625fc31f73c0f6d253f79802ab4b6fcadaa7a444f3c3a311202924ceab1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\U9MAz.cpl
Filesize
1.8MB

MD5
2db33d3114a29c94b38fb9e4e2ee6e16

SHA1
05f9ed07cb1fd7bcd304a26c61854734d963343b

SHA256
65c6a99a6758a3ee8e04edda297a0a01279092e65d0dcbe679dec82683f20c19

SHA512
3a3273ce26fb0c46908e54b6d84cda0136669af6d47d1657da637ad84d6a39cbea2c625fc31f73c0f6d253f79802ab4b6fcadaa7a444f3c3a311202924ceab1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\U9MAz.cpl
Filesize
1.8MB

MD5
2db33d3114a29c94b38fb9e4e2ee6e16

SHA1
05f9ed07cb1fd7bcd304a26c61854734d963343b

SHA256
65c6a99a6758a3ee8e04edda297a0a01279092e65d0dcbe679dec82683f20c19

SHA512
3a3273ce26fb0c46908e54b6d84cda0136669af6d47d1657da637ad84d6a39cbea2c625fc31f73c0f6d253f79802ab4b6fcadaa7a444f3c3a311202924ceab1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exe
Filesize
780KB

MD5
d53cf9d2e7b6410bec5b8960643cbbc8

SHA1
55afb898ddcb5ef0af47ba7a82d8b820d7496dd6

SHA256
dfe955ab261dff65d5bfc3989342fb0bb9d4418485889a8b8062fef8eb5be708

SHA512
d5605e3f6160192b739aad221512307767d38984512f0dd917403daf9111f0d71c3305128fe0e0365cd5f180349146fba02006d646ae8793461459d6e2baa1b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exe
Filesize
780KB

MD5
d53cf9d2e7b6410bec5b8960643cbbc8

SHA1
55afb898ddcb5ef0af47ba7a82d8b820d7496dd6

SHA256
dfe955ab261dff65d5bfc3989342fb0bb9d4418485889a8b8062fef8eb5be708

SHA512
d5605e3f6160192b739aad221512307767d38984512f0dd917403daf9111f0d71c3305128fe0e0365cd5f180349146fba02006d646ae8793461459d6e2baa1b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\f338f622fb\gntuud.exe
Filesize
780KB

MD5
d53cf9d2e7b6410bec5b8960643cbbc8

SHA1
55afb898ddcb5ef0af47ba7a82d8b820d7496dd6

SHA256
dfe955ab261dff65d5bfc3989342fb0bb9d4418485889a8b8062fef8eb5be708

SHA512
d5605e3f6160192b739aad221512307767d38984512f0dd917403daf9111f0d71c3305128fe0e0365cd5f180349146fba02006d646ae8793461459d6e2baa1b2

Download Submit
C:\Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dll
Filesize
126KB

MD5
f6d14701e7c568254151e153f7763672

SHA1
4501ffb7284f29cca51b06deba0262b8d33f93f6

SHA256
e246c844a272e80f2819e754e79a394e0fc964ad583ae90110dc38a01100b44d

SHA512
62c1d6cbe6531a6b5d2a9fcdddd91cc3971dd81f1f5208e88c02d97d066e1b04665122817acb228894937279c49ac627bdb3c42cb32e130e39201f3108cde8f2

Download Submit
C:\Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dll
Filesize
126KB

MD5
f6d14701e7c568254151e153f7763672

SHA1
4501ffb7284f29cca51b06deba0262b8d33f93f6

SHA256
e246c844a272e80f2819e754e79a394e0fc964ad583ae90110dc38a01100b44d

SHA512
62c1d6cbe6531a6b5d2a9fcdddd91cc3971dd81f1f5208e88c02d97d066e1b04665122817acb228894937279c49ac627bdb3c42cb32e130e39201f3108cde8f2

Download Submit
C:\Users\Admin\AppData\Roaming\8f80aeaa2e33b8\cred64.dll
Filesize
126KB

MD5
f6d14701e7c568254151e153f7763672

SHA1
4501ffb7284f29cca51b06deba0262b8d33f93f6

SHA256
e246c844a272e80f2819e754e79a394e0fc964ad583ae90110dc38a01100b44d

SHA512
62c1d6cbe6531a6b5d2a9fcdddd91cc3971dd81f1f5208e88c02d97d066e1b04665122817acb228894937279c49ac627bdb3c42cb32e130e39201f3108cde8f2

Download Submit
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
Filesize
126KB

MD5
674cec24e36e0dfaec6290db96dda86e

SHA1
581e3a7a541cc04641e751fc850d92e07236681f

SHA256
de81531468982b689451e85d249214d0aa484e2ffedfd32c58d43cf879f29ded

SHA512
6d9898169073c240fe454bd45065fd7dc8458f1d323925b57eb58fa4305bb0d5631bbceb61835593b225e887e0867186ef637c440460279378cb29e832066029

Download Submit
C:\Users\Admin\AppData\Roaming\bf045808586a24\cred64.dll
Filesize
126KB

MD5
674cec24e36e0dfaec6290db96dda86e

SHA1
581e3a7a541cc04641e751fc850d92e07236681f

SHA256
de81531468982b689451e85d249214d0aa484e2ffedfd32c58d43cf879f29ded

SHA512
6d9898169073c240fe454bd45065fd7dc8458f1d323925b57eb58fa4305bb0d5631bbceb61835593b225e887e0867186ef637c440460279378cb29e832066029

Download Submit
memory/364-229-0x0000000000000000-mapping.dmp

Download
memory/644-184-0x0000000000DC0000-0x0000000000DCD000-memory.dmp

Filesize
52KB

Download
memory/644-183-0x0000000000DD0000-0x0000000000DD7000-memory.dmp

Filesize
28KB

Download
memory/644-206-0x0000000000DD0000-0x0000000000DD7000-memory.dmp

Filesize
28KB

Download
memory/644-181-0x0000000000000000-mapping.dmp

Download
memory/1192-172-0x00000000008F0000-0x00000000008FF000-memory.dmp

Filesize
60KB

Download
memory/1192-203-0x0000000000900000-0x0000000000909000-memory.dmp

Filesize
36KB

Download
memory/1192-174-0x0000000000900000-0x0000000000909000-memory.dmp

Filesize
36KB

Download
memory/1192-168-0x0000000000000000-mapping.dmp

Download
memory/1372-201-0x0000000001170000-0x000000000117B000-memory.dmp

Filesize
44KB

Download
memory/1372-180-0x0000000000000000-mapping.dmp

Download
memory/1372-193-0x0000000001180000-0x0000000001186000-memory.dmp

Filesize
24KB

Download
memory/1472-199-0x0000000001140000-0x000000000114B000-memory.dmp

Filesize
44KB

Download
memory/1472-191-0x0000000001150000-0x0000000001158000-memory.dmp

Filesize
32KB

Download
memory/1472-185-0x0000000000000000-mapping.dmp

Download
memory/1560-136-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/1560-133-0x00000000008A0000-0x00000000008A9000-memory.dmp

Filesize
36KB

Download
memory/1560-132-0x000000000091E000-0x000000000092F000-memory.dmp

Filesize
68KB

Download
memory/1560-134-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/1560-135-0x000000000091E000-0x000000000092F000-memory.dmp

Filesize
68KB

Download
memory/1696-224-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/1696-223-0x0000000000A4C000-0x0000000000A6B000-memory.dmp

Filesize
124KB

Download
memory/1696-211-0x0000000000000000-mapping.dmp

Download
memory/1696-232-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/1992-237-0x0000000000000000-mapping.dmp

Download
memory/1992-241-0x0000000002810000-0x00000000029DF000-memory.dmp

Filesize
1.8MB

Download
memory/2220-246-0x0000000000000000-mapping.dmp

Download
memory/2220-250-0x0000000000960000-0x0000000000984000-memory.dmp

Filesize
144KB

Download
memory/2268-169-0x0000000000000000-mapping.dmp

Download
memory/2268-196-0x0000000000730000-0x0000000000739000-memory.dmp

Filesize
36KB

Download
memory/2268-194-0x0000000000740000-0x0000000000745000-memory.dmp

Filesize
20KB

Download
memory/2448-198-0x00000000003C0000-0x00000000003C9000-memory.dmp

Filesize
36KB

Download
memory/2448-192-0x00000000003D0000-0x00000000003D5000-memory.dmp

Filesize
20KB

Download
memory/2448-178-0x0000000000000000-mapping.dmp

Download
memory/2808-218-0x0000000000000000-mapping.dmp

Download
memory/3088-202-0x00007FFED9600000-0x00007FFEDA0C1000-memory.dmp

Filesize
10.8MB

Download
memory/3088-221-0x00000237C457A000-0x00000237C457F000-memory.dmp

Filesize
20KB

Download
memory/3088-209-0x00000237C457A000-0x00000237C457F000-memory.dmp

Filesize
20KB

Download
memory/3088-205-0x00000237C5390000-0x00000237C542B000-memory.dmp

Filesize
620KB

Download
memory/3088-170-0x00007FFED9600000-0x00007FFEDA0C1000-memory.dmp

Filesize
10.8MB

Download
memory/3088-233-0x00007FFED9600000-0x00007FFEDA0C1000-memory.dmp

Filesize
10.8MB

Download
memory/3088-234-0x00000237C457A000-0x00000237C457F000-memory.dmp

Filesize
20KB

Download
memory/3088-179-0x00000237AB080000-0x00000237AB0A2000-memory.dmp

Filesize
136KB

Download
memory/3088-155-0x00000237A93D0000-0x00000237A955C000-memory.dmp

Filesize
1.5MB

Download
memory/3088-146-0x0000000000000000-mapping.dmp

Download
memory/3132-259-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/3364-195-0x00000000011A0000-0x00000000011C2000-memory.dmp

Filesize
136KB

Download
memory/3364-200-0x0000000001170000-0x0000000001197000-memory.dmp

Filesize
156KB

Download
memory/3364-177-0x0000000000000000-mapping.dmp

Download
memory/3496-171-0x00000000008A0000-0x0000000000C4E000-memory.dmp

Filesize
3.7MB

Download
memory/3496-143-0x0000000000000000-mapping.dmp

Download
memory/3824-167-0x0000000000000000-mapping.dmp

Download
memory/3824-190-0x0000000001180000-0x0000000001187000-memory.dmp

Filesize
28KB

Download
memory/3824-197-0x0000000001170000-0x000000000117B000-memory.dmp

Filesize
44KB

Download
memory/3964-137-0x0000000000000000-mapping.dmp

Download
memory/3976-149-0x0000000000000000-mapping.dmp

Download
memory/3976-150-0x0000000000A50000-0x0000000000CBF000-memory.dmp

Filesize
2.4MB

Download
memory/3976-166-0x0000000000A50000-0x0000000000CBF000-memory.dmp

Filesize
2.4MB

Download
memory/4228-251-0x0000000000000000-mapping.dmp

Download
memory/4240-182-0x00000000022D0000-0x000000000232C000-memory.dmp

Filesize
368KB

Download
memory/4240-188-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4240-216-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4240-140-0x0000000000000000-mapping.dmp

Download
memory/4536-228-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4536-210-0x0000000000000000-mapping.dmp

Download
memory/4536-217-0x0000000000400000-0x00000000004CA000-memory.dmp

Filesize
808KB

Download
memory/4624-236-0x0000000000000000-mapping.dmp

Download
memory/4692-245-0x0000000005210000-0x000000000524C000-memory.dmp

Filesize
240KB

Download
memory/4692-261-0x0000000007180000-0x00000000076AC000-memory.dmp

Filesize
5.2MB

Download
memory/4692-256-0x0000000006300000-0x00000000068A4000-memory.dmp

Filesize
5.6MB

Download
memory/4692-235-0x0000000000800000-0x0000000000828000-memory.dmp

Filesize
160KB

Download
memory/4692-242-0x0000000005730000-0x0000000005D48000-memory.dmp

Filesize
6.1MB

Download
memory/4692-243-0x0000000005280000-0x000000000538A000-memory.dmp

Filesize
1.0MB

Download
memory/4692-244-0x00000000051B0000-0x00000000051C2000-memory.dmp

Filesize
72KB

Download
memory/4692-257-0x0000000005F20000-0x0000000005FB2000-memory.dmp

Filesize
584KB

Download
memory/4692-225-0x0000000000000000-mapping.dmp

Download
memory/4692-260-0x0000000006A80000-0x0000000006C42000-memory.dmp

Filesize
1.8MB

Download
memory/4692-258-0x0000000005FC0000-0x0000000006026000-memory.dmp

Filesize
408KB

Download
memory/4728-222-0x0000000000000000-mapping.dmp

Download
memory/4788-173-0x0000000000000000-mapping.dmp

Download
memory/4788-176-0x0000000001030000-0x000000000103C000-memory.dmp

Filesize
48KB

Download
memory/4788-204-0x0000000001040000-0x0000000001046000-memory.dmp

Filesize
24KB

Download
memory/4788-175-0x0000000001040000-0x0000000001046000-memory.dmp

Filesize
24KB

Download
memory/4828-187-0x0000000000870000-0x00000000008AE000-memory.dmp

Filesize
248KB

Download
memory/4828-219-0x000000000090D000-0x000000000092C000-memory.dmp

Filesize
124KB

Download
memory/4828-220-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/4828-189-0x0000000000400000-0x000000000071D000-memory.dmp

Filesize
3.1MB

Download
memory/4828-186-0x000000000090D000-0x000000000092C000-memory.dmp

Filesize
124KB

Download
memory/4828-208-0x0000000000870000-0x00000000008AE000-memory.dmp

Filesize
248KB

Download
memory/4828-156-0x0000000000000000-mapping.dmp

Download
memory/4828-207-0x000000000090D000-0x000000000092C000-memory.dmp

Filesize
124KB

Download