amadey | 4ada782bf1a9a2fd7b1e5c351fd4ecaaafd19e9e07ae9a26847b65bf48c318ce

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2023 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ada782bf1a9a2fd7b1e5c351fd4ecaaafd19e9e07ae9a26847b65bf48c318ce.exe
Size

639KB
MD5

4b9a2c82dae5a6747c9b6a635874fe1b
SHA1

16849642f7562fb28a7c57493ede6dc14e71e423
SHA256

4ada782bf1a9a2fd7b1e5c351fd4ecaaafd19e9e07ae9a26847b65bf48c318ce
SHA512

3ef6541eb83fa9734b0277ba753b449f4c2f47d3f8e0b6e46cfcd0c706e0e4c91478f883b1698755351ada6dec7f463562f31f832aa23f7e84c904b3b8ff6a5d
SSDEEP

12288:iMrNy90KItLD9U6csc0Wlc5ao392/gTlYQbOH8t4MhxphtwML/:XyhAlpcw391pjOYFrjr

Score

10^/10

amadey healer redline smokeloader 0305 papik backdoor discovery dropper evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.86

http://77.91.68.61/rock/index.php

Attributes

install_dir
925e7e99c5
install_file
pdates.exe
strings_key
ada76b8b0e1f6892ee93c20ab8946117

rc4.plain

Extracted

Family

smokeloader

Version

2022

http://77.91.68.29/fks/

rc4.i32

Extracted

Family

redline

Botnet

papik

77.91.124.156:19071

Attributes

auth_value
325a615d8be5db8e2f7a4c2448fdac3a

Extracted

Family

redline

Botnet

0305

185.215.113.25:10195

Attributes

auth_value
c86205ff1cc37b2da12f0190adfda52c

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5298088.exe	healer
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5298088.exe	healer
behavioral2/memory/1296-28-0x00000000002E0000-0x00000000002EA000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

a5298088.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	a5298088.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	a5298088.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	a5298088.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	a5298088.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	a5298088.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	a5298088.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

b2824343.exepdates.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000\Control Panel\International\Geo\Nation	b2824343.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000\Control Panel\International\Geo\Nation	pdates.exe

Executes dropped EXE 13 IoCs

Processes:

v1943436.exev7679029.exev9111658.exea5298088.exeb2824343.exepdates.exec3090472.exed9855588.exepdates.exeF836.exeFB63.exepdates.exepdates.exe

pid	process
216	v1943436.exe
4768	v7679029.exe
3868	v9111658.exe
1296	a5298088.exe
4940	b2824343.exe
2288	pdates.exe
1972	c3090472.exe
1792	d9855588.exe
1132	pdates.exe
1936	F836.exe
2856	FB63.exe
3084	pdates.exe
4128	pdates.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

448 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Processes:

a5298088.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" a5298088.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
448	rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	a5298088.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

4ada782bf1a9a2fd7b1e5c351fd4ecaaafd19e9e07ae9a26847b65bf48c318ce.exev1943436.exev7679029.exev9111658.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4ada782bf1a9a2fd7b1e5c351fd4ecaaafd19e9e07ae9a26847b65bf48c318ce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	v1943436.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	v7679029.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	v9111658.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

c3090472.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c3090472.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c3090472.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	c3090472.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3416 schtasks.exe

pid	process
3416	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000\Software\Microsoft\Internet Explorer\IESettingSync
Set value (int)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"

Modifies registry class 1 IoCs

Processes:

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

2944 vlc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings

pid	process
2944	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a5298088.exec3090472.exe

pid	process
1296	a5298088.exe
1296	a5298088.exe
1972	c3090472.exe
1972	c3090472.exe
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232
3232

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

vlc.exe

pid process

3232
2944 vlc.exe
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

c3090472.exe

pid process

1972 c3090472.exe

pid	process
3232
2944	vlc.exe

pid	process
1972	c3090472.exe

Suspicious use of AdjustPrivilegeToken 57 IoCs

Processes:

a5298088.exeF836.exeFB63.exe

description	pid	process
Token: SeDebugPrivilege	1296	a5298088.exe
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeDebugPrivilege	1936	F836.exe
Token: SeDebugPrivilege	2856	FB63.exe
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232
Token: SeShutdownPrivilege	3232
Token: SeCreatePagefilePrivilege	3232

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

b2824343.exevlc.exe

pid process

4940 b2824343.exe
3232
3232
2944 vlc.exe
3232
3232
2944 vlc.exe
2944 vlc.exe
2944 vlc.exe
3232
3232
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

vlc.exe

pid process

2944 vlc.exe
2944 vlc.exe
2944 vlc.exe
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vlc.exe

pid process

2944 vlc.exe

pid	process
4940	b2824343.exe
3232
3232
2944	vlc.exe
3232
3232
2944	vlc.exe
2944	vlc.exe
2944	vlc.exe
3232
3232

pid	process
2944	vlc.exe
2944	vlc.exe
2944	vlc.exe

pid	process
2944	vlc.exe

Suspicious use of WriteProcessMemory 58 IoCs

Processes:

4ada782bf1a9a2fd7b1e5c351fd4ecaaafd19e9e07ae9a26847b65bf48c318ce.exev1943436.exev7679029.exev9111658.exeb2824343.exepdates.execmd.exe

description	pid	process	target process
PID 1304 wrote to memory of 216	1304	4ada782bf1a9a2fd7b1e5c351fd4ecaaafd19e9e07ae9a26847b65bf48c318ce.exe	v1943436.exe
PID 1304 wrote to memory of 216	1304	4ada782bf1a9a2fd7b1e5c351fd4ecaaafd19e9e07ae9a26847b65bf48c318ce.exe	v1943436.exe
PID 1304 wrote to memory of 216	1304	4ada782bf1a9a2fd7b1e5c351fd4ecaaafd19e9e07ae9a26847b65bf48c318ce.exe	v1943436.exe
PID 216 wrote to memory of 4768	216	v1943436.exe	v7679029.exe
PID 216 wrote to memory of 4768	216	v1943436.exe	v7679029.exe
PID 216 wrote to memory of 4768	216	v1943436.exe	v7679029.exe
PID 4768 wrote to memory of 3868	4768	v7679029.exe	v9111658.exe
PID 4768 wrote to memory of 3868	4768	v7679029.exe	v9111658.exe
PID 4768 wrote to memory of 3868	4768	v7679029.exe	v9111658.exe
PID 3868 wrote to memory of 1296	3868	v9111658.exe	a5298088.exe
PID 3868 wrote to memory of 1296	3868	v9111658.exe	a5298088.exe
PID 3868 wrote to memory of 4940	3868	v9111658.exe	b2824343.exe
PID 3868 wrote to memory of 4940	3868	v9111658.exe	b2824343.exe
PID 3868 wrote to memory of 4940	3868	v9111658.exe	b2824343.exe
PID 4940 wrote to memory of 2288	4940	b2824343.exe	pdates.exe
PID 4940 wrote to memory of 2288	4940	b2824343.exe	pdates.exe
PID 4940 wrote to memory of 2288	4940	b2824343.exe	pdates.exe
PID 4768 wrote to memory of 1972	4768	v7679029.exe	c3090472.exe
PID 4768 wrote to memory of 1972	4768	v7679029.exe	c3090472.exe
PID 4768 wrote to memory of 1972	4768	v7679029.exe	c3090472.exe
PID 2288 wrote to memory of 3416	2288	pdates.exe	schtasks.exe
PID 2288 wrote to memory of 3416	2288	pdates.exe	schtasks.exe
PID 2288 wrote to memory of 3416	2288	pdates.exe	schtasks.exe
PID 2288 wrote to memory of 1096	2288	pdates.exe	cmd.exe
PID 2288 wrote to memory of 1096	2288	pdates.exe	cmd.exe
PID 2288 wrote to memory of 1096	2288	pdates.exe	cmd.exe
PID 1096 wrote to memory of 1412	1096	cmd.exe	cmd.exe
PID 1096 wrote to memory of 1412	1096	cmd.exe	cmd.exe
PID 1096 wrote to memory of 1412	1096	cmd.exe	cmd.exe
PID 1096 wrote to memory of 5092	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 5092	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 5092	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 1984	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 1984	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 1984	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 1556	1096	cmd.exe	cmd.exe
PID 1096 wrote to memory of 1556	1096	cmd.exe	cmd.exe
PID 1096 wrote to memory of 1556	1096	cmd.exe	cmd.exe
PID 1096 wrote to memory of 1584	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 1584	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 1584	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 3028	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 3028	1096	cmd.exe	cacls.exe
PID 1096 wrote to memory of 3028	1096	cmd.exe	cacls.exe
PID 216 wrote to memory of 1792	216	v1943436.exe	d9855588.exe
PID 216 wrote to memory of 1792	216	v1943436.exe	d9855588.exe
PID 216 wrote to memory of 1792	216	v1943436.exe	d9855588.exe
PID 3232 wrote to memory of 2944	3232		vlc.exe
PID 3232 wrote to memory of 2944	3232		vlc.exe
PID 2288 wrote to memory of 448	2288	pdates.exe	rundll32.exe
PID 2288 wrote to memory of 448	2288	pdates.exe	rundll32.exe
PID 2288 wrote to memory of 448	2288	pdates.exe	rundll32.exe
PID 3232 wrote to memory of 1936	3232		F836.exe
PID 3232 wrote to memory of 1936	3232		F836.exe
PID 3232 wrote to memory of 1936	3232		F836.exe
PID 3232 wrote to memory of 2856	3232		FB63.exe
PID 3232 wrote to memory of 2856	3232		FB63.exe
PID 3232 wrote to memory of 2856	3232		FB63.exe

C:\Users\Admin\AppData\Local\Temp\4ada782bf1a9a2fd7b1e5c351fd4ecaaafd19e9e07ae9a26847b65bf48c318ce.exe
"C:\Users\Admin\AppData\Local\Temp\4ada782bf1a9a2fd7b1e5c351fd4ecaaafd19e9e07ae9a26847b65bf48c318ce.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1943436.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1943436.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:216
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7679029.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7679029.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9111658.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9111658.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5298088.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5298088.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1296
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2824343.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2824343.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
        
        "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2288
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:3416
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1096
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:N"
        8⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "pdates.exe" /P "Admin:R" /E
        8⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:N"
        8⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\925e7e99c5" /P "Admin:R" /E
        8⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        7⤵
        Loads dropped DLL
        
        PID:448
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3090472.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3090472.exe
      4⤵
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:1972
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d9855588.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d9855588.exe
    3⤵
    - Executes dropped EXE
    PID:1792

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:1132

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\GrantComplete.mp4"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2944

C:\Users\Admin\AppData\Local\Temp\F836.exe
C:\Users\Admin\AppData\Local\Temp\F836.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1936

C:\Users\Admin\AppData\Local\Temp\FB63.exe
C:\Users\Admin\AppData\Local\Temp\FB63.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2856

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:3084

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
1⤵
- Executes dropped EXE
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
227KB

MD5
816bae1c1895ce3277ecfad5577722b6

SHA1
cf85d34a84f2f7931d1852314d4deaf34e4aefa4

SHA256
d6037d67f4ecfb120a7654ef87d402f71f405473805adb49908aa2e2fc8bca0c

SHA512
ce8769a5a551b43b9a7efc0ddc6c0c35025e81476cb274a28087f8fe48fbf7e77bbacc18ba35677d58c5d96b8156d8dd8ceb951c75c93c55da2274535e7f9994

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
227KB

MD5
816bae1c1895ce3277ecfad5577722b6

SHA1
cf85d34a84f2f7931d1852314d4deaf34e4aefa4

SHA256
d6037d67f4ecfb120a7654ef87d402f71f405473805adb49908aa2e2fc8bca0c

SHA512
ce8769a5a551b43b9a7efc0ddc6c0c35025e81476cb274a28087f8fe48fbf7e77bbacc18ba35677d58c5d96b8156d8dd8ceb951c75c93c55da2274535e7f9994

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
227KB

MD5
816bae1c1895ce3277ecfad5577722b6

SHA1
cf85d34a84f2f7931d1852314d4deaf34e4aefa4

SHA256
d6037d67f4ecfb120a7654ef87d402f71f405473805adb49908aa2e2fc8bca0c

SHA512
ce8769a5a551b43b9a7efc0ddc6c0c35025e81476cb274a28087f8fe48fbf7e77bbacc18ba35677d58c5d96b8156d8dd8ceb951c75c93c55da2274535e7f9994

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
227KB

MD5
816bae1c1895ce3277ecfad5577722b6

SHA1
cf85d34a84f2f7931d1852314d4deaf34e4aefa4

SHA256
d6037d67f4ecfb120a7654ef87d402f71f405473805adb49908aa2e2fc8bca0c

SHA512
ce8769a5a551b43b9a7efc0ddc6c0c35025e81476cb274a28087f8fe48fbf7e77bbacc18ba35677d58c5d96b8156d8dd8ceb951c75c93c55da2274535e7f9994

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
227KB

MD5
816bae1c1895ce3277ecfad5577722b6

SHA1
cf85d34a84f2f7931d1852314d4deaf34e4aefa4

SHA256
d6037d67f4ecfb120a7654ef87d402f71f405473805adb49908aa2e2fc8bca0c

SHA512
ce8769a5a551b43b9a7efc0ddc6c0c35025e81476cb274a28087f8fe48fbf7e77bbacc18ba35677d58c5d96b8156d8dd8ceb951c75c93c55da2274535e7f9994

Download Submit
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Filesize
227KB

MD5
816bae1c1895ce3277ecfad5577722b6

SHA1
cf85d34a84f2f7931d1852314d4deaf34e4aefa4

SHA256
d6037d67f4ecfb120a7654ef87d402f71f405473805adb49908aa2e2fc8bca0c

SHA512
ce8769a5a551b43b9a7efc0ddc6c0c35025e81476cb274a28087f8fe48fbf7e77bbacc18ba35677d58c5d96b8156d8dd8ceb951c75c93c55da2274535e7f9994

Download Submit
C:\Users\Admin\AppData\Local\Temp\F836.exe

Filesize
341KB

MD5
8669fe397a7225ede807202f6a9d8390

SHA1
04a806a5c4218cb703cba85d3e636d0c8cbae043

SHA256
1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

SHA512
29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\F836.exe

Filesize
341KB

MD5
8669fe397a7225ede807202f6a9d8390

SHA1
04a806a5c4218cb703cba85d3e636d0c8cbae043

SHA256
1624a759791e49ce8f79dd249d3ac2aede589ffbe53db342e4c99e2fbbc1b90e

SHA512
29cad49434172a910ba7635058ecc02aacf43f648ee98b2c47c561332403a96847b5da817358095f7638295b238de8874bf34fb393670096bbf3caeb388a9c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB63.exe

Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\FB63.exe

Filesize
412KB

MD5
5200fbe07521eb001f145afb95d40283

SHA1
df6cfdf15b58a0bb24255b3902886dc375f3346f

SHA256
00c3f29f9a8aec0774256501c562275e2d866f0130a2b8a58d74003c6c77e812

SHA512
c38359959ce1083f94d2206d1b4b317e8c5d493168013b4e8c406acb5a55fd4f85ec7ce4d5e400b9105fd82eae3d6301d52346f040a64c09981185c66f2cbf75

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1943436.exe

Filesize
514KB

MD5
4a9a8315e08ab3c5ebaec761ba363846

SHA1
d78a4ae3f3736604145ae07a5318513152291156

SHA256
64f9a22fea16d876f2b3128ae763e2803fddbfe3a97cd91be8e80114deead6eb

SHA512
99b71bafd8bf1eaa9ceff84cec55735a74caad790539cc1d7235d4e6918baa240e7469aef2faa3f93bd34fb0933222ecdfc8afb1ff150f4b3d1d77a13276655a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\v1943436.exe

Filesize
514KB

MD5
4a9a8315e08ab3c5ebaec761ba363846

SHA1
d78a4ae3f3736604145ae07a5318513152291156

SHA256
64f9a22fea16d876f2b3128ae763e2803fddbfe3a97cd91be8e80114deead6eb

SHA512
99b71bafd8bf1eaa9ceff84cec55735a74caad790539cc1d7235d4e6918baa240e7469aef2faa3f93bd34fb0933222ecdfc8afb1ff150f4b3d1d77a13276655a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d9855588.exe

Filesize
173KB

MD5
43981693053923e1a57a9fb579c4f75a

SHA1
64a21e3e3ba5121d4a799e0fccd1f20af6f82e25

SHA256
fac54a8c9f27428f3531d4cfa06c30743c51d112f5f49c564d58045b47a11fd6

SHA512
cd73973def2f972af937f6a942911af6477bcfc5b508d55100857decdf5300bf7ec1581bd1fb969236885c8e849b6471d61a331bbdad4715e2c05f9c43b4057a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\d9855588.exe

Filesize
173KB

MD5
43981693053923e1a57a9fb579c4f75a

SHA1
64a21e3e3ba5121d4a799e0fccd1f20af6f82e25

SHA256
fac54a8c9f27428f3531d4cfa06c30743c51d112f5f49c564d58045b47a11fd6

SHA512
cd73973def2f972af937f6a942911af6477bcfc5b508d55100857decdf5300bf7ec1581bd1fb969236885c8e849b6471d61a331bbdad4715e2c05f9c43b4057a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7679029.exe

Filesize
359KB

MD5
177599010642041a74679ae4de272585

SHA1
363baef7ab1250dd1474f07c4f340e4fc5d677d2

SHA256
5131c72cabec7a343fb00926054ea641c8b88f01dfea4afb59fa4904e5db4c8a

SHA512
1159a011c64f210c0b5f587ed83f5533a288a53bc5924aad361b540098d236042e6faac52562c98482436101827eb0072672719ef16c3ec6b83a4d654af0937c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\v7679029.exe

Filesize
359KB

MD5
177599010642041a74679ae4de272585

SHA1
363baef7ab1250dd1474f07c4f340e4fc5d677d2

SHA256
5131c72cabec7a343fb00926054ea641c8b88f01dfea4afb59fa4904e5db4c8a

SHA512
1159a011c64f210c0b5f587ed83f5533a288a53bc5924aad361b540098d236042e6faac52562c98482436101827eb0072672719ef16c3ec6b83a4d654af0937c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3090472.exe

Filesize
37KB

MD5
07d1424642ef120d01a5f8ec3655620a

SHA1
c97d7eabf451d934702e59c3bad535349d44073d

SHA256
793efa0f022bf158c4b0d70f0119e787216b911f4141fbdca7d1888480f6e604

SHA512
73081c42eb9f05ed6330a27dd35fdb4c3d526fb9abefc77337f23ab7c40e4137ae5ac99933fc9b927aaee1856addb6c1ffc311371ce7dac989c2bb6a40717d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\c3090472.exe

Filesize
37KB

MD5
07d1424642ef120d01a5f8ec3655620a

SHA1
c97d7eabf451d934702e59c3bad535349d44073d

SHA256
793efa0f022bf158c4b0d70f0119e787216b911f4141fbdca7d1888480f6e604

SHA512
73081c42eb9f05ed6330a27dd35fdb4c3d526fb9abefc77337f23ab7c40e4137ae5ac99933fc9b927aaee1856addb6c1ffc311371ce7dac989c2bb6a40717d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9111658.exe

Filesize
234KB

MD5
063c63685d99cd7886d779e6044043c5

SHA1
0bb9d6af814d1f07cc7b90202c5f00a3e50a42f9

SHA256
e53e9b5cae6d5dbf5dc867efe8e384046195c78a97642e7f4077dfa269cb5607

SHA512
ac180999f6f9aca3465b458bd6009eea1e803124c62fe01a2aa7a8848131e804dc657e734bdbf2c0cfd19dd66e3eec8efdcb1fa6aa62da14493a21d14e6f7d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\v9111658.exe

Filesize
234KB

MD5
063c63685d99cd7886d779e6044043c5

SHA1
0bb9d6af814d1f07cc7b90202c5f00a3e50a42f9

SHA256
e53e9b5cae6d5dbf5dc867efe8e384046195c78a97642e7f4077dfa269cb5607

SHA512
ac180999f6f9aca3465b458bd6009eea1e803124c62fe01a2aa7a8848131e804dc657e734bdbf2c0cfd19dd66e3eec8efdcb1fa6aa62da14493a21d14e6f7d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5298088.exe

Filesize
11KB

MD5
bbd440498315e029d0707a934d76cb98

SHA1
36503d21cccc67be0c8143f51d066f7c0d9ad3b0

SHA256
5256ce16ffd51bb8705484957104fd08108954094c1a63e96af68624a4ec23a3

SHA512
5d42afbcdcfa1ceab806af9a6547f9c1b880ba8ed8ef75d4abaa6c8523ca91018afc8d852ab6f4b63833db6d8edb2e48dae4bab12709140ddcd8fd3c978c3cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\a5298088.exe

Filesize
11KB

MD5
bbd440498315e029d0707a934d76cb98

SHA1
36503d21cccc67be0c8143f51d066f7c0d9ad3b0

SHA256
5256ce16ffd51bb8705484957104fd08108954094c1a63e96af68624a4ec23a3

SHA512
5d42afbcdcfa1ceab806af9a6547f9c1b880ba8ed8ef75d4abaa6c8523ca91018afc8d852ab6f4b63833db6d8edb2e48dae4bab12709140ddcd8fd3c978c3cd3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2824343.exe

Filesize
227KB

MD5
816bae1c1895ce3277ecfad5577722b6

SHA1
cf85d34a84f2f7931d1852314d4deaf34e4aefa4

SHA256
d6037d67f4ecfb120a7654ef87d402f71f405473805adb49908aa2e2fc8bca0c

SHA512
ce8769a5a551b43b9a7efc0ddc6c0c35025e81476cb274a28087f8fe48fbf7e77bbacc18ba35677d58c5d96b8156d8dd8ceb951c75c93c55da2274535e7f9994

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\b2824343.exe

Filesize
227KB

MD5
816bae1c1895ce3277ecfad5577722b6

SHA1
cf85d34a84f2f7931d1852314d4deaf34e4aefa4

SHA256
d6037d67f4ecfb120a7654ef87d402f71f405473805adb49908aa2e2fc8bca0c

SHA512
ce8769a5a551b43b9a7efc0ddc6c0c35025e81476cb274a28087f8fe48fbf7e77bbacc18ba35677d58c5d96b8156d8dd8ceb951c75c93c55da2274535e7f9994

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2392b231cf4a80739b5cb09bf808127d

SHA1
41b5cf81c50884954911d96444fe83cfd0da465b

SHA256
2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f

SHA512
19ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2392b231cf4a80739b5cb09bf808127d

SHA1
41b5cf81c50884954911d96444fe83cfd0da465b

SHA256
2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f

SHA512
19ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2392b231cf4a80739b5cb09bf808127d

SHA1
41b5cf81c50884954911d96444fe83cfd0da465b

SHA256
2244b4dc9afc6cfab7ef1dea92420e2acd275bac7349b929a69f3c1ae25f5e2f

SHA512
19ceba063fa1cc1d0116eb11b18d6301a0e1eeda1cb5b983e331e59e4f12e4d0e36d7b4a1d8259dff57a79c47fdcedf89de8e255d932452e441762e4d440ce34

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
9851b884bf4aadfade57d911a3f03332

SHA1
aaadd1c1856c22844bb9fbb030cf4f586ed8866a

SHA256
03afb988f3eec62c2da682af371625adcac5a0e69615298f83d99365ab07ac0f

SHA512
a7de560f51bacd381d3e741f887c3c40ece88521ee93a22a4f7448297e8bda2131be866d9ae6438c528d9f40a277c18bae517deec16b6b723f67d4c308031327

Download Submit
memory/1296-31-0x00007FFD45130000-0x00007FFD45BF1000-memory.dmp

Filesize
10.8MB

Download
memory/1296-29-0x00007FFD45130000-0x00007FFD45BF1000-memory.dmp

Filesize
10.8MB

Download
memory/1296-28-0x00000000002E0000-0x00000000002EA000-memory.dmp

Filesize
40KB

Download
memory/1792-62-0x000000000A580000-0x000000000A5BC000-memory.dmp

Filesize
240KB

Download
memory/1792-58-0x000000000AA60000-0x000000000B078000-memory.dmp

Filesize
6.1MB

Download
memory/1792-64-0x0000000073530000-0x0000000073CE0000-memory.dmp

Filesize
7.7MB

Download
memory/1792-60-0x000000000A520000-0x000000000A532000-memory.dmp

Filesize
72KB

Download
memory/1792-61-0x0000000000DC0000-0x0000000000DD0000-memory.dmp

Filesize
64KB

Download
memory/1792-59-0x000000000A5E0000-0x000000000A6EA000-memory.dmp

Filesize
1.0MB

Download
memory/1792-57-0x0000000073530000-0x0000000073CE0000-memory.dmp

Filesize
7.7MB

Download
memory/1792-65-0x0000000000DC0000-0x0000000000DD0000-memory.dmp

Filesize
64KB

Download
memory/1792-56-0x0000000000630000-0x0000000000660000-memory.dmp

Filesize
192KB

Download
memory/1936-233-0x0000000007560000-0x000000000756A000-memory.dmp

Filesize
40KB

Download
memory/1936-235-0x0000000007FB0000-0x0000000008016000-memory.dmp

Filesize
408KB

Download
memory/1936-318-0x0000000007620000-0x0000000007630000-memory.dmp

Filesize
64KB

Download
memory/1936-317-0x0000000073530000-0x0000000073CE0000-memory.dmp

Filesize
7.7MB

Download
memory/1936-225-0x00000000005E0000-0x000000000063A000-memory.dmp

Filesize
360KB

Download
memory/1936-246-0x0000000009840000-0x000000000985E000-memory.dmp

Filesize
120KB

Download
memory/1936-245-0x000000000A040000-0x000000000A56C000-memory.dmp

Filesize
5.2MB

Download
memory/1936-244-0x0000000009940000-0x0000000009B02000-memory.dmp

Filesize
1.8MB

Download
memory/1936-243-0x00000000096F0000-0x0000000009766000-memory.dmp

Filesize
472KB

Download
memory/1936-226-0x0000000073530000-0x0000000073CE0000-memory.dmp

Filesize
7.7MB

Download
memory/1936-227-0x0000000007880000-0x0000000007E24000-memory.dmp

Filesize
5.6MB

Download
memory/1936-320-0x0000000073530000-0x0000000073CE0000-memory.dmp

Filesize
7.7MB

Download
memory/1936-228-0x00000000073B0000-0x0000000007442000-memory.dmp

Filesize
584KB

Download
memory/1936-229-0x0000000007620000-0x0000000007630000-memory.dmp

Filesize
64KB

Download
memory/1972-50-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1972-48-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2856-464-0x0000000073530000-0x0000000073CE0000-memory.dmp

Filesize
7.7MB

Download
memory/2856-461-0x0000000006710000-0x0000000006760000-memory.dmp

Filesize
320KB

Download
memory/2856-322-0x0000000005120000-0x0000000005130000-memory.dmp

Filesize
64KB

Download
memory/2856-241-0x0000000002730000-0x0000000002760000-memory.dmp

Filesize
192KB

Download
memory/2856-242-0x0000000073530000-0x0000000073CE0000-memory.dmp

Filesize
7.7MB

Download
memory/2856-321-0x0000000073530000-0x0000000073CE0000-memory.dmp

Filesize
7.7MB

Download
memory/2944-108-0x00007FFD438C0000-0x00007FFD43916000-memory.dmp

Filesize
344KB

Download
memory/2944-109-0x00007FFD43890000-0x00007FFD438B8000-memory.dmp

Filesize
160KB

Download
memory/2944-111-0x00007FFD45670000-0x00007FFD45687000-memory.dmp

Filesize
92KB

Download
memory/2944-110-0x00007FFD43860000-0x00007FFD43884000-memory.dmp

Filesize
144KB

Download
memory/2944-112-0x00007FFD43830000-0x00007FFD43853000-memory.dmp

Filesize
140KB

Download
memory/2944-113-0x00007FFD43810000-0x00007FFD43821000-memory.dmp

Filesize
68KB

Download
memory/2944-114-0x00007FFD437F0000-0x00007FFD43802000-memory.dmp

Filesize
72KB

Download
memory/2944-117-0x00007FFD43780000-0x00007FFD43792000-memory.dmp

Filesize
72KB

Download
memory/2944-116-0x00007FFD437A0000-0x00007FFD437B3000-memory.dmp

Filesize
76KB

Download
memory/2944-115-0x00007FFD437C0000-0x00007FFD437E1000-memory.dmp

Filesize
132KB

Download
memory/2944-118-0x00007FFD43640000-0x00007FFD4377B000-memory.dmp

Filesize
1.2MB

Download
memory/2944-119-0x00007FFD43610000-0x00007FFD4363C000-memory.dmp

Filesize
176KB

Download
memory/2944-120-0x00007FFD43450000-0x00007FFD43602000-memory.dmp

Filesize
1.7MB

Download
memory/2944-123-0x00007FFD43330000-0x00007FFD433C7000-memory.dmp

Filesize
604KB

Download
memory/2944-122-0x00007FFD433D0000-0x00007FFD433E1000-memory.dmp

Filesize
68KB

Download
memory/2944-124-0x00007FFD43310000-0x00007FFD43322000-memory.dmp

Filesize
72KB

Download
memory/2944-121-0x00007FFD433F0000-0x00007FFD4344C000-memory.dmp

Filesize
368KB

Download
memory/2944-125-0x00007FFD430D0000-0x00007FFD43301000-memory.dmp

Filesize
2.2MB

Download
memory/2944-126-0x00007FFD42FB0000-0x00007FFD430C2000-memory.dmp

Filesize
1.1MB

Download
memory/2944-128-0x00007FFD42F40000-0x00007FFD42F65000-memory.dmp

Filesize
148KB

Download
memory/2944-127-0x00007FFD42F70000-0x00007FFD42FA5000-memory.dmp

Filesize
212KB

Download
memory/2944-130-0x00007FFD42EB0000-0x00007FFD42F11000-memory.dmp

Filesize
388KB

Download
memory/2944-129-0x00007FFD42F20000-0x00007FFD42F31000-memory.dmp

Filesize
68KB

Download
memory/2944-132-0x00007FFD42E70000-0x00007FFD42E82000-memory.dmp

Filesize
72KB

Download
memory/2944-131-0x00007FFD42E90000-0x00007FFD42EA1000-memory.dmp

Filesize
68KB

Download
memory/2944-133-0x00007FFD42E50000-0x00007FFD42E63000-memory.dmp

Filesize
76KB

Download
memory/2944-134-0x00007FFD42DB0000-0x00007FFD42E4F000-memory.dmp

Filesize
636KB

Download
memory/2944-135-0x00007FFD42D90000-0x00007FFD42DA1000-memory.dmp

Filesize
68KB

Download
memory/2944-136-0x00007FFD42C80000-0x00007FFD42D82000-memory.dmp

Filesize
1.0MB

Download
memory/2944-141-0x00007FFD42BE0000-0x00007FFD42BF8000-memory.dmp

Filesize
96KB

Download
memory/2944-140-0x00007FFD42C00000-0x00007FFD42C12000-memory.dmp

Filesize
72KB

Download
memory/2944-139-0x00007FFD42C20000-0x00007FFD42C31000-memory.dmp

Filesize
68KB

Download
memory/2944-138-0x00007FFD42C40000-0x00007FFD42C51000-memory.dmp

Filesize
68KB

Download
memory/2944-143-0x00007FFD42B90000-0x00007FFD42BB9000-memory.dmp

Filesize
164KB

Download
memory/2944-137-0x00007FFD42C60000-0x00007FFD42C71000-memory.dmp

Filesize
68KB

Download
memory/2944-142-0x00007FFD42BC0000-0x00007FFD42BD6000-memory.dmp

Filesize
88KB

Download
memory/2944-107-0x00007FFD45690000-0x00007FFD456A1000-memory.dmp

Filesize
68KB

Download
memory/2944-106-0x00007FFD43920000-0x00007FFD4398F000-memory.dmp

Filesize
444KB

Download
memory/2944-105-0x00007FFD43990000-0x00007FFD439F7000-memory.dmp

Filesize
412KB

Download
memory/2944-104-0x00007FFD456B0000-0x00007FFD456E0000-memory.dmp

Filesize
192KB

Download
memory/2944-103-0x00007FFD456E0000-0x00007FFD456F8000-memory.dmp

Filesize
96KB

Download
memory/2944-102-0x00007FFD45700000-0x00007FFD45711000-memory.dmp

Filesize
68KB

Download
memory/2944-101-0x00007FFD45720000-0x00007FFD4573B000-memory.dmp

Filesize
108KB

Download
memory/2944-100-0x00007FFD45740000-0x00007FFD45751000-memory.dmp

Filesize
68KB

Download
memory/2944-99-0x00007FFD45760000-0x00007FFD45771000-memory.dmp

Filesize
68KB

Download
memory/2944-98-0x00007FFD45A30000-0x00007FFD45A41000-memory.dmp

Filesize
68KB

Download
memory/2944-97-0x00007FFD46280000-0x00007FFD46298000-memory.dmp

Filesize
96KB

Download
memory/2944-96-0x00007FFD46A80000-0x00007FFD46AA1000-memory.dmp

Filesize
132KB

Download
memory/2944-95-0x00007FFD45780000-0x00007FFD457BF000-memory.dmp

Filesize
252KB

Download
memory/2944-94-0x00007FFD43A00000-0x00007FFD44AAB000-memory.dmp

Filesize
16.7MB

Download
memory/2944-93-0x00007FFD45A50000-0x00007FFD45C50000-memory.dmp

Filesize
2.0MB

Download
memory/2944-92-0x00007FFD4BBC0000-0x00007FFD4BBD1000-memory.dmp

Filesize
68KB

Download
memory/2944-91-0x00007FFD4BF40000-0x00007FFD4BF5D000-memory.dmp

Filesize
116KB

Download
memory/2944-90-0x00007FFD4FAD0000-0x00007FFD4FAE1000-memory.dmp

Filesize
68KB

Download
memory/2944-89-0x00007FFD50CA0000-0x00007FFD50CB7000-memory.dmp

Filesize
92KB

Download
memory/2944-88-0x00007FFD54DA0000-0x00007FFD54DB1000-memory.dmp

Filesize
68KB

Download
memory/2944-87-0x00007FFD54F20000-0x00007FFD54F37000-memory.dmp

Filesize
92KB

Download
memory/2944-86-0x00007FFD54F70000-0x00007FFD54F88000-memory.dmp

Filesize
96KB

Download
memory/2944-85-0x00007FFD45210000-0x00007FFD454C4000-memory.dmp

Filesize
2.7MB

Download
memory/2944-84-0x00007FFD54E00000-0x00007FFD54E34000-memory.dmp

Filesize
208KB

Download
memory/2944-83-0x00007FF6E9B70000-0x00007FF6E9C68000-memory.dmp

Filesize
992KB

Download
memory/3232-49-0x0000000003170000-0x0000000003186000-memory.dmp

Filesize
88KB

Download