ammyyadmin | a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115

Analysis

max time kernel
152s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
25-10-2023 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
Size

3.4MB
MD5

8b6693a9fd8f3a9ca63e933c7e1284bc
SHA1

94fe1a59213d6cb266e5e6b8761b9b7a45512e1f
SHA256

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115
SHA512

882ffd091cae2a658cb5b992a3c3c8e06519bedcee1ed629b4d933bfbea2e32531e04519ca76f450a4a014bf851360cb56d72c7bd2c13907c308b26fa0a0a2e9
SSDEEP

49152:Q5qWhABbYQFw/3MywBAfm079cyxuc5BhBKiJ+av9kgzr0dt1cOZaX:ZWhEywBgm0OQ5BhkivHr0bps

Score

10^/10

ammyyadmin flawedammyy rhadamanthys smokeloader stealc backdoor bootkit collection discovery persistence rat spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://servermlogs27.xyz/statweb255/

http://servmblog45.xyz/statweb255/

http://demblog575.xyz/statweb255/

http://admlogs85x.xyz/statweb255/

http://blogmstat389.xyz/statweb255/

http://blogmstat255.xyz/statweb255/

rc4.i32

Extracted

Family

stealc

rc4.plain

Signatures

Ammyy Admin
Remote admin tool with various capabilities.
rat ammyyadmin

AmmyyAdmin payload 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp\svchost.exe	family_ammyyadmin
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp\svchost.exe	family_ammyyadmin

Detect rhadamanthys stealer shellcode 6 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2556-17-0x0000000003380000-0x0000000003780000-memory.dmp	family_rhadamanthys
behavioral1/memory/2556-18-0x0000000003380000-0x0000000003780000-memory.dmp	family_rhadamanthys
behavioral1/memory/2556-19-0x0000000003380000-0x0000000003780000-memory.dmp	family_rhadamanthys
behavioral1/memory/2556-20-0x0000000003380000-0x0000000003780000-memory.dmp	family_rhadamanthys
behavioral1/memory/2556-30-0x0000000003380000-0x0000000003780000-memory.dmp	family_rhadamanthys
behavioral1/memory/2556-32-0x0000000003380000-0x0000000003780000-memory.dmp	family_rhadamanthys

FlawedAmmyy RAT
Remote-access trojan based on leaked code for the Ammyy remote admin software.
trojan flawedammyy
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
stealer rhadamanthys
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe

description pid process target process

PID 2556 created 3284 2556 a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe Explorer.EXE
Downloads MZ/PE file

description	pid	process	target process
PID 2556 created 3284	2556	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	Explorer.EXE

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

sNa_h4am.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	sNa_h4am.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Control Panel\International\Geo\Nation	svchost.exe

Deletes itself 1 IoCs

Processes:

certreq.exe

pid process

2840 certreq.exe
Executes dropped EXE 5 IoCs

Processes:

sNa_h4am.exeC]2.exe0J).exeC]2.exesvchost.exe

pid process

1364 sNa_h4am.exe
4980 C]2.exe
1736 0J).exe
3240 C]2.exe
4100 svchost.exe
Loads dropped DLL 3 IoCs

Processes:

sNa_h4am.exerundll32.exe

pid process

1364 sNa_h4am.exe
1364 sNa_h4am.exe
2924 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2840	certreq.exe

pid	process
1364	sNa_h4am.exe
4980	C]2.exe
1736	0J).exe
3240	C]2.exe
4100	svchost.exe

pid	process
1364	sNa_h4am.exe
1364	sNa_h4am.exe
2924	rundll32.exe

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

Processes:

certreq.exeexplorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\11.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\10.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\12.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	certreq.exe
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	certreq.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

svchost.exe

description ioc process

File opened for modification \??\PhysicalDrive0 svchost.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exeC]2.exe

description	pid	process	target process
PID 3200 set thread context of 2556	3200	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
PID 4980 set thread context of 3240	4980	C]2.exe	C]2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1756 1364 WerFault.exe sNa_h4am.exe

pid	pid_target	process	target process
1756	1364	WerFault.exe	sNa_h4am.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

C]2.exe

description	ioc	process
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C]2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C]2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	C]2.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

sNa_h4am.execertreq.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sNa_h4am.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sNa_h4am.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	certreq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	certreq.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3336 timeout.exe

pid	process
3336	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.execertreq.exeC]2.exesNa_h4am.exeExplorer.EXE

pid	process
2556	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
2556	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
2556	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
2556	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
2840	certreq.exe
2840	certreq.exe
2840	certreq.exe
2840	certreq.exe
3240	C]2.exe
3240	C]2.exe
1364	sNa_h4am.exe
1364	sNa_h4am.exe
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

3284 Explorer.EXE

pid	process
3284	Explorer.EXE

Suspicious behavior: MapViewOfSection 33 IoCs

Processes:

C]2.exeExplorer.EXEexplorer.exe

pid	process
3240	C]2.exe
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
3284	Explorer.EXE
2920	explorer.exe
2920	explorer.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exeC]2.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	3200	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
Token: SeDebugPrivilege	4980	C]2.exe
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE
Token: SeShutdownPrivilege	3284	Explorer.EXE
Token: SeCreatePagefilePrivilege	3284	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

svchost.exe

pid process

4100 svchost.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

3284 Explorer.EXE

pid	process
4100	svchost.exe

pid	process
3284	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exea75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exeC]2.exesNa_h4am.execmd.exeExplorer.EXE

description	pid	process	target process
PID 3200 wrote to memory of 2556	3200	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
PID 3200 wrote to memory of 2556	3200	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
PID 3200 wrote to memory of 2556	3200	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
PID 3200 wrote to memory of 2556	3200	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
PID 3200 wrote to memory of 2556	3200	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
PID 3200 wrote to memory of 2556	3200	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
PID 3200 wrote to memory of 2556	3200	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
PID 3200 wrote to memory of 2556	3200	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
PID 2556 wrote to memory of 2840	2556	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	certreq.exe
PID 2556 wrote to memory of 2840	2556	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	certreq.exe
PID 2556 wrote to memory of 2840	2556	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	certreq.exe
PID 2556 wrote to memory of 2840	2556	a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe	certreq.exe
PID 4980 wrote to memory of 3240	4980	C]2.exe	C]2.exe
PID 4980 wrote to memory of 3240	4980	C]2.exe	C]2.exe
PID 4980 wrote to memory of 3240	4980	C]2.exe	C]2.exe
PID 4980 wrote to memory of 3240	4980	C]2.exe	C]2.exe
PID 4980 wrote to memory of 3240	4980	C]2.exe	C]2.exe
PID 4980 wrote to memory of 3240	4980	C]2.exe	C]2.exe
PID 1364 wrote to memory of 1508	1364	sNa_h4am.exe	cmd.exe
PID 1364 wrote to memory of 1508	1364	sNa_h4am.exe	cmd.exe
PID 1364 wrote to memory of 1508	1364	sNa_h4am.exe	cmd.exe
PID 1508 wrote to memory of 3336	1508	cmd.exe	timeout.exe
PID 1508 wrote to memory of 3336	1508	cmd.exe	timeout.exe
PID 1508 wrote to memory of 3336	1508	cmd.exe	timeout.exe
PID 3284 wrote to memory of 4496	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 4496	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 4496	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 4496	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 3052	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 3052	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 3052	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 232	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 232	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 232	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 232	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 1116	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 1116	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 1116	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 1116	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 4864	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 4864	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 4864	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 4864	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 4372	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 4372	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 4372	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 1684	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 1684	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 1684	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 1684	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2292	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2292	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2292	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2744	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2744	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2744	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2744	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2808	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2808	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2808	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2624	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2624	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2624	3284	Explorer.EXE	explorer.exe
PID 3284 wrote to memory of 2624	3284	Explorer.EXE	explorer.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3125601242-331447593-1512828465-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
  "C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3200
- - C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
    C:\Users\Admin\AppData\Local\Temp\a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2556
- C:\Windows\system32\certreq.exe
  "C:\Windows\system32\certreq.exe"
  2⤵
  - Deletes itself
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  - Accesses Microsoft Outlook profiles
  - outlook_office_path
  - outlook_win_path
  PID:4496
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:3052
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:232
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:1116
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:4864
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:4372
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:1684
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:2292
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:2744
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:2808
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:2624
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:1912
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  PID:4824
- C:\Windows\explorer.exe
  C:\Windows\explorer.exe
  2⤵
  PID:5100
- C:\Windows\SysWOW64\explorer.exe
  C:\Windows\SysWOW64\explorer.exe
  2⤵
  - Suspicious behavior: MapViewOfSection
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\A3C8.tmp\svchost.exe
    C:\Users\Admin\AppData\Local\Temp\A3C8.tmp\svchost.exe -debug
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of FindShellTrayWindow
    PID:4100
  - - C:\Windows\SYSTEM32\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\Temp\A3C8.tmp\aa_nts.dll",run
      4⤵
      Loads dropped DLL
      PID:2924

C:\Users\Admin\AppData\Local\Microsoft\sNa_h4am.exe
"C:\Users\Admin\AppData\Local\Microsoft\sNa_h4am.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Microsoft\sNa_h4am.exe" & del "C:\ProgramData\*.dll"" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5
    3⤵
    - Delays execution with timeout.exe
    PID:3336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 2504
  2⤵
  - Program crash
  PID:1756

C:\Users\Admin\AppData\Local\Microsoft\C]2.exe
"C:\Users\Admin\AppData\Local\Microsoft\C]2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Microsoft\C]2.exe
  C:\Users\Admin\AppData\Local\Microsoft\C]2.exe
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:3240

C:\Users\Admin\AppData\Local\Microsoft\0J).exe
"C:\Users\Admin\AppData\Local\Microsoft\0J).exe"
1⤵
- Executes dropped EXE
PID:1736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1364 -ip 1364
1⤵
PID:1840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\0J).exe

Filesize
968KB

MD5
2a40a56b3dbe361864baac57a7815de4

SHA1
a0b67c7eb5bb378010ada7a3cf6bfe4101df9049

SHA256
3d62c31dd2a3749a264d72bd87c287c9367d3198d612c5566ca54809b714af99

SHA512
6c426f00cac5bbf67fd6e56c95561b8ad94da32d1199cfbf5d9e3b2627b39cdf8e089856fd346a44097006a0f32a78480b32554f39ba4ceaf72182126f78e4b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\0J).exe

Filesize
968KB

MD5
2a40a56b3dbe361864baac57a7815de4

SHA1
a0b67c7eb5bb378010ada7a3cf6bfe4101df9049

SHA256
3d62c31dd2a3749a264d72bd87c287c9367d3198d612c5566ca54809b714af99

SHA512
6c426f00cac5bbf67fd6e56c95561b8ad94da32d1199cfbf5d9e3b2627b39cdf8e089856fd346a44097006a0f32a78480b32554f39ba4ceaf72182126f78e4b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\C]2.exe

Filesize
2.5MB

MD5
a5e52d00a57904485aeb8e6580ce4666

SHA1
8f10588d8fcb6bb4d734c6e31fdaf2c165f87d92

SHA256
13d55838fe9e2e638ea8d21e86dab4fc28c8d9ba94526b79d48d0e83ce21fe71

SHA512
f14ca4c6017ffff6df0141cd706770225b9418029b69e37ff1f7d50ce2941cefb1e3f6d20df1897cb6cf3dc8db8e171d4ee94b72dac0b9375c31cb2e652b0b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\C]2.exe

Filesize
2.5MB

MD5
a5e52d00a57904485aeb8e6580ce4666

SHA1
8f10588d8fcb6bb4d734c6e31fdaf2c165f87d92

SHA256
13d55838fe9e2e638ea8d21e86dab4fc28c8d9ba94526b79d48d0e83ce21fe71

SHA512
f14ca4c6017ffff6df0141cd706770225b9418029b69e37ff1f7d50ce2941cefb1e3f6d20df1897cb6cf3dc8db8e171d4ee94b72dac0b9375c31cb2e652b0b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\C]2.exe

Filesize
2.5MB

MD5
a5e52d00a57904485aeb8e6580ce4666

SHA1
8f10588d8fcb6bb4d734c6e31fdaf2c165f87d92

SHA256
13d55838fe9e2e638ea8d21e86dab4fc28c8d9ba94526b79d48d0e83ce21fe71

SHA512
f14ca4c6017ffff6df0141cd706770225b9418029b69e37ff1f7d50ce2941cefb1e3f6d20df1897cb6cf3dc8db8e171d4ee94b72dac0b9375c31cb2e652b0b76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\sNa_h4am.exe

Filesize
284KB

MD5
f445dce24fe09b59d9affb9f0a16ee7e

SHA1
9d2b2ef3e57c7a571c20d078dbac82576cdfcb30

SHA256
7476d2335a1f3cf87f1995a40147d6ee0acaf9cf0c9895a595365942b64be5a3

SHA512
6e721fbfc49a7780b20be1173795f602b3b4ccf9a8ce5625fc38ec15f818943dd7a0e56a75b4cb9719f2255b28d2ec538257f55ea383f2407069e5f93314edb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\sNa_h4am.exe

Filesize
284KB

MD5
f445dce24fe09b59d9affb9f0a16ee7e

SHA1
9d2b2ef3e57c7a571c20d078dbac82576cdfcb30

SHA256
7476d2335a1f3cf87f1995a40147d6ee0acaf9cf0c9895a595365942b64be5a3

SHA512
6e721fbfc49a7780b20be1173795f602b3b4ccf9a8ce5625fc38ec15f818943dd7a0e56a75b4cb9719f2255b28d2ec538257f55ea383f2407069e5f93314edb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\6DE6.tmp

Filesize
92KB

MD5
44d2ab225d5338fedd68e8983242a869

SHA1
98860eaac2087b0564e2d3e0bf0d1f25e21e0eeb

SHA256
217c293b309195f479ca76bf78898a98685ba2854639dfd1293950232a6c6695

SHA512
611eb322a163200b4718f0b48c7a50a5e245af35f0c539f500ad9b517c4400c06dd64a3df30310223a6328eeb38862be7556346ec14a460e33b5c923153ac4a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\6E27.tmp

Filesize
116KB

MD5
f70aa3fa04f0536280f872ad17973c3d

SHA1
50a7b889329a92de1b272d0ecf5fce87395d3123

SHA256
8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

SHA512
30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp\aa_nts.dll

Filesize
902KB

MD5
480a66902e6e7cdafaa6711e8697ff8c

SHA1
6ac730962e7c1dba9e2ecc5733a506544f3c8d11

SHA256
7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

SHA512
7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp\aa_nts.dll

Filesize
902KB

MD5
480a66902e6e7cdafaa6711e8697ff8c

SHA1
6ac730962e7c1dba9e2ecc5733a506544f3c8d11

SHA256
7eaaaa6010bbcd6bb8c9ad08d4b0966c7aedc9b2ac24758f170012ac36e508b5

SHA512
7d010cd47b7d1adf66f9c97afc6c3805997aa5c7cc6ff13eddee81f24cf2b95a3fe375ec5b3d6185c0bc8840b4ad91ae143c73a39af26391cc182ab6a1793ba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp\aa_nts.msg

Filesize
46B

MD5
3f05819f995b4dafa1b5d55ce8d1f411

SHA1
404449b79a16bfc4f64f2fd55cd73d5d27a85d71

SHA256
7e0bf0cbd06a087500a9c3b50254df3a8a2c2980921ab6a62ab1121941c80fc0

SHA512
34abb7df8b3a68e1649ff0d2762576a4d4e65da548e74b1aa65c2b82c1b89f90d053ecddac67c614ca6084dc5b2cb552949250fb70f49b536f1bcb0057717026

Download Submit
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp\svchost.exe

Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
C:\Users\Admin\AppData\Local\Temp\A3C8.tmp\svchost.exe

Filesize
798KB

MD5
90aadf2247149996ae443e2c82af3730

SHA1
050b7eba825412b24e3f02d76d7da5ae97e10502

SHA256
ee573647477339784dcef81024de1be1762833a20e5cc2b89a93e47d05b86b6a

SHA512
eec32bb82b230dd309c29712e72d4469250e651449e127479d178eddbafd5a46ec8048a753bc2c1a0fdf1dc3ed72a9453ca66fb49cbf0f95a12704e5427182be

Download Submit
memory/232-203-0x0000000000D90000-0x0000000000D99000-memory.dmp

Filesize
36KB

Download
memory/232-220-0x0000000000D90000-0x0000000000D99000-memory.dmp

Filesize
36KB

Download
memory/232-201-0x0000000000DA0000-0x0000000000DA4000-memory.dmp

Filesize
16KB

Download
memory/1116-205-0x0000000000420000-0x000000000042A000-memory.dmp

Filesize
40KB

Download
memory/1116-206-0x0000000000410000-0x000000000041B000-memory.dmp

Filesize
44KB

Download
memory/1116-204-0x0000000000410000-0x000000000041B000-memory.dmp

Filesize
44KB

Download
memory/1364-86-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/1364-207-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/1364-77-0x0000000000930000-0x0000000000A30000-memory.dmp

Filesize
1024KB

Download
memory/1364-78-0x0000000000780000-0x000000000079B000-memory.dmp

Filesize
108KB

Download
memory/1364-164-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/1364-79-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/1364-87-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1364-128-0x0000000000930000-0x0000000000A30000-memory.dmp

Filesize
1024KB

Download
memory/1364-139-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/1364-135-0x0000000000780000-0x000000000079B000-memory.dmp

Filesize
108KB

Download
memory/1684-216-0x0000000000370000-0x0000000000379000-memory.dmp

Filesize
36KB

Download
memory/1684-214-0x0000000000380000-0x0000000000385000-memory.dmp

Filesize
20KB

Download
memory/2292-219-0x0000000000EE0000-0x0000000000EEC000-memory.dmp

Filesize
48KB

Download
memory/2292-217-0x0000000000EE0000-0x0000000000EEC000-memory.dmp

Filesize
48KB

Download
memory/2292-218-0x0000000000EF0000-0x0000000000EF6000-memory.dmp

Filesize
24KB

Download
memory/2556-22-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2556-19-0x0000000003380000-0x0000000003780000-memory.dmp

Filesize
4.0MB

Download
memory/2556-10-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2556-13-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2556-14-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2556-16-0x00000000015C0000-0x00000000015C7000-memory.dmp

Filesize
28KB

Download
memory/2556-17-0x0000000003380000-0x0000000003780000-memory.dmp

Filesize
4.0MB

Download
memory/2556-18-0x0000000003380000-0x0000000003780000-memory.dmp

Filesize
4.0MB

Download
memory/2556-20-0x0000000003380000-0x0000000003780000-memory.dmp

Filesize
4.0MB

Download
memory/2556-23-0x00000000040C0000-0x00000000040F6000-memory.dmp

Filesize
216KB

Download
memory/2556-30-0x0000000003380000-0x0000000003780000-memory.dmp

Filesize
4.0MB

Download
memory/2556-29-0x00000000040C0000-0x00000000040F6000-memory.dmp

Filesize
216KB

Download
memory/2556-31-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2556-32-0x0000000003380000-0x0000000003780000-memory.dmp

Filesize
4.0MB

Download
memory/2744-221-0x0000000000540000-0x0000000000549000-memory.dmp

Filesize
36KB

Download
memory/2744-222-0x0000000000550000-0x0000000000554000-memory.dmp

Filesize
16KB

Download
memory/2808-223-0x00000000008F0000-0x00000000008F9000-memory.dmp

Filesize
36KB

Download
memory/2808-226-0x00000000008F0000-0x00000000008F9000-memory.dmp

Filesize
36KB

Download
memory/2808-225-0x0000000000900000-0x0000000000905000-memory.dmp

Filesize
20KB

Download
memory/2840-39-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-47-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-41-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-43-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-45-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-21-0x000001D2985E0000-0x000001D2985E3000-memory.dmp

Filesize
12KB

Download
memory/2840-80-0x000001D2989A0000-0x000001D2989A5000-memory.dmp

Filesize
20KB

Download
memory/2840-81-0x00007FF9E6B10000-0x00007FF9E6D05000-memory.dmp

Filesize
2.0MB

Download
memory/2840-46-0x00007FF9E6B10000-0x00007FF9E6D05000-memory.dmp

Filesize
2.0MB

Download
memory/2840-51-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-44-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-37-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-50-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-38-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-54-0x00007FF9E6B10000-0x00007FF9E6D05000-memory.dmp

Filesize
2.0MB

Download
memory/2840-53-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-52-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-33-0x000001D2985E0000-0x000001D2985E3000-memory.dmp

Filesize
12KB

Download
memory/2840-34-0x000001D2989A0000-0x000001D2989A7000-memory.dmp

Filesize
28KB

Download
memory/2840-36-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/2840-35-0x00007FF469440000-0x00007FF46956F000-memory.dmp

Filesize
1.2MB

Download
memory/3052-200-0x0000000000390000-0x000000000039C000-memory.dmp

Filesize
48KB

Download
memory/3052-197-0x0000000000390000-0x000000000039C000-memory.dmp

Filesize
48KB

Download
memory/3052-199-0x00000000003A0000-0x00000000003A7000-memory.dmp

Filesize
28KB

Download
memory/3200-3-0x0000000005C00000-0x0000000005C10000-memory.dmp

Filesize
64KB

Download
memory/3200-6-0x0000000006490000-0x00000000064F8000-memory.dmp

Filesize
416KB

Download
memory/3200-0-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/3200-1-0x0000000000F10000-0x0000000001272000-memory.dmp

Filesize
3.4MB

Download
memory/3200-9-0x0000000006B70000-0x0000000007114000-memory.dmp

Filesize
5.6MB

Download
memory/3200-8-0x0000000006570000-0x00000000065BC000-memory.dmp

Filesize
304KB

Download
memory/3200-15-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/3200-2-0x0000000005CB0000-0x0000000005D42000-memory.dmp

Filesize
584KB

Download
memory/3200-7-0x0000000006500000-0x0000000006568000-memory.dmp

Filesize
416KB

Download
memory/3200-4-0x0000000005D50000-0x0000000005F3E000-memory.dmp

Filesize
1.9MB

Download
memory/3200-5-0x0000000006410000-0x0000000006490000-memory.dmp

Filesize
512KB

Download
memory/3240-75-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3240-72-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3240-84-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3284-82-0x0000000000CE0000-0x0000000000CF6000-memory.dmp

Filesize
88KB

Download
memory/4372-213-0x00000000004D0000-0x00000000004DF000-memory.dmp

Filesize
60KB

Download
memory/4372-228-0x00000000004D0000-0x00000000004DF000-memory.dmp

Filesize
60KB

Download
memory/4372-211-0x00000000004E0000-0x00000000004E9000-memory.dmp

Filesize
36KB

Download
memory/4496-175-0x0000000000C90000-0x0000000000CFB000-memory.dmp

Filesize
428KB

Download
memory/4496-173-0x0000000000D00000-0x0000000000D75000-memory.dmp

Filesize
468KB

Download
memory/4496-198-0x0000000000C90000-0x0000000000CFB000-memory.dmp

Filesize
428KB

Download
memory/4864-209-0x00000000005D0000-0x00000000005D7000-memory.dmp

Filesize
28KB

Download
memory/4864-224-0x00000000005D0000-0x00000000005D7000-memory.dmp

Filesize
28KB

Download
memory/4864-210-0x00000000005C0000-0x00000000005CB000-memory.dmp

Filesize
44KB

Download
memory/4864-208-0x00000000005C0000-0x00000000005CB000-memory.dmp

Filesize
44KB

Download
memory/4980-70-0x00000000051D0000-0x0000000005202000-memory.dmp

Filesize
200KB

Download
memory/4980-64-0x0000000000430000-0x00000000006BE000-memory.dmp

Filesize
2.6MB

Download
memory/4980-63-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/4980-69-0x0000000005580000-0x00000000055CA000-memory.dmp

Filesize
296KB

Download
memory/4980-71-0x00000000055F0000-0x0000000005622000-memory.dmp

Filesize
200KB

Download
memory/4980-76-0x0000000074410000-0x0000000074BC0000-memory.dmp

Filesize
7.7MB

Download
memory/4980-65-0x0000000005080000-0x0000000005090000-memory.dmp

Filesize
64KB

Download
memory/4980-66-0x0000000005090000-0x00000000051AA000-memory.dmp

Filesize
1.1MB

Download