Analysis
- max time kernel
167s - max time network
303s - platform
windows10-1703_x64 - resource
win10-20240221-en - resource tags
- submitted
08/03/2024, 05:03
General
- Target c6e5c9484d4ef41a419f70212c09e2e44f8764195d155df662e62c98f06b21b1.exe
- Size 1.8MB
- Sample240308-fp27hafg86
- SHA256 c6e5c9484d4ef41a419f70212c09e2e44f8764195d155df662e62c98f06b21b1
Malware Config
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
install_dir
00c07260dc
-
install_file
explorgu.exe
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
redline
-
LiveTraffic
-
20.218.68.91:7690
Extracted
-
amadey
-
4.17
-
http://185.215.113.32
-
strings_key
461809bd97c251ba0c0c8450c7055f1d
-
url_paths
/yandex/index.php
Extracted
-
lumma
-
https://resergvearyinitiani.shop/api
-
https://technologyenterdo.shop/api
-
https://detectordiscusser.shop/api
-
https://turkeyunlikelyofw.shop/api
-
https://associationokeo.shop/api
-
https://executivebrakeji.shop/api
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detect ZGRat V1 3 IoCs
- Detected google phishing page
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- UAC bypass 3 TTPs 1 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Contacts a large (4830) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs
- Blocklisted process makes network request 6 IoCs
- Downloads MZ/PE file
- Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 9 IoCs
- Executes dropped EXE 37 IoCs
- Identifies Wine through registry keys 2 TTPs 6 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 48 IoCs
- Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Drops file in Windows directory 14 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- NSIS installer 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 64 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 16 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6e5c9484d4ef41a419f70212c09e2e44f8764195d155df662e62c98f06b21b1.exe"C:\Users\Admin\AppData\Local\Temp\c6e5c9484d4ef41a419f70212c09e2e44f8764195d155df662e62c98f06b21b1.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exeC:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"C:\Users\Admin\AppData\Local\Temp\1000836001\osminog.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"C:\Users\Admin\AppData\Local\Temp\1000837001\goldprime123.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\990815831200_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\onefile_4060_133543478983466865\stub.exe"C:\Users\Admin\AppData\Local\Temp\1000838001\judith.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name5⤵
- Detects videocard installed
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get Manufacturer"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "gdb --version"4⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic path Win32_ComputerSystem get Manufacturer"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get Manufacturer5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid5⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "tasklist"4⤵
-
C:\Windows\system32\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exe"C:\Users\Admin\AppData\Local\Temp\1000844001\Amadeygold.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
-
C:\Users\Admin\AppData\Local\Temp\1000854001\lumma28282828.exe"C:\Users\Admin\AppData\Local\Temp\1000854001\lumma28282828.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1304 -s 11444⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe"C:\Users\Admin\AppData\Local\Temp\1000858001\alex12341.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"C:\Users\Admin\AppData\Roaming\configurationValue\olehpsp.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Roaming\configurationValue\TWO.exe"C:\Users\Admin\AppData\Roaming\configurationValue\TWO.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"4⤵
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 35⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000864001\InstallSetup_three.exe"C:\Users\Admin\AppData\Local\Temp\1000864001\InstallSetup_three.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\u1is.0.exe"C:\Users\Admin\AppData\Local\Temp\u1is.0.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\u1is.1.exe"C:\Users\Admin\AppData\Local\Temp\u1is.1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000865001\dais.exe"C:\Users\Admin\AppData\Local\Temp\1000865001\dais.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\Temp\1000871001\lastrovs.exe"C:\Users\Admin\AppData\Local\Temp\1000871001\lastrovs.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\1000872001\Reload.exe"C:\Users\Admin\AppData\Local\Temp\1000872001\Reload.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000872001\Reload.exe"C:\Users\Admin\AppData\Local\Temp\1000872001\Reload.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\1000872001\Reload.exe"C:\Users\Admin\AppData\Local\Temp\1000872001\Reload.exe"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\1000872001\Reload.exe"C:\Users\Admin\AppData\Local\Temp\1000872001\Reload.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"C:\Users\Admin\AppData\Local\Temp\1000873001\random.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\1000874021\random.cmd" "2⤵
- Checks computer location settings
-
-
C:\Users\Admin\AppData\Local\Temp\1000875001\amadka.exe"C:\Users\Admin\AppData\Local\Temp\1000875001\amadka.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\1000010001\d94f651721.exe"C:\Users\Admin\AppData\Local\Temp\1000010001\d94f651721.exe"4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main5⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\990815831200_Desktop.zip' -CompressionLevel Optimal6⤵
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000881001\file300un.exe"C:\Users\Admin\AppData\Local\Temp\1000881001\file300un.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000881001\file300un.exe" -Force3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- Drops startup file
-
C:\Users\Admin\Pictures\W2ZEfezUdM6NkGMzILxt6vbZ.exe"C:\Users\Admin\Pictures\W2ZEfezUdM6NkGMzILxt6vbZ.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\W2ZEfezUdM6NkGMzILxt6vbZ.exe"C:\Users\Admin\Pictures\W2ZEfezUdM6NkGMzILxt6vbZ.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
-
-
C:\Users\Admin\Pictures\X4vM5fa9diJZrGVwPHPX5vE5.exe"C:\Users\Admin\Pictures\X4vM5fa9diJZrGVwPHPX5vE5.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\X4vM5fa9diJZrGVwPHPX5vE5.exe"C:\Users\Admin\Pictures\X4vM5fa9diJZrGVwPHPX5vE5.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
-
-
C:\Users\Admin\Pictures\cUxFLzCWhcEK1fxAZyO4EFDe.exe"C:\Users\Admin\Pictures\cUxFLzCWhcEK1fxAZyO4EFDe.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\cUxFLzCWhcEK1fxAZyO4EFDe.exe"C:\Users\Admin\Pictures\cUxFLzCWhcEK1fxAZyO4EFDe.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
-
-
C:\Users\Admin\Pictures\XNHjCnenHHiVjp77Yaq7aImi.exe"C:\Users\Admin\Pictures\XNHjCnenHHiVjp77Yaq7aImi.exe" --silent --allusers=04⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
-
C:\Users\Admin\Pictures\XNHjCnenHHiVjp77Yaq7aImi.exeC:\Users\Admin\Pictures\XNHjCnenHHiVjp77Yaq7aImi.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x6e5921c8,0x6e5921d4,0x6e5921e05⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\XNHjCnenHHiVjp77Yaq7aImi.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\XNHjCnenHHiVjp77Yaq7aImi.exe" --version5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Pictures\XNHjCnenHHiVjp77Yaq7aImi.exe"C:\Users\Admin\Pictures\XNHjCnenHHiVjp77Yaq7aImi.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=24324 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240308050631" --session-guid=4de6ef83-c598-4eb0-ac95-9082a240e95a --server-tracking-blob=MDllNWE4ODU4MWJiZWRiZjkxZmMyOTM0N2RiYzA3NGViZmNjY2VjY2U5NzJlZjZiNTk2NTMwMWJmMzQzNmZkNzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwOTg3NDM4OC4zNDY2IiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiIwYTU3YjY3ZC1jOTBkLTQyMTMtYTY0Mi1kOTc4MmFiYjZjM2YifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=C4040000000000005⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
-
C:\Users\Admin\Pictures\XNHjCnenHHiVjp77Yaq7aImi.exeC:\Users\Admin\Pictures\XNHjCnenHHiVjp77Yaq7aImi.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x2c0,0x2c4,0x2c8,0x290,0x2cc,0x6dbe21c8,0x6dbe21d4,0x6dbe21e06⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\Pictures\FCJI8W4acMzWrTPvuONd2ucP.exe"C:\Users\Admin\Pictures\FCJI8W4acMzWrTPvuONd2ucP.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\wfplwfs.exeC:\Users\Admin\AppData\Local\Temp\wfplwfs.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2.3.1.1.exeC:\Users\Admin\AppData\Local\Temp\2.3.1.1.exe6⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 24176 -s 15087⤵
- Program crash
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 3 & del "C:\Users\Admin\Pictures\FCJI8W4acMzWrTPvuONd2ucP.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 36⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\Pictures\88zfmegQugmiTHBqP0hua3mQ.exe"C:\Users\Admin\Pictures\88zfmegQugmiTHBqP0hua3mQ.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Users\Admin\Pictures\88zfmegQugmiTHBqP0hua3mQ.exe"C:\Users\Admin\Pictures\88zfmegQugmiTHBqP0hua3mQ.exe"5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
-
-
-
-
C:\Users\Admin\Pictures\GbXpRheOFz8F6yKhV5mEVibp.exe"C:\Users\Admin\Pictures\GbXpRheOFz8F6yKhV5mEVibp.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\syncUpd.exeC:\Users\Admin\AppData\Local\Temp\syncUpd.exe5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 12517⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F7⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\Pictures\IyAken7jnBNfcoVh1mIQno5d.exe"C:\Users\Admin\Pictures\IyAken7jnBNfcoVh1mIQno5d.exe" --silent --allusers=04⤵
-
C:\Users\Admin\Pictures\IyAken7jnBNfcoVh1mIQno5d.exeC:\Users\Admin\Pictures\IyAken7jnBNfcoVh1mIQno5d.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=108.0.5067.20 --initial-client-data=0x2b8,0x2bc,0x2c0,0x294,0x2c4,0x6c3321c8,0x6c3321d4,0x6c3321e05⤵
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\IyAken7jnBNfcoVh1mIQno5d.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\IyAken7jnBNfcoVh1mIQno5d.exe" --version5⤵
-
-
-
C:\Users\Admin\Pictures\jugpJFGEyhq3U9vQDkuaiwlT.exe"C:\Users\Admin\Pictures\jugpJFGEyhq3U9vQDkuaiwlT.exe"4⤵
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exeC:\Users\Admin\AppData\Local\Temp\4d0ab15804\chrosha.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main2⤵
- Loads dropped DLL
-
C:\Windows\system32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\cred64.dll, Main3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\netsh.exenetsh wlan show profiles4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\990815831200_Desktop.zip' -CompressionLevel Optimal4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\c1ec479e5342a2\clip64.dll, Main2⤵
- Blocklisted process makes network request
- Loads dropped DLL
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exeC:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
4Virtualization/Sandbox Evasion
2Credential Access
Unsecured Credentials
5Credentials In Files
4Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
v4B7uSo4weWy
GltfkwE7JHLHodQPoWH8sz1N.exe
KN0g799pilEm68DXu8f0XFZT.exe
edgecompatviewlist[1].xml
4Kv5U5b1o3f[1].png
suggestions[1].en-US
Pdqx684TRYtpXux28tz68QAH.exe
explorgu.exe
explorgu.exe
osminog.exe
goldprime123.exe
judith.exe
judith.exe
Amadeygold.exe
lumma28282828.exe
alex12341.exe
InstallSetup_three.exe
dais.exe
lastrovs.exe
Reload.exe
random.exe
random.cmd
amadka.exe
file300un.exe
990815831200_Desktop.zip
BroomSetup.exe
_overlapped.pyd
_helpers.pyd
_rust.pyd
libcrypto-1_1.dll
libssl-1_1.dll
_multidict.pyd
sqlite3.dll
unicodedata.pyd
_quoting_c.pyd
Opera_installer_24030805063156724472.dll
MountStep.docx
MountStep.docx
__PSScriptPolicyTest_s2mttc4s.ala.ps1
INetC.dll
python310.dll
stub.exe
stub.exe
syncUpd.exe
clip64.dll
cred64.dll
cred64.dll
clip64.dll
cred64.dll
clip64.dll
cred64.dll
2vQtKP6PoZjAWe6xFactyjYc.exe
8kSTBcheqQ67ZLShbLe6ruuB.exe
IyAken7jnBNfcoVh1mIQno5d.exe
XNHjCnenHHiVjp77Yaq7aImi.exe
soI08cRXuuPjmEG3mAFVrYe5.exe
_asyncio.pyd
_bz2.pyd
_cffi_backend.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_socket.pyd
_sqlite3.pyd
_ssl.pyd
_rust.pyd
libcrypto-1_1.dll
libcrypto-1_1.dll
libffi-7.dll
select.pyd
sqlite3.dll
unicodedata.pyd
python3.dll
python310.dll
vcruntime140.dll
cred64.dll
cred64.dll
memory/192-507-0x0000000000400000-0x0000000001A30000-memory.dmp
memory/192-560-0x0000000000400000-0x0000000001A30000-memory.dmp
memory/192-464-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/648-44-0x0000000004980000-0x0000000004990000-memory.dmp
memory/648-53-0x00000000729F0000-0x00000000730DE000-memory.dmp
memory/648-43-0x00000000729F0000-0x00000000730DE000-memory.dmp
memory/648-42-0x0000000000110000-0x0000000000166000-memory.dmp
memory/648-52-0x00000000023B0000-0x00000000043B0000-memory.dmp
memory/648-92-0x00000000023B0000-0x00000000043B0000-memory.dmp
memory/1008-136-0x0000000008AB0000-0x0000000008C72000-memory.dmp
memory/1008-88-0x0000000008370000-0x000000000847A000-memory.dmp
memory/1008-91-0x00000000082E0000-0x000000000832B000-memory.dmp
memory/1008-94-0x0000000008560000-0x00000000085C6000-memory.dmp
memory/1008-95-0x0000000008860000-0x00000000088B0000-memory.dmp
memory/1008-179-0x0000000072810000-0x0000000072EFE000-memory.dmp
memory/1008-90-0x00000000082A0000-0x00000000082DE000-memory.dmp
memory/1008-78-0x0000000000400000-0x0000000000450000-memory.dmp
memory/1008-81-0x0000000005C40000-0x000000000613E000-memory.dmp
memory/1008-89-0x0000000006AD0000-0x0000000006AE2000-memory.dmp
memory/1008-83-0x0000000005740000-0x00000000057D2000-memory.dmp
memory/1008-141-0x00000000091B0000-0x00000000096DC000-memory.dmp
memory/1008-87-0x0000000006B10000-0x0000000007116000-memory.dmp
memory/1008-86-0x0000000072810000-0x0000000072EFE000-memory.dmp
memory/1008-85-0x00000000056F0000-0x00000000056FA000-memory.dmp
memory/1304-344-0x0000000000400000-0x0000000000447000-memory.dmp
memory/1304-341-0x0000000000400000-0x0000000000447000-memory.dmp
memory/1516-2-0x0000000000E10000-0x00000000012D3000-memory.dmp
memory/1516-3-0x00000000050F0000-0x00000000050F1000-memory.dmp
memory/1516-7-0x00000000050D0000-0x00000000050D1000-memory.dmp
memory/1516-8-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/1516-5-0x0000000005110000-0x0000000005111000-memory.dmp
memory/1516-15-0x0000000000E10000-0x00000000012D3000-memory.dmp
memory/1516-10-0x0000000005140000-0x0000000005141000-memory.dmp
memory/1516-11-0x0000000005130000-0x0000000005131000-memory.dmp
memory/1516-1-0x00000000777A4000-0x00000000777A5000-memory.dmp
memory/1516-0-0x0000000000E10000-0x00000000012D3000-memory.dmp
memory/1516-6-0x00000000050B0000-0x00000000050B1000-memory.dmp
memory/1516-4-0x00000000050E0000-0x00000000050E1000-memory.dmp
memory/1740-354-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-21-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/1740-58-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-18-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-26-0x0000000004D50000-0x0000000004D51000-memory.dmp
memory/1740-194-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-193-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-25-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/1740-24-0x0000000004D00000-0x0000000004D01000-memory.dmp
memory/1740-180-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-23-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/1740-22-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/1740-412-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-321-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-57-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-73-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-20-0x0000000004D30000-0x0000000004D31000-memory.dmp
memory/1740-506-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-19-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-93-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1740-28-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/1740-27-0x0000000004D80000-0x0000000004D81000-memory.dmp
memory/1740-559-0x00000000003B0000-0x0000000000873000-memory.dmp
memory/1972-436-0x0000000000400000-0x0000000001A50000-memory.dmp
memory/2172-522-0x0000000000400000-0x0000000000930000-memory.dmp
memory/2712-305-0x00007FF754C00000-0x00007FF755E39000-memory.dmp
memory/3436-47-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3436-50-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3436-54-0x00000000023B0000-0x00000000043B0000-memory.dmp
memory/3436-55-0x0000000001550000-0x0000000001551000-memory.dmp
memory/3436-56-0x0000000000400000-0x0000000000448000-memory.dmp
memory/3884-169-0x0000023B276C0000-0x0000023B276CA000-memory.dmp
memory/3884-176-0x00007FFDDD7D0000-0x00007FFDDE1BC000-memory.dmp
memory/3884-156-0x0000023B27940000-0x0000023B27952000-memory.dmp
memory/3884-142-0x0000023B276D0000-0x0000023B276E0000-memory.dmp
memory/3884-119-0x0000023B27960000-0x0000023B279D6000-memory.dmp
memory/3884-115-0x0000023B276D0000-0x0000023B276E0000-memory.dmp
memory/3884-116-0x0000023B276D0000-0x0000023B276E0000-memory.dmp
memory/3884-114-0x00007FFDDD7D0000-0x00007FFDDE1BC000-memory.dmp
memory/3884-113-0x0000023B27670000-0x0000023B27692000-memory.dmp
memory/4060-353-0x00007FF7EF1D0000-0x00007FF7EFCA7000-memory.dmp
memory/4188-72-0x0000000000660000-0x00000000006F2000-memory.dmp
memory/4188-84-0x00000000029E0000-0x00000000049E0000-memory.dmp
memory/4188-82-0x0000000072810000-0x0000000072EFE000-memory.dmp
memory/4188-75-0x0000000005080000-0x0000000005090000-memory.dmp
memory/4188-74-0x0000000072810000-0x0000000072EFE000-memory.dmp
memory/4188-181-0x00000000029E0000-0x00000000049E0000-memory.dmp
memory/4336-582-0x0000000000400000-0x0000000000448000-memory.dmp
memory/4336-588-0x0000000000400000-0x0000000000448000-memory.dmp
memory/4880-338-0x0000000072660000-0x0000000072D4E000-memory.dmp
memory/4880-337-0x0000000000BE0000-0x0000000000C32000-memory.dmp
memory/4920-371-0x0000000000400000-0x0000000000592000-memory.dmp
memory/5088-628-0x000001F977D00000-0x000001F977D10000-memory.dmp