amadey | 05dc25ab693f8dd4de2070840c58c43fa567a16dce0c718c39e22138e1befc59

Analysis

max time kernel
122s
max time network
171s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe
Size 1.8MB
Sample240402-l2gn8aeb74
SHA256 4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7
MD5 b0760925b1a75ecc31de3a751527f22e
SHA1 94cf73fb3e18054e1bae184e56be5f3e6331ccc3
SHA512 5dadb7fab6cacf74c574dc3455a57a2a48f0cd27cc6aef25b32cacf23a873050554c528eb3789daf2b6e1968acf9aad254cd00549c16f40e7412acb1c5a57f10
SSDEEP 49152:g4f/xxV0vXV7zSUfjVfWkC9cZD5pHARh0RoASjOBQX:gcxxCxPi9cN60RRoiQX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

amadey risepro evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.18

http://193.233.132.56

Attributes

install_dir
09fd851a4f
install_file
explorha.exe
strings_key
443351145ece4966ded809641c77cfa8
url_paths
/Pneh2sXQk0/index.php

rc4.plain

Extracted

Family

amadey

Version

4.17

http://185.215.113.32

Attributes

install_dir
00c07260dc
install_file
explorgu.exe
strings_key
461809bd97c251ba0c0c8450c7055f1d
url_paths
/yandex/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
RisePro
RisePro stealer is an infostealer distributed by PrivateLoader.
stealer risepro

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorgu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7e937ccff0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	amert.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorha.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
52	2288	rundll32.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorgu.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorha.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7e937ccff0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7e937ccff0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	amert.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	amert.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	explorha.exe

Executes dropped EXE 6 IoCs

pid	Process
2412	explorha.exe
4420	7e937ccff0.exe
1996	go.exe
532	amert.exe
2192	explorha.exe
3696	explorgu.exe

Identifies Wine through registry keys 2 TTPs 6 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	7e937ccff0.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	amert.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	explorha.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	explorgu.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine	explorha.exe

Loads dropped DLL 3 IoCs

pid	Process
4264	rundll32.exe
684	rundll32.exe
2288	rundll32.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\go.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000044001\\go.exe"	explorha.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000700000002327b-65.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4724	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe
2412	explorha.exe
532	amert.exe
2192	explorha.exe
3696	explorgu.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\explorha.job	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe
File created	C:\Windows\Tasks\explorgu.job	amert.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4724	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe
4724	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe
2412	explorha.exe
2412	explorha.exe
532	amert.exe
532	amert.exe
684	rundll32.exe
684	rundll32.exe
684	rundll32.exe
684	rundll32.exe
684	rundll32.exe
684	rundll32.exe
2192	explorha.exe
2192	explorha.exe
3696	explorgu.exe
3696	explorgu.exe

Suspicious use of FindShellTrayWindow 31 IoCs

pid	Process
4724	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
532	amert.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe
1996	go.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 2412	4724	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe	97
PID 4724 wrote to memory of 2412	4724	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe	97
PID 4724 wrote to memory of 2412	4724	4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe	97
PID 2412 wrote to memory of 4420	2412	explorha.exe	102
PID 2412 wrote to memory of 4420	2412	explorha.exe	102
PID 2412 wrote to memory of 4420	2412	explorha.exe	102
PID 2412 wrote to memory of 5072	2412	explorha.exe	104
PID 2412 wrote to memory of 5072	2412	explorha.exe	104
PID 2412 wrote to memory of 5072	2412	explorha.exe	104
PID 2412 wrote to memory of 1996	2412	explorha.exe	105
PID 2412 wrote to memory of 1996	2412	explorha.exe	105
PID 2412 wrote to memory of 1996	2412	explorha.exe	105
PID 2412 wrote to memory of 4264	2412	explorha.exe	106
PID 2412 wrote to memory of 4264	2412	explorha.exe	106
PID 2412 wrote to memory of 4264	2412	explorha.exe	106
PID 2412 wrote to memory of 532	2412	explorha.exe	108
PID 2412 wrote to memory of 532	2412	explorha.exe	108
PID 2412 wrote to memory of 532	2412	explorha.exe	108
PID 4264 wrote to memory of 684	4264	rundll32.exe	109
PID 4264 wrote to memory of 684	4264	rundll32.exe	109
PID 684 wrote to memory of 4056	684	rundll32.exe	110
PID 684 wrote to memory of 4056	684	rundll32.exe	110
PID 2412 wrote to memory of 2288	2412	explorha.exe	112
PID 2412 wrote to memory of 2288	2412	explorha.exe	112
PID 2412 wrote to memory of 2288	2412	explorha.exe	112
PID 1996 wrote to memory of 3296	1996	go.exe	113
PID 1996 wrote to memory of 3296	1996	go.exe	113
PID 1996 wrote to memory of 1160	1996	go.exe	118
PID 1996 wrote to memory of 1160	1996	go.exe	118
PID 1996 wrote to memory of 948	1996	go.exe	121
PID 1996 wrote to memory of 948	1996	go.exe	121

C:\Users\Admin\AppData\Local\Temp\4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe
"C:\Users\Admin\AppData\Local\Temp\4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
  "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Users\Admin\AppData\Local\Temp\1000042001\7e937ccff0.exe
    "C:\Users\Admin\AppData\Local\Temp\1000042001\7e937ccff0.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    PID:4420
- - C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
    "C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe"
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
    "C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/account
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.facebook.com/video
      4⤵
      PID:1160
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x390,0x3b4,0x388,0x394,0x2bc,0x7ffd71342e98,0x7ffd71342ea4,0x7ffd71342eb0
        5⤵
        
        PID:5408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2144 --field-trial-handle=2148,i,14068024795863898902,5635685098558003301,262144 --variations-seed-version /prefetch:2
        5⤵
        
        PID:5680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2640 --field-trial-handle=2148,i,14068024795863898902,5635685098558003301,262144 --variations-seed-version /prefetch:3
        5⤵
        
        PID:5700
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3172 --field-trial-handle=2148,i,14068024795863898902,5635685098558003301,262144 --variations-seed-version /prefetch:8
        5⤵
        
        PID:5888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3592 --field-trial-handle=2148,i,14068024795863898902,5635685098558003301,262144 --variations-seed-version /prefetch:1
        5⤵
        
        PID:6028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3696 --field-trial-handle=2148,i,14068024795863898902,5635685098558003301,262144 --variations-seed-version /prefetch:1
        5⤵
        
        PID:6040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4772 --field-trial-handle=2148,i,14068024795863898902,5635685098558003301,262144 --variations-seed-version /prefetch:8
        5⤵
        
        PID:552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=4832 --field-trial-handle=2148,i,14068024795863898902,5635685098558003301,262144 --variations-seed-version /prefetch:8
        5⤵
        
        PID:3988
    - - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5620 --field-trial-handle=2148,i,14068024795863898902,5635685098558003301,262144 --variations-seed-version /prefetch:8
        5⤵
        
        PID:412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5620 --field-trial-handle=2148,i,14068024795863898902,5635685098558003301,262144 --variations-seed-version /prefetch:8
        5⤵
        
        PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://accounts.google.com/
      4⤵
      PID:948
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Windows\system32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll, Main
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:684
    - - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        5⤵
        
        PID:4056
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\808065738166_Desktop.zip' -CompressionLevel Optimal
        5⤵
        
        PID:3392
- - C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
    "C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:532
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
    3⤵
    - Blocklisted process makes network request
    - Loads dropped DLL
    PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3820 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:3580

C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2192

C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
C:\Users\Admin\AppData\Local\Temp\00c07260dc\explorgu.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3696
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
  2⤵
  PID:1196
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll, Main
    3⤵
    PID:1736
  - - C:\Windows\system32\netsh.exe
      netsh wlan show profiles
      4⤵
      PID:2752
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command Compress-Archive -Path 'C:\Users\Admin\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\808065738166_Desktop.zip' -CompressionLevel Optimal
      4⤵
      PID:2604
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
  2⤵
  PID:3364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4828 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=4112 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5740 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:8
1⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=5464 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5536 --field-trial-handle=2264,i,15001568551143786084,90255922961447677,262144 --variations-seed-version /prefetch:1
1⤵
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b31372b8b397535d16e044ea454b8be639487f04ae4736551129439faf64bc2b
MD5 21bafe1123fb38f5524bd0695e56b5cf
SHA1 5dbf6f21dc4578ef2b5e003a56f9dec8891048e4
SHA512 1c1fa5ccc4d542b7c6735e39c3908d1343f78a75f4a4ec551f63cbe368d64391d8bc88f667d68c3b638dfe70c05199573b4318684e6160fbaa26c597d616f534
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8965d1b94879b91982d78983b5b6a05c419be5c14d5e38ee9573c3ebecfe01d6
MD5 3603e96df6545c243c33e463445831e1
SHA1 98cb644c71d442045f46739ec53c125c6beed7a8
SHA512 76c9d2dcd04c17341bc66c30d963fc00b581ce975ab5fe84bde982e593e74eea8059682d42f824d8578734716ece6ded3ead5bb242680b8dfabc7453c8d0c85e
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 66afeaa6e0a80992739d141cea8768a47c8b1383a59e29f8bc2d5f594972a6e3
MD5 413173058b5a140736319ee50340b8be
SHA1 2fb383a5a3bf2720d703e5bcc33a3dc47a918675
SHA512 c0953f6ce7e36ca2926216991e96a3f1d7e2b8c368dd889b332c8e2caaac94bd3f743d5bb657cf3385844f214b65faa6731101fa8b1ec3193e22ec85cbf4a2a6
SSDEEP 768:hFpiMi+Aa2CWJK5GaHxavftAz8DsCrU3gedrUw2eg5uNk6D4ZA8Vzn:hCMi+A2dwftvDjI3ieAak2iA8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 45KB
SHA256 fa67a564c5598875b6b3b2a5690e69f78a48a8ab6be11e2d0db27d388fe4a688
MD5 5580b72982df6ecc06d1b48b1d8627c0
SHA1 1efda2b91d856be61a270f2898e3ab5e228001be
SHA512 152dcfd5a321626807a4fb93a93dbad825f9d06ac90017d2da9f0a4a5abd4df8561365bb97bca3e8448c1a344cabcdd6ff1fbbf54c772610df9d51dbcd6e32d6
SSDEEP 768:/FpiMi+Xp2CWqxavftAz8DsCrU3geOr5SnzJrW335uNk6D4ZA8Vzn:/CMi+oqwftvDjI3FzFW3pak2iA8B
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 615e2ccaa4042d33b16395aead0c9bafba8a6113523bc60dbf39162a4337afd5
MD5 1041e9a9601eaa8781b140d162604792
SHA1 ddb9551a47c32a8dcf7fdf8f8e703965d4f6a853
SHA512 2978fc31a35abad599df5a5cff24f6c9dd2739db1a2c31b1c7beb1d13f2afcb46d38d7bb7aacfd7483310e3e2efe9c4f86cdf3dc315496bbe19a1fcaf8d161fa
MD5 SHA1 SHA512

Submit Download

explorha.exe

Path C:\Users\Admin\AppData\Local\Temp\09fd851a4f\explorha.exe
Size 1.8MB
SHA256 4c020f31e0c47dff0b918e47e622bfe76a2ff38a38a22dbb8e033689b735f1c7
MD5 b0760925b1a75ecc31de3a751527f22e
SHA1 94cf73fb3e18054e1bae184e56be5f3e6331ccc3
SHA512 5dadb7fab6cacf74c574dc3455a57a2a48f0cd27cc6aef25b32cacf23a873050554c528eb3789daf2b6e1968acf9aad254cd00549c16f40e7412acb1c5a57f10
SSDEEP 49152:g4f/xxV0vXV7zSUfjVfWkC9cZD5pHARh0RoASjOBQX:gcxxCxPi9cN60RRoiQX
MD5 SHA1 SHA512 SSDEEP

Submit Download

7e937ccff0.exe

Path C:\Users\Admin\AppData\Local\Temp\1000042001\7e937ccff0.exe
Size 3.1MB
SHA256 0e7609071c91305f3316e318950f2b25beb02ec8c8dc6f0f8e0e86b901256331
MD5 4fdeb9d50f33402d0d93388253dc141e
SHA1 caf27df6acb44e09bff887d7a38e69ae1879faa6
SHA512 593d4d7aed2188c905a696bd41263ba6d71d0cd0122527fa6361c5d438feb9ffeb5678a1185e36a809a20a27c65c39bde249aecccaca543f772ec18f093f1d8f
SSDEEP 49152:7zaLRbrJDNMuEiP/jllhB95Axc41m7/h2ERA/78VVoluDr5RLl8R2C:7k9U0DvhB95gc4Y7/IE2yks5RL3
MD5 SHA1 SHA512 SSDEEP

Submit Download

go.exe

Path C:\Users\Admin\AppData\Local\Temp\1000044001\go.exe
Size 894KB
SHA256 59ff8e0aa665fbbf749c7548906a655cb1869bb58a3b7546efa5b416d19e6308
MD5 2f8912af892c160c1c24c9f38a60c1ab
SHA1 d2deae508e262444a8f15c29ebcc7ebbe08a3fdb
SHA512 0395383bde98d358b0a7f2224f903dff026ce0c6d90feb49ac0e6993ef692143b0eb25da84d9cdc9e7b373a7b75a6dbaef14746eda1bff165d59f07ca51a16bb
SSDEEP 12288:qqDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDga4TN:qqDEvCTbMWu7rQYlBQcBiT6rprG8aAN
MD5 SHA1 SHA512 SSDEEP

Submit Download

amert.exe

Path C:\Users\Admin\AppData\Local\Temp\1000046001\amert.exe
Size 1.8MB
SHA256 71adec6910885d6bb62095c4c85e230d9acd1f547d1cbe27813740979968a93a
MD5 c76246d2870c5043e410132ab91f3851
SHA1 fe759389d6dcb33888472dc969183a675ecec428
SHA512 1741f23f66ba9ecee4f5051bd5d5934a13a6195aab1c5030f846e455d15b0c30b05289ca7816f6a685e347b760072a009db29c11500d1e14352921f9f4f968e5
SSDEEP 49152:NehQtUtrh3kAWySCSf1tJmgz4GbB+HB+FaXaM1HUQA0:NehQOdxCySCmmwf1+HBOKUQP
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_jhw0sj45.toh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jhw0sj45.toh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Size 109KB
SHA256 8d31b39170909595b518b1a03e9ec950540fabd545ed14817cac5c84b91599ee
MD5 2afdbe3b99a4736083066a13e4b5d11a
SHA1 4d4856cf02b3123ac16e63d4a448cdbcb1633546
SHA512 d89b3c46854153e60e3fa825b394344eee33936d7dbf186af9d95c9adae54428609e3bf21a18d38fce3d96f3e0b8e4e0ed25cb5004fbe288de3aef3a85b1d93f
SSDEEP 3072:xE5kJp+s5aP40bGsuZR+SVhJQ3ICRv4l:m5ka2obfuZR7Py4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Size 1.2MB
SHA256 b4588feacc183cd5a089f9bb950827b75df04bd5a6e67c95ff258e4a34aa0d72
MD5 92fbdfccf6a63acef2743631d16652a7
SHA1 971968b1378dd89d59d7f84bf92f16fc68664506
SHA512 b8ea216d4a59d8858fd4128abb555f8dcf3acca9138e663b488f09dc5200db6dc11ecc235a355e801145bbbb44d7beac6147949d75d78b32fe9cfd2fa200d117
SSDEEP 24576:ZvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dgg/l+yC7:ZsMPSYcS5wPi095PbgWl
MD5 SHA1 SHA512 SSDEEP

Submit Download

clip64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Size 109KB
SHA256 12fef2d5995d671ec0e91bdbdc91e2b0d3c90ed3a8b2b13ddaa8ad64727dcd46
MD5 726cd06231883a159ec1ce28dd538699
SHA1 404897e6a133d255ad5a9c26ac6414d7134285a2
SHA512 9ea82e7cb6c6a58446bd5033855947c3e2d475d2910f2b941235e0b96aa08eec822d2dd17cc86b2d3fce930f78b799291992408e309a6c63e3011266810ea83e
SSDEEP 3072:Q3uSD+ZwruS0bGcuZRt2sSZV/Q3IegRQod4l:AuTiabHuZRAFtlD4l
MD5 SHA1 SHA512 SSDEEP

Submit Download

cred64.dll

Path C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Size 1.2MB
SHA256 3c97bb410e49b11af8116feb7240b7101e1967cae7538418c45c3d2e072e8103
MD5 15a42d3e4579da615a384c717ab2109b
SHA1 22aeedeb2307b1370cdab70d6a6b6d2c13ad2301
SHA512 1eb7f126dccc88a2479e3818c36120f5af3caa0d632b9ea803485ee6531d6e2a1fd0805b1c4364983d280df23ea5ca3ad4a5fca558ac436efae36af9b795c444
SSDEEP 24576:IvkQL6YY4wMPSYZofkf0Gh6Pi41+a9uyP5dggky+yC7:IsMPSYcS5wPi095Pbg9y
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-120-0x0000000004E40000-0x0000000004E41000-memory.dmp

Download

memory/532-110-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Download

memory/532-104-0x0000000000470000-0x0000000000915000-memory.dmp

Download

memory/532-124-0x0000000000470000-0x0000000000915000-memory.dmp

Download

memory/532-119-0x0000000004E50000-0x0000000004E51000-memory.dmp

Download

memory/532-113-0x0000000000470000-0x0000000000915000-memory.dmp

Download

memory/532-106-0x0000000004E00000-0x0000000004E01000-memory.dmp

Download

memory/532-107-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

Download

memory/532-108-0x0000000004E30000-0x0000000004E31000-memory.dmp

Download

memory/532-109-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download

memory/532-111-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Download

memory/532-112-0x0000000004E20000-0x0000000004E21000-memory.dmp

Download

memory/2192-147-0x00000000052E0000-0x00000000052E1000-memory.dmp

Download

memory/2192-148-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2192-142-0x0000000005300000-0x0000000005301000-memory.dmp

Download

memory/2192-146-0x00000000052D0000-0x00000000052D1000-memory.dmp

Download

memory/2192-145-0x0000000005330000-0x0000000005331000-memory.dmp

Download

memory/2192-149-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2192-143-0x0000000005310000-0x0000000005311000-memory.dmp

Download

memory/2192-144-0x00000000052F0000-0x00000000052F1000-memory.dmp

Download

memory/2192-137-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2412-49-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2412-32-0x0000000004B90000-0x0000000004B91000-memory.dmp

Download

memory/2412-87-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2412-179-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2412-38-0x0000000004BD0000-0x0000000004BD1000-memory.dmp

Download

memory/2412-31-0x0000000004B80000-0x0000000004B81000-memory.dmp

Download

memory/2412-33-0x0000000004B70000-0x0000000004B71000-memory.dmp

Download

memory/2412-34-0x0000000004BB0000-0x0000000004BB1000-memory.dmp

Download

memory/2412-36-0x0000000004B60000-0x0000000004B61000-memory.dmp

Download

memory/2412-116-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2412-35-0x0000000004B50000-0x0000000004B51000-memory.dmp

Download

memory/2412-105-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2412-30-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2412-163-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2412-29-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2412-293-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2412-158-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2412-268-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2412-213-0x0000000000930000-0x0000000000DE6000-memory.dmp

Download

memory/2604-212-0x00007FFD75380000-0x00007FFD75E41000-memory.dmp

Download

memory/2604-211-0x000001E943820000-0x000001E943842000-memory.dmp

Download

memory/3392-215-0x00007FFD75380000-0x00007FFD75E41000-memory.dmp

Download

memory/3392-216-0x000001E44DB40000-0x000001E44DB50000-memory.dmp

Download

memory/3392-217-0x000001E44DB40000-0x000001E44DB50000-memory.dmp

Download

memory/3696-141-0x0000000000E40000-0x00000000012E5000-memory.dmp

Download

memory/3696-238-0x0000000000E40000-0x00000000012E5000-memory.dmp

Download

memory/3696-152-0x0000000004A50000-0x0000000004A51000-memory.dmp

Download

memory/3696-157-0x0000000004A70000-0x0000000004A71000-memory.dmp

Download

memory/3696-156-0x0000000004A20000-0x0000000004A21000-memory.dmp

Download

memory/3696-155-0x0000000004A30000-0x0000000004A31000-memory.dmp

Download

memory/3696-153-0x0000000004A80000-0x0000000004A81000-memory.dmp

Download

memory/3696-154-0x0000000004A10000-0x0000000004A11000-memory.dmp

Download

memory/3696-151-0x0000000004A40000-0x0000000004A41000-memory.dmp

Download

memory/3696-150-0x0000000000E40000-0x00000000012E5000-memory.dmp

Download

memory/3696-292-0x0000000000E40000-0x00000000012E5000-memory.dmp

Download

memory/3696-160-0x0000000004A90000-0x0000000004A91000-memory.dmp

Download

memory/3696-159-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

Download

memory/3696-214-0x0000000000E40000-0x00000000012E5000-memory.dmp

Download

memory/3696-162-0x0000000000E40000-0x00000000012E5000-memory.dmp

Download

memory/3696-181-0x0000000000E40000-0x00000000012E5000-memory.dmp

Download

memory/3696-178-0x0000000000E40000-0x00000000012E5000-memory.dmp

Download

memory/3696-175-0x0000000000E40000-0x00000000012E5000-memory.dmp

Download

memory/4420-161-0x0000000000CC0000-0x0000000001087000-memory.dmp

Download

memory/4420-88-0x0000000000CC0000-0x0000000001087000-memory.dmp

Download

memory/4420-58-0x0000000000CC0000-0x0000000001087000-memory.dmp

Download

memory/4420-180-0x0000000000CC0000-0x0000000001087000-memory.dmp

Download

memory/4420-125-0x0000000000CC0000-0x0000000001087000-memory.dmp

Download

memory/4420-294-0x0000000000CC0000-0x0000000001087000-memory.dmp

Download

memory/4420-140-0x0000000000CC0000-0x0000000001087000-memory.dmp

Download

memory/4420-174-0x0000000000CC0000-0x0000000001087000-memory.dmp

Download

memory/4420-269-0x0000000000CC0000-0x0000000001087000-memory.dmp

Download

memory/4420-220-0x0000000000CC0000-0x0000000001087000-memory.dmp

Download

memory/4724-17-0x0000000000290000-0x0000000000746000-memory.dmp

Download

memory/4724-4-0x0000000004D70000-0x0000000004D71000-memory.dmp

Download

memory/4724-13-0x0000000000290000-0x0000000000746000-memory.dmp

Download

memory/4724-12-0x0000000000290000-0x0000000000746000-memory.dmp

Download

memory/4724-15-0x0000000000290000-0x0000000000746000-memory.dmp

Download

memory/4724-9-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Download

memory/4724-0-0x0000000000290000-0x0000000000746000-memory.dmp

Download

memory/4724-10-0x0000000004DB0000-0x0000000004DB1000-memory.dmp

Download

memory/4724-3-0x0000000004D60000-0x0000000004D61000-memory.dmp

Download

memory/4724-14-0x0000000000290000-0x0000000000746000-memory.dmp

Download

memory/4724-8-0x0000000004D40000-0x0000000004D41000-memory.dmp

Download

memory/4724-7-0x0000000004D30000-0x0000000004D31000-memory.dmp

Download

memory/4724-16-0x0000000000290000-0x0000000000746000-memory.dmp

Download

memory/4724-5-0x0000000004D50000-0x0000000004D51000-memory.dmp

Download

memory/4724-6-0x0000000004D90000-0x0000000004D91000-memory.dmp

Download

memory/4724-22-0x0000000000290000-0x0000000000746000-memory.dmp

Download

memory/4724-2-0x0000000000290000-0x0000000000746000-memory.dmp

Download

memory/4724-37-0x0000000000290000-0x0000000000746000-memory.dmp

Download

memory/4724-1-0x0000000077DA4000-0x0000000077DA6000-memory.dmp

Download