amadey | 6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017

Analysis

max time kernel
149s
max time network
147s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-10-2024 23:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe
Size

1.8MB
MD5

a5a80ebfc812f7f5117e1c290d03c66f
SHA1

95adf3f585ff1b332973752f27edeeca5049452a
SHA256

6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017
SHA512

6308155f9dcd7ae7f15da0fe7a71bbe7aa910b05abbbad036b2c1a6f473dbdc955f4e7d0cdf167206409877d07ce06d655f085ad89a5a17792f0ae3c14f253f6
SSDEEP

49152:lZ0tauquw+6eEtsK6OsWVkCv17Uo35biaJT:lZ0Quq6EtUHCvZb3T

Score

10^/10

amadey cryptbot lumma stealc 1176f2 default_valenciga fed3aa credential_access discovery evasion spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

lumma

https://snailyeductyi.sbs

https://ferrycheatyk.sbs

https://deepymouthi.sbs

https://wrigglesight.sbs

https://captaitwik.sbs

https://sidercotay.sbs

https://heroicmint.sbs

https://monstourtu.sbs

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

http://185.215.113.19

Attributes

install_dir
417fd29867
install_file
ednfoki.exe
strings_key
183201dc3defc4394182b4bff63c4065
url_paths
/CoreOPT/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot

Detects CryptBot payload 1 IoCs

CryptBot is a C++ stealer distributed widely in bundle with other software.

spyware stealer

Processes:

resource	yara_rule
behavioral1/memory/2988-322-0x0000000069CC0000-0x000000006A37B000-memory.dmp	family_cryptbot_v3

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exeaxplong.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exeaxplong.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe

Drops startup file 1 IoCs

Processes:

splwow64.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url	splwow64.exe

Executes dropped EXE 19 IoCs

Processes:

axplong.exepvp.exepvp.exeBEKi1z770x.exenTBzvr3t03.exestealc_default2.exeprocessclass.exesplwow64.exegolden.exegolden.exegolden.exegolden.exegolden.exeNewofff.exeHkbsse.exeJavUmar1.execontext.exeservice123.exeservice123.exe

pid	Process
2532	axplong.exe
276	pvp.exe
1644	pvp.exe
628	BEKi1z770x.exe
2224	nTBzvr3t03.exe
2332	stealc_default2.exe
2356	processclass.exe
1008	splwow64.exe
2760	golden.exe
1968	golden.exe
2844	golden.exe
2156	golden.exe
2412	golden.exe
1672	Newofff.exe
2964	Hkbsse.exe
2988	JavUmar1.exe
988	context.exe
2096	service123.exe
1640	service123.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exeaxplong.exe

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe
Key opened	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Wine	axplong.exe

Loads dropped DLL 35 IoCs

Processes:

6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exeaxplong.exepvp.exeWerFault.exepvp.exegolden.exeWerFault.exeNewofff.exestealc_default2.exeHkbsse.exeWerFault.exeJavUmar1.exeservice123.exeservice123.exe

pid	Process
2700	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe
2532	axplong.exe
276	pvp.exe
1784	WerFault.exe
1784	WerFault.exe
1644	pvp.exe
1644	pvp.exe
2532	axplong.exe
2532	axplong.exe
1784	WerFault.exe
2532	axplong.exe
2532	axplong.exe
2532	axplong.exe
2760	golden.exe
2760	golden.exe
2760	golden.exe
2760	golden.exe
2092	WerFault.exe
2092	WerFault.exe
2092	WerFault.exe
2532	axplong.exe
1672	Newofff.exe
2332	stealc_default2.exe
2332	stealc_default2.exe
2964	Hkbsse.exe
2964	Hkbsse.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
1884	WerFault.exe
2988	JavUmar1.exe
2988	JavUmar1.exe
2096	service123.exe
1640	service123.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exeaxplong.exe

pid	Process
2700	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe
2532	axplong.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

pvp.exegolden.exesplwow64.exe

description	pid	Process	procid_target
PID 276 set thread context of 1644	276	pvp.exe	34
PID 2760 set thread context of 2412	2760	golden.exe	46
PID 1008 set thread context of 2700	1008	splwow64.exe	55

Drops file in Windows directory 2 IoCs

Processes:

6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exeNewofff.exe

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe
File created	C:\Windows\Tasks\Hkbsse.job	Newofff.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
1784	276	WerFault.exe	32
2092	2760	WerFault.exe	42
1884	988	WerFault.exe	54

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

golden.exetimeout.exetaskkill.exesplwow64.exeHkbsse.execontext.exeInstallUtil.execmd.exeaxplong.exepvp.exegolden.exeschtasks.exe6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exepvp.exestealc_default2.exeNewofff.exeJavUmar1.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	golden.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hkbsse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	context.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	golden.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Newofff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JavUmar1.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

stealc_default2.exeJavUmar1.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JavUmar1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JavUmar1.exe

Delays execution with timeout.exe 1 IoCs

evasion

Processes:

timeout.exe

pid	Process
1584	timeout.exe

Kills process with taskkill 1 IoCs

evasion

Processes:

taskkill.exe

pid	Process
2180	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
2780	schtasks.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

Processes:

context.exe

pid	Process
988	context.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exeaxplong.exestealc_default2.exenTBzvr3t03.exeBEKi1z770x.exegolden.execontext.exe

pid	Process
2700	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe
2532	axplong.exe
2332	stealc_default2.exe
2224	nTBzvr3t03.exe
628	BEKi1z770x.exe
2412	golden.exe
2412	golden.exe
2412	golden.exe
2412	golden.exe
2332	stealc_default2.exe
988	context.exe
988	context.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

BEKi1z770x.exenTBzvr3t03.exeprocessclass.exesplwow64.exetaskkill.execontext.exe

description	pid	Process
Token: SeBackupPrivilege	628	BEKi1z770x.exe
Token: SeBackupPrivilege	2224	nTBzvr3t03.exe
Token: SeSecurityPrivilege	628	BEKi1z770x.exe
Token: SeSecurityPrivilege	2224	nTBzvr3t03.exe
Token: SeSecurityPrivilege	628	BEKi1z770x.exe
Token: SeSecurityPrivilege	628	BEKi1z770x.exe
Token: SeSecurityPrivilege	628	BEKi1z770x.exe
Token: SeSecurityPrivilege	2224	nTBzvr3t03.exe
Token: SeSecurityPrivilege	2224	nTBzvr3t03.exe
Token: SeSecurityPrivilege	2224	nTBzvr3t03.exe
Token: SeDebugPrivilege	628	BEKi1z770x.exe
Token: SeDebugPrivilege	2224	nTBzvr3t03.exe
Token: SeDebugPrivilege	2356	processclass.exe
Token: SeDebugPrivilege	1008	splwow64.exe
Token: SeDebugPrivilege	2180	taskkill.exe
Token: SeDebugPrivilege	988	context.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exeNewofff.exe

pid	Process
2700	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe
1672	Newofff.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exeaxplong.exepvp.exepvp.exegolden.exe

description	pid	Process	procid_target
PID 2700 wrote to memory of 2532	2700	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe	31
PID 2700 wrote to memory of 2532	2700	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe	31
PID 2700 wrote to memory of 2532	2700	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe	31
PID 2700 wrote to memory of 2532	2700	6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe	31
PID 2532 wrote to memory of 276	2532	axplong.exe	32
PID 2532 wrote to memory of 276	2532	axplong.exe	32
PID 2532 wrote to memory of 276	2532	axplong.exe	32
PID 2532 wrote to memory of 276	2532	axplong.exe	32
PID 276 wrote to memory of 1644	276	pvp.exe	34
PID 276 wrote to memory of 1644	276	pvp.exe	34
PID 276 wrote to memory of 1644	276	pvp.exe	34
PID 276 wrote to memory of 1644	276	pvp.exe	34
PID 276 wrote to memory of 1644	276	pvp.exe	34
PID 276 wrote to memory of 1644	276	pvp.exe	34
PID 276 wrote to memory of 1644	276	pvp.exe	34
PID 276 wrote to memory of 1644	276	pvp.exe	34
PID 276 wrote to memory of 1644	276	pvp.exe	34
PID 276 wrote to memory of 1644	276	pvp.exe	34
PID 276 wrote to memory of 1644	276	pvp.exe	34
PID 276 wrote to memory of 1784	276	pvp.exe	35
PID 276 wrote to memory of 1784	276	pvp.exe	35
PID 276 wrote to memory of 1784	276	pvp.exe	35
PID 276 wrote to memory of 1784	276	pvp.exe	35
PID 1644 wrote to memory of 628	1644	pvp.exe	36
PID 1644 wrote to memory of 628	1644	pvp.exe	36
PID 1644 wrote to memory of 628	1644	pvp.exe	36
PID 1644 wrote to memory of 628	1644	pvp.exe	36
PID 1644 wrote to memory of 2224	1644	pvp.exe	37
PID 1644 wrote to memory of 2224	1644	pvp.exe	37
PID 1644 wrote to memory of 2224	1644	pvp.exe	37
PID 1644 wrote to memory of 2224	1644	pvp.exe	37
PID 2532 wrote to memory of 2332	2532	axplong.exe	38
PID 2532 wrote to memory of 2332	2532	axplong.exe	38
PID 2532 wrote to memory of 2332	2532	axplong.exe	38
PID 2532 wrote to memory of 2332	2532	axplong.exe	38
PID 2532 wrote to memory of 2356	2532	axplong.exe	39
PID 2532 wrote to memory of 2356	2532	axplong.exe	39
PID 2532 wrote to memory of 2356	2532	axplong.exe	39
PID 2532 wrote to memory of 2356	2532	axplong.exe	39
PID 2532 wrote to memory of 1008	2532	axplong.exe	40
PID 2532 wrote to memory of 1008	2532	axplong.exe	40
PID 2532 wrote to memory of 1008	2532	axplong.exe	40
PID 2532 wrote to memory of 1008	2532	axplong.exe	40
PID 2532 wrote to memory of 2760	2532	axplong.exe	42
PID 2532 wrote to memory of 2760	2532	axplong.exe	42
PID 2532 wrote to memory of 2760	2532	axplong.exe	42
PID 2532 wrote to memory of 2760	2532	axplong.exe	42
PID 2760 wrote to memory of 1968	2760	golden.exe	43
PID 2760 wrote to memory of 1968	2760	golden.exe	43
PID 2760 wrote to memory of 1968	2760	golden.exe	43
PID 2760 wrote to memory of 1968	2760	golden.exe	43
PID 2760 wrote to memory of 2844	2760	golden.exe	44
PID 2760 wrote to memory of 2844	2760	golden.exe	44
PID 2760 wrote to memory of 2844	2760	golden.exe	44
PID 2760 wrote to memory of 2844	2760	golden.exe	44
PID 2760 wrote to memory of 2156	2760	golden.exe	45
PID 2760 wrote to memory of 2156	2760	golden.exe	45
PID 2760 wrote to memory of 2156	2760	golden.exe	45
PID 2760 wrote to memory of 2156	2760	golden.exe	45
PID 2760 wrote to memory of 2412	2760	golden.exe	46
PID 2760 wrote to memory of 2412	2760	golden.exe	46
PID 2760 wrote to memory of 2412	2760	golden.exe	46
PID 2760 wrote to memory of 2412	2760	golden.exe	46
PID 2760 wrote to memory of 2412	2760	golden.exe	46

C:\Users\Admin\AppData\Local\Temp\6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe
"C:\Users\Admin\AppData\Local\Temp\6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:276
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1644
    - - C:\Users\Admin\AppData\Roaming\BEKi1z770x.exe
        
        "C:\Users\Admin\AppData\Roaming\BEKi1z770x.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:628
    - - C:\Users\Admin\AppData\Roaming\nTBzvr3t03.exe
        
        "C:\Users\Admin\AppData\Roaming\nTBzvr3t03.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 276 -s 52
      4⤵
      Loads dropped DLL
      Program crash
      PID:1784
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2332
- - C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
    "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2356
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c start context.exe
      4⤵
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\context.exe
        
        context.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: CmdExeWriteProcessMemorySpam
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:988
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 988 -s 732
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1884
- - C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
    "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1008
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2700
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1888
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im "InstallUtil.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2180
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1584
- - C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
    "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
      "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
      4⤵
      Executes dropped EXE
      PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
      "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
      4⤵
      Executes dropped EXE
      PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
      "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
      4⤵
      Executes dropped EXE
      PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe
      "C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 80
      4⤵
      Loads dropped DLL
      Program crash
      PID:2092
- - C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe
    "C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
      "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\1000098001\JavUmar1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000098001\JavUmar1.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\service123.exe
        
        "C:\Users\Admin\AppData\Local\Temp\service123.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2096
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2780

C:\Windows\system32\taskeng.exe
taskeng.exe {3E1C26B6-C6C7-4B52-873A-64FB80DF6904} S-1-5-21-312935884-697965778-3955649944-1000:MXQFNXLT\Admin:Interactive:[1]
1⤵
PID:2820
- C:\Users\Admin\AppData\Local\Temp\service123.exe
  C:\Users\Admin\AppData\Local\Temp\/service123.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5364c929c2c6e9163cbffb0c3ce8af4d

SHA1
2356dbcad31db665ee3ba639c9679c68baf8b076

SHA256
b45d38e7550fdbe47ba2473521d3b321ddf68e95b5f3420e09789ff3fa66f2ac

SHA512
e3b4e1202b10d49a5edb255700ef2f8f7b254e4a20c9e2ef592eb36b7e7b4ea6325ee46f3c27963869e61a7269cc17426a0bc14afd461ef20f2f9fb4c1be2869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a6a474ad3edc04894be3a8172fb5ed7

SHA1
42bc8b55c55b12da23840a7887e966202705c634

SHA256
2f378b8ea75f71d541805ded6b10b9d1614ad5c09022c661d59f73b0b5358153

SHA512
a56ab77575194cb89ad1a002e6040a077eafd6e73bb2227827997f2ed9a5615e436ff9c10c6590a18a3b391512b424a31168d0758747c47f3b8180f730dfa9a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe

Filesize
1.3MB

MD5
d419a0a5a81da8360c3db8c358e7492e

SHA1
a4fa4a9cd4143b152c52c678dd2433379d5c5b7b

SHA256
c8718abc923b7a8f552445edb5a69ff56c76cd73d4703ec8acfe02a0ce0cb5b2

SHA512
8b02a250070de14eebcdea2688302bf0701005cbb64d89684fb45da1284828bda89241beab60565c1c8d6c4a20c5f5510afda92aa170babb6dc8efba087c023e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
307KB

MD5
68a99cf42959dc6406af26e91d39f523

SHA1
f11db933a83400136dc992820f485e0b73f1b933

SHA256
c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

SHA512
7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000098001\JavUmar1.exe

Filesize
6.9MB

MD5
0ddaf55ff5b6daf269845dee74b4f24b

SHA1
9b9363db8deadeee5803ce1751230fb56d776501

SHA256
6798b30915ded323d8ca7f310a7d518cfa5de39bcc20ae984c9a3b65ccbeb941

SHA512
262dab88704c4aff25f7b802759699ad1c712c227ec8afad5354ed2f37ef8a5510edaf692eb39e95f9dac695990176ad78e1720044343a855069b042dd09d763

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000354001\77a3a1e484.exe

Filesize
277B

MD5
d052d5386c0cea6928e36a0eea7cb777

SHA1
f01c44f9773efa1b5262956f225d24b1076fd2ff

SHA256
d96c85af3bdfc77361de9732c018a7bc7c623771e9a29331c793b6f9ff399fd0

SHA512
b8490ff4534ceca05c8ffe0a1f753681951d94117a5a6a06639f1372df9d45f0fc2402f7126526c88e911e4c73ea64917212bb07716b3bbb0d2ff6d9de52e05f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe

Filesize
6KB

MD5
c042782226565f89ce3954489075e516

SHA1
256dd5ba42837a33c7aa6cb71cef33d5617117ee

SHA256
a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

SHA512
9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe

Filesize
1.1MB

MD5
ed9393d5765529c845c623e35c1b1a34

SHA1
d3eca07f5ce0df847070d2d7fe5253067f624285

SHA256
53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a

SHA512
565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe

Filesize
551KB

MD5
3a0f1fe734b215e85f47816085e425c9

SHA1
30a3ddb576c2f0eeb1bfc718b30266123eb1e474

SHA256
ec189d42b19d842d94772287dd02c5b2a2a6a79fce75f2f132111820646b8fba

SHA512
840546dbba54a94452eaf069dbbb53fd00fdf42dff20ce5722226a1a25b7410731dfd7ad01c04ca97b269aabbd46cead03cd82e52ed49ba6ea1f6c5bdba37189

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe

Filesize
416KB

MD5
f5d7b79ee6b6da6b50e536030bcc3b59

SHA1
751b555a8eede96d55395290f60adc43b28ba5e2

SHA256
2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

SHA512
532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
a5a80ebfc812f7f5117e1c290d03c66f

SHA1
95adf3f585ff1b332973752f27edeeca5049452a

SHA256
6fefbaa7c5cb09a64b483a20030e7c6e8411def2a1c9bfc9432cf2636c0d2017

SHA512
6308155f9dcd7ae7f15da0fe7a71bbe7aa910b05abbbad036b2c1a6f473dbdc955f4e7d0cdf167206409877d07ce06d655f085ad89a5a17792f0ae3c14f253f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE72.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarED1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\BEKi1z770x.exe

Filesize
469KB

MD5
3eba6a9c3a91b6cab9e2cba1620bfc3e

SHA1
52d195538a8162143cefd745bf9eee7df1f84e9d

SHA256
664d5913432f1b76c33b37599b46cc5f6324283428dba6b45801de37ee2f8d81

SHA512
eb9224e84993a19cddc9eaf75bf422f43fa61e73ab59be0b1b20110eeea6ee75e06f863ad327c9c2314e164f00e2b8813d6498bd442203fb457e0e9c34724fb9

Download Submit
C:\Users\Admin\AppData\Roaming\nTBzvr3t03.exe

Filesize
315KB

MD5
59c9d5bc2cfca695e10f12c6f5f5be3c

SHA1
64f8568e8beeef61e3c3918b2f6c38c8af42c46e

SHA256
cac6b02d8f2ae8f58e7e02ab86fc82149bf466a5857d92e3457aabfca468cf47

SHA512
220b2013d60713e5041ce6422f68aa7753042e1c9ffe8f6644515590d605b6f1701eaf4ecda1f03357a52d04956933261ba02f7948bb652438598211d72b0874

Download Submit
\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
memory/276-71-0x0000000000E95000-0x0000000000E96000-memory.dmp

Filesize
4KB

Download
memory/628-109-0x0000000000EA0000-0x0000000000F1A000-memory.dmp

Filesize
488KB

Download
memory/988-336-0x00000000011D0000-0x00000000012E8000-memory.dmp

Filesize
1.1MB

Download
memory/1008-170-0x0000000000170000-0x0000000000288000-memory.dmp

Filesize
1.1MB

Download
memory/1008-188-0x0000000009EF0000-0x0000000009F74000-memory.dmp

Filesize
528KB

Download
memory/1644-63-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1644-69-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1644-72-0x0000000000D70000-0x0000000000EB3000-memory.dmp

Filesize
1.3MB

Download
memory/1644-55-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1644-57-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1644-85-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1644-59-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1644-61-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1644-70-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1644-53-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1644-66-0x0000000000400000-0x00000000004FD000-memory.dmp

Filesize
1012KB

Download
memory/1644-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2224-110-0x0000000000E00000-0x0000000000E54000-memory.dmp

Filesize
336KB

Download
memory/2332-202-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2332-106-0x0000000000F40000-0x00000000011A1000-memory.dmp

Filesize
2.4MB

Download
memory/2332-331-0x0000000000F40000-0x00000000011A1000-memory.dmp

Filesize
2.4MB

Download
memory/2356-138-0x00000000012F0000-0x00000000012F8000-memory.dmp

Filesize
32KB

Download
memory/2412-242-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2412-240-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2412-234-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2412-236-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2412-244-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2412-245-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2412-247-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2412-238-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/2532-17-0x00000000001F0000-0x00000000006B3000-memory.dmp

Filesize
4.8MB

Download
memory/2532-140-0x00000000001F0000-0x00000000006B3000-memory.dmp

Filesize
4.8MB

Download
memory/2532-18-0x00000000001F0000-0x00000000006B3000-memory.dmp

Filesize
4.8MB

Download
memory/2532-225-0x00000000001F0000-0x00000000006B3000-memory.dmp

Filesize
4.8MB

Download
memory/2532-19-0x00000000001F0000-0x00000000006B3000-memory.dmp

Filesize
4.8MB

Download
memory/2532-20-0x00000000001F0000-0x00000000006B3000-memory.dmp

Filesize
4.8MB

Download
memory/2532-22-0x00000000001F0000-0x00000000006B3000-memory.dmp

Filesize
4.8MB

Download
memory/2532-107-0x00000000001F0000-0x00000000006B3000-memory.dmp

Filesize
4.8MB

Download
memory/2532-139-0x00000000001F0000-0x00000000006B3000-memory.dmp

Filesize
4.8MB

Download
memory/2532-391-0x00000000066E0000-0x0000000006941000-memory.dmp

Filesize
2.4MB

Download
memory/2532-104-0x00000000066E0000-0x0000000006941000-memory.dmp

Filesize
2.4MB

Download
memory/2532-105-0x00000000066E0000-0x0000000006941000-memory.dmp

Filesize
2.4MB

Download
memory/2532-390-0x00000000066E0000-0x0000000006941000-memory.dmp

Filesize
2.4MB

Download
memory/2532-332-0x00000000001F0000-0x00000000006B3000-memory.dmp

Filesize
4.8MB

Download
memory/2700-5-0x0000000000240000-0x0000000000703000-memory.dmp

Filesize
4.8MB

Download
memory/2700-2-0x0000000000241000-0x000000000026F000-memory.dmp

Filesize
184KB

Download
memory/2700-3-0x0000000000240000-0x0000000000703000-memory.dmp

Filesize
4.8MB

Download
memory/2700-16-0x0000000000240000-0x0000000000703000-memory.dmp

Filesize
4.8MB

Download
memory/2700-1-0x0000000077D00000-0x0000000077D02000-memory.dmp

Filesize
8KB

Download
memory/2700-345-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2700-343-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2700-341-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2700-339-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2700-10-0x0000000000240000-0x0000000000703000-memory.dmp

Filesize
4.8MB

Download
memory/2700-0-0x0000000000240000-0x0000000000703000-memory.dmp

Filesize
4.8MB

Download
memory/2988-322-0x0000000069CC0000-0x000000006A37B000-memory.dmp

Filesize
6.7MB

Download
memory/2988-338-0x0000000000330000-0x0000000000A22000-memory.dmp

Filesize
6.9MB

Download