Malware Analysis Report

2025-01-02 14:26

Sample ID 241126-ts426aynay
Target 63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
SHA256 63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4ae
Tags
upx discovery persistence andromeda backdoor botnet
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4ae

Threat Level: Known bad

The file 63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe was found to be: Known bad.

Malicious Activity Summary

upx discovery persistence andromeda backdoor botnet

Andromeda, Gamarue

Andromeda family

Detects Andromeda payload.

Adds policy Run key to start application

Checks computer location settings

Loads dropped DLL

Executes dropped EXE

Maps connected drives based on registry

Adds Run key to start application

UPX packed file

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: MapViewOfSection

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-26 16:20

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-26 16:20

Reported

2024-11-26 16:22

Platform

win7-20241010-en

Max time kernel

119s

Max time network

114s

Command Line

"C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe"

Signatures

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\syswow64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\63542 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mszroow.com" C:\Windows\syswow64\svchost.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Users\\Admin\\AppData\\Roaming\\skype\\skyrpe.exe" C:\Windows\SysWOW64\reg.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\PROGRA~3\LOCALS~1\Temp\mszroow.com C:\Windows\syswow64\svchost.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\syswow64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1840 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 1840 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 1840 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 1840 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 1840 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 1840 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 1840 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 1840 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 2436 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Windows\SysWOW64\cmd.exe
PID 2436 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Windows\SysWOW64\cmd.exe
PID 2588 wrote to memory of 2240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2588 wrote to memory of 2240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2588 wrote to memory of 2240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2588 wrote to memory of 2240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 2436 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2436 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2436 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2436 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183796 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183796 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183796 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183796 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183796 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183796 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183796 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183796 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183860 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183860 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183860 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183860 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183860 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183860 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 2372 wrote to memory of 183860 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 183860 wrote to memory of 183952 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\syswow64\svchost.exe
PID 183860 wrote to memory of 183952 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\syswow64\svchost.exe
PID 183860 wrote to memory of 183952 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\syswow64\svchost.exe
PID 183860 wrote to memory of 183952 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\syswow64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe

"C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe"

C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe

"C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\SQUPX.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Skype" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe" /f

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Windows\syswow64\svchost.exe

C:\Windows\syswow64\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.update.microsoft.com udp
US 20.109.209.108:80 www.update.microsoft.com tcp
US 8.8.4.4:53 sonic4me.com udp
US 184.105.192.2:80 sonic4me.com tcp
US 8.8.4.4:53 imageshells.com udp
US 184.105.192.2:80 imageshells.com tcp

Files

memory/1840-0-0x0000000000400000-0x0000000000462000-memory.dmp

memory/1840-3-0x0000000000270000-0x0000000000271000-memory.dmp

memory/1840-117-0x0000000000404000-0x0000000000405000-memory.dmp

memory/1840-223-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2436-53492-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2436-53490-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1840-53489-0x0000000002620000-0x0000000002682000-memory.dmp

memory/2436-53487-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2436-53485-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2436-53483-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2436-53481-0x0000000000400000-0x000000000040B000-memory.dmp

memory/1840-53491-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2436-53493-0x0000000000400000-0x000000000040B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\SQUPX.bat

MD5 0654f004b2e314bad7f75867e91da37d
SHA1 4232c22e7340b12108d86e3cb35ed288a3dbc7f1
SHA256 ead325a060300a9606a3f0f14694be39a3e4006a60c6c3eb0bea5d6f98192249
SHA512 dda135cdfca90a742d42b4c7a5e7f5df6580ec428302a8f0c311f5b92eb08dda75774e0c7497110faffbe2dfa02b30d2dfe35ec2848a275f53be8d930c7aa553

\Users\Admin\AppData\Roaming\skype\skyrpe.exe

MD5 31f110a94de4159195f0d77048162395
SHA1 856b3b752d827cd53d93939ec5897203a560f557
SHA256 91c6043ec20a46431b97c72e50d86fdba65a393206321c8c7976d7c302ae37df
SHA512 52bb2b29e5fd074f993601846167747c4506a6429252e9e89010089a5781052e032f1e411f6b43c6d3ce07689e473a1aa4b830e6b53487701b5bf9e58479367b

memory/2436-53536-0x0000000002820000-0x0000000002882000-memory.dmp

memory/2436-53535-0x0000000002820000-0x0000000002882000-memory.dmp

memory/2436-53534-0x0000000002820000-0x0000000002882000-memory.dmp

memory/2436-53533-0x0000000002820000-0x0000000002882000-memory.dmp

memory/2436-53524-0x0000000002820000-0x0000000002882000-memory.dmp

memory/2372-53540-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2436-53690-0x0000000000400000-0x000000000040B000-memory.dmp

memory/2436-53691-0x0000000002820000-0x0000000002882000-memory.dmp

memory/2436-53693-0x0000000002820000-0x0000000002882000-memory.dmp

memory/2436-53694-0x0000000002820000-0x0000000002882000-memory.dmp

memory/2436-53695-0x0000000002820000-0x0000000002882000-memory.dmp

memory/2372-53696-0x0000000000400000-0x0000000000462000-memory.dmp

memory/183860-106984-0x0000000000400000-0x0000000000405000-memory.dmp

memory/2372-106985-0x0000000000400000-0x0000000000462000-memory.dmp

memory/2436-106988-0x0000000000400000-0x000000000040B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-26 16:20

Reported

2024-11-26 16:22

Platform

win10v2004-20241007-en

Max time kernel

119s

Max time network

95s

Command Line

"C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe"

Signatures

Andromeda family

andromeda

Andromeda, Gamarue

botnet backdoor andromeda

Detects Andromeda payload.

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds policy Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run C:\Windows\SysWOW64\svchost.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\12693 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\msirfywiu.exe" C:\Windows\SysWOW64\svchost.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Users\\Admin\\AppData\\Roaming\\skype\\skyrpe.exe" C:\Windows\SysWOW64\reg.exe N/A

Maps connected drives based on registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\PROGRA~3\LOCALS~1\Temp\msirfywiu.exe C:\Windows\SysWOW64\svchost.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\svchost.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4164 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 4164 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 4164 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 4164 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 4164 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 4164 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 4164 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 4164 wrote to memory of 4512 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe
PID 4512 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Windows\SysWOW64\cmd.exe
PID 4512 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Windows\SysWOW64\cmd.exe
PID 4512 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Windows\SysWOW64\cmd.exe
PID 4296 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4296 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4296 wrote to memory of 2008 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4512 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4512 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4512 wrote to memory of 4076 N/A C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4228 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4076 wrote to memory of 4480 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe
PID 4480 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\SysWOW64\svchost.exe
PID 4480 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\SysWOW64\svchost.exe
PID 4480 wrote to memory of 4928 N/A C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe

"C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe"

C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe

"C:\Users\Admin\AppData\Local\Temp\63d75c26988f36768facb956a6695ee7e9dcea10751d39528b48f3e8b780c4aeN.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\NVNAB.bat" "

C:\Windows\SysWOW64\reg.exe

REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Skype" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe" /f

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"

C:\Windows\SysWOW64\svchost.exe

C:\Windows\syswow64\svchost.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 92.12.20.2.in-addr.arpa udp
US 8.8.8.8:53 104.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 www.update.microsoft.com udp
US 20.72.235.82:80 www.update.microsoft.com tcp
US 8.8.4.4:53 sonic4me.com udp
US 184.105.192.2:80 sonic4me.com tcp
US 8.8.4.4:53 imageshells.com udp
US 8.8.8.8:53 4.4.8.8.in-addr.arpa udp
US 8.8.8.8:53 82.235.72.20.in-addr.arpa udp
US 184.105.192.2:80 imageshells.com tcp
US 8.8.8.8:53 2.192.105.184.in-addr.arpa udp

Files

memory/4164-0-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4164-3-0x00000000021E0000-0x00000000021E1000-memory.dmp

memory/4164-4-0x00000000021F0000-0x00000000021F1000-memory.dmp

memory/4164-5-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4164-6-0x00000000021E0000-0x00000000021E1000-memory.dmp

memory/4164-7-0x0000000002200000-0x0000000002201000-memory.dmp

memory/4164-8-0x0000000002210000-0x0000000002211000-memory.dmp

memory/4512-9-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4512-11-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4512-14-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4164-13-0x0000000000400000-0x0000000000462000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\NVNAB.txt

MD5 0654f004b2e314bad7f75867e91da37d
SHA1 4232c22e7340b12108d86e3cb35ed288a3dbc7f1
SHA256 ead325a060300a9606a3f0f14694be39a3e4006a60c6c3eb0bea5d6f98192249
SHA512 dda135cdfca90a742d42b4c7a5e7f5df6580ec428302a8f0c311f5b92eb08dda75774e0c7497110faffbe2dfa02b30d2dfe35ec2848a275f53be8d930c7aa553

C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe

MD5 0c40fe2a52c6c6147edeb0e57f640bc5
SHA1 a74203009491069b7959e025ff918e2d273fa6d5
SHA256 fc773c124fad3b8e23d686b9c6f522a36facc36c2400241d158e19dfceeac292
SHA512 d3747d4bb30b2156be048708ff66e08562f71cefeb232328ea593af5f3d483bac15707ac8eb036a936b13a44defb625e981d661af47cd682a7f91937864f91c6

memory/4076-38-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4076-41-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4076-42-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4512-43-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4076-47-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4480-55-0x0000000000400000-0x0000000000405000-memory.dmp

memory/4480-59-0x0000000000400000-0x0000000000405000-memory.dmp

memory/4076-58-0x0000000000400000-0x0000000000462000-memory.dmp

memory/4512-60-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4928-65-0x0000000000D50000-0x0000000000D55000-memory.dmp

memory/4928-69-0x0000000000D50000-0x0000000000D55000-memory.dmp

memory/4228-71-0x0000000000400000-0x000000000040B000-memory.dmp

memory/4928-73-0x0000000000550000-0x0000000000555000-memory.dmp