mimikatz | 87181855813627344ca0ac67c10dca6a04d436b62d2b915450964a7fa98b3dc1

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/07/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Size 8.3MB
Sample260710-ft47naex2w
SHA256 87181855813627344ca0ac67c10dca6a04d436b62d2b915450964a7fa98b3dc1
MD5 9928c9f752e3a5b3d3a8065be4bf0e0c
SHA1 35a5cd1198bd889be1b2003a1c0611ddaf7acec2
SHA512 140fb8827d4c5a0e956198f3316ee5c862fb0904feadcdc2653a93e01c1896a2287c51e4a6bc6e6ce6f480b5f12cd3b97a273124d15bee67cf672d306ad2a98d
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T18F96F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery mimikatz installer

Malware Config

Signatures

Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

mimikatz is an open source tool to dump credentials on Windows 3 IoCs

resource	yara_rule
behavioral1/memory/2820-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral1/memory/2820-4-0x0000000000400000-0x0000000000A6E000-memory.dmp	mimikatz
behavioral1/files/0x000c0000000244b9-6.dat	mimikatz

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/memory/2820-0-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral1/memory/2820-4-0x0000000000400000-0x0000000000A6E000-memory.dmp	UPX
behavioral1/files/0x000c0000000244b9-6.dat	UPX

Executes dropped EXE 2 IoCs

pid	Process
3724	wmzfehd.exe
2996	wmzfehd.exe

Unexpected DNS network traffic destination 64 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	63	208.67.220.220	2772	nslookup.exe
Destination IP	65	208.67.220.220	2772	nslookup.exe
Destination IP	117	117.50.22.22	1048	nslookup.exe
Destination IP	122	208.67.220.220	1000	nslookup.exe
Destination IP	131	117.50.11.11	5028	nslookup.exe
Destination IP	176	117.50.11.11	2996	wmzfehd.exe
Destination IP	46	117.50.22.22	4212	nslookup.exe
Destination IP	114	117.50.11.11	960	nslookup.exe
Destination IP	159	208.67.222.222	4976	nslookup.exe
Destination IP	160	208.67.222.222	4976	nslookup.exe
Destination IP	174	117.50.11.11	2728	nslookup.exe
Destination IP	75	117.50.22.22	3192	nslookup.exe
Destination IP	24	117.50.22.22	3508	nslookup.exe
Destination IP	61	208.67.222.222	4968	nslookup.exe
Destination IP	74	117.50.11.11	4104	nslookup.exe
Destination IP	76	117.50.22.22	3192	nslookup.exe
Destination IP	112	117.50.11.11	960	nslookup.exe
Destination IP	133	117.50.22.22	3900	nslookup.exe
Destination IP	140	208.67.220.220	2812	nslookup.exe
Destination IP	41	117.50.11.11	3000	nslookup.exe
Destination IP	81	208.67.220.220	812	nslookup.exe
Destination IP	99	208.67.222.222	1036	nslookup.exe
Destination IP	135	117.50.22.22	3900	nslookup.exe
Destination IP	141	208.67.220.220	2812	nslookup.exe
Destination IP	156	117.50.22.22	4524	nslookup.exe
Destination IP	161	208.67.222.222	4976	nslookup.exe
Destination IP	178	117.50.22.22	2996	wmzfehd.exe
Destination IP	31	208.67.222.222	3964	nslookup.exe
Destination IP	78	208.67.222.222	2804	nslookup.exe
Destination IP	80	208.67.222.222	2804	nslookup.exe
Destination IP	139	208.67.220.220	2812	nslookup.exe
Destination IP	158	117.50.22.22	4524	nslookup.exe
Destination IP	181	208.67.222.222	2996	wmzfehd.exe
Destination IP	79	208.67.222.222	2804	nslookup.exe
Destination IP	83	208.67.220.220	812	nslookup.exe
Destination IP	90	117.50.11.11	3380	nslookup.exe
Destination IP	91	117.50.11.11	3380	nslookup.exe
Destination IP	121	208.67.220.220	1000	nslookup.exe
Destination IP	132	117.50.11.11	5028	nslookup.exe
Destination IP	137	208.67.222.222	2488	nslookup.exe
Destination IP	162	208.67.220.220	3368	nslookup.exe
Destination IP	60	208.67.222.222	4968	nslookup.exe
Destination IP	103	208.67.220.220	4876	nslookup.exe
Destination IP	115	117.50.22.22	1048	nslookup.exe
Destination IP	157	117.50.22.22	4524	nslookup.exe
Destination IP	42	117.50.11.11	3000	nslookup.exe
Destination IP	18	117.50.11.11	804	nslookup.exe
Destination IP	29	208.67.222.222	3964	nslookup.exe
Destination IP	93	117.50.22.22	3636	nslookup.exe
Destination IP	95	117.50.22.22	3636	nslookup.exe
Destination IP	119	208.67.222.222	4212	nslookup.exe
Destination IP	120	208.67.222.222	4212	nslookup.exe
Destination IP	19	117.50.11.11	804	nslookup.exe
Destination IP	20	117.50.11.11	804	nslookup.exe
Destination IP	21	117.50.22.22	3508	nslookup.exe
Destination IP	164	208.67.220.220	3368	nslookup.exe
Destination IP	180	208.67.222.222	4424	nslookup.exe
Destination IP	32	208.67.220.220	3568	nslookup.exe
Destination IP	62	208.67.222.222	4968	nslookup.exe
Destination IP	73	117.50.11.11	4104	nslookup.exe
Destination IP	113	117.50.11.11	960	nslookup.exe
Destination IP	130	117.50.11.11	5028	nslookup.exe
Destination IP	134	117.50.22.22	3900	nslookup.exe
Destination IP	151	117.50.11.11	3564	nslookup.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	wmzfehd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	wmzfehd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	wmzfehd.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	wmzfehd.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\iyyewzvf\wmzfehd.exe	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
File opened for modification	C:\Windows\iyyewzvf\wmzfehd.exe	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmzfehd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nslookup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3840	cmd.exe
2360	PING.EXE

NSIS installer 1 IoCs

installer

resource	yara_rule
behavioral1/files/0x000c0000000244b9-6.dat	nsis_installer_2

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wmzfehd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wmzfehd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	wmzfehd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	wmzfehd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wmzfehd.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wmzfehd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wmzfehd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	wmzfehd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2360	PING.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2820	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2820	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
Token: SeDebugPrivilege	3724	wmzfehd.exe
Token: SeDebugPrivilege	2996	wmzfehd.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2820	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
3724	wmzfehd.exe
2996	wmzfehd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 3840	2820	2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe	86
PID 3840 wrote to memory of 2360	3840	cmd.exe	88
PID 3840 wrote to memory of 3724	3840	cmd.exe	90
PID 2996 wrote to memory of 1776	2996	wmzfehd.exe	94
PID 1776 wrote to memory of 1812	1776	cmd.exe	96
PID 2996 wrote to memory of 3124	2996	wmzfehd.exe	97
PID 3124 wrote to memory of 2740	3124	cmd.exe	99
PID 2996 wrote to memory of 860	2996	wmzfehd.exe	101
PID 860 wrote to memory of 804	860	cmd.exe	103
PID 2996 wrote to memory of 564	2996	wmzfehd.exe	108
PID 564 wrote to memory of 3508	564	cmd.exe	110
PID 2996 wrote to memory of 4504	2996	wmzfehd.exe	111
PID 4504 wrote to memory of 3964	4504	cmd.exe	113
PID 2996 wrote to memory of 4512	2996	wmzfehd.exe	114
PID 4512 wrote to memory of 3568	4512	cmd.exe	116
PID 2996 wrote to memory of 3912	2996	wmzfehd.exe	117
PID 3912 wrote to memory of 748	3912	cmd.exe	119
PID 2996 wrote to memory of 452	2996	wmzfehd.exe	120
PID 452 wrote to memory of 2604	452	cmd.exe	122
PID 2996 wrote to memory of 1808	2996	wmzfehd.exe	123
PID 1808 wrote to memory of 3000	1808	cmd.exe	125
PID 2996 wrote to memory of 4640	2996	wmzfehd.exe	126
PID 4640 wrote to memory of 4212	4640	cmd.exe	128
PID 2996 wrote to memory of 5084	2996	wmzfehd.exe	131
PID 5084 wrote to memory of 4968	5084	cmd.exe	133
PID 2996 wrote to memory of 400	2996	wmzfehd.exe	134
PID 400 wrote to memory of 2772	400	cmd.exe	136
PID 2996 wrote to memory of 1096	2996	wmzfehd.exe	137
PID 1096 wrote to memory of 2000	1096	cmd.exe	139
PID 2996 wrote to memory of 2208	2996	wmzfehd.exe	140
PID 2208 wrote to memory of 4116	2208	cmd.exe	142
PID 2996 wrote to memory of 3860	2996	wmzfehd.exe	143
PID 3860 wrote to memory of 4104	3860	cmd.exe	145
PID 2996 wrote to memory of 1500	2996	wmzfehd.exe	146
PID 1500 wrote to memory of 3192	1500	cmd.exe	148
PID 2996 wrote to memory of 4260	2996	wmzfehd.exe	149
PID 4260 wrote to memory of 2804	4260	cmd.exe	151
PID 2996 wrote to memory of 3208	2996	wmzfehd.exe	152
PID 3208 wrote to memory of 812	3208	cmd.exe	154
PID 2996 wrote to memory of 3772	2996	wmzfehd.exe	155
PID 3772 wrote to memory of 4352	3772	cmd.exe	157
PID 2996 wrote to memory of 4724	2996	wmzfehd.exe	158
PID 4724 wrote to memory of 2388	4724	cmd.exe	160
PID 2996 wrote to memory of 3920	2996	wmzfehd.exe	161
PID 3920 wrote to memory of 3380	3920	cmd.exe	163
PID 2996 wrote to memory of 1872	2996	wmzfehd.exe	164
PID 1872 wrote to memory of 3636	1872	cmd.exe	166
PID 2996 wrote to memory of 3952	2996	wmzfehd.exe	167
PID 3952 wrote to memory of 1036	3952	cmd.exe	169
PID 2996 wrote to memory of 2884	2996	wmzfehd.exe	170
PID 2884 wrote to memory of 4876	2884	cmd.exe	172
PID 2996 wrote to memory of 2428	2996	wmzfehd.exe	173
PID 2428 wrote to memory of 2540	2428	cmd.exe	175
PID 2996 wrote to memory of 2372	2996	wmzfehd.exe	176
PID 2372 wrote to memory of 4828	2372	cmd.exe	178
PID 2996 wrote to memory of 4372	2996	wmzfehd.exe	179
PID 4372 wrote to memory of 960	4372	cmd.exe	181
PID 2996 wrote to memory of 4608	2996	wmzfehd.exe	182
PID 4608 wrote to memory of 1048	4608	cmd.exe	184
PID 2996 wrote to memory of 3776	2996	wmzfehd.exe	185
PID 3776 wrote to memory of 4212	3776	cmd.exe	187
PID 2996 wrote to memory of 4448	2996	wmzfehd.exe	188
PID 4448 wrote to memory of 1000	4448	cmd.exe	190
PID 2996 wrote to memory of 1592	2996	wmzfehd.exe	191

C:\Users\Admin\AppData\Local\Temp\2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_9928c9f752e3a5b3d3a8065be4bf0e0c_amadey_cloudeye_coinminer_elex_emotet_glassworm_hacktool.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\iyyewzvf\wmzfehd.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2360
- - C:\Windows\iyyewzvf\wmzfehd.exe
    C:\Windows\iyyewzvf\wmzfehd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:3724

C:\Windows\iyyewzvf\wmzfehd.exe
C:\Windows\iyyewzvf\wmzfehd.exe
1⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    PID:804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3508
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4504
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3964
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A aj.0x0x0x0x0.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:3568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3912
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:4212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4968
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A xs.0x0x0x0x0.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 1.1.1.1
    3⤵
    PID:4116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    PID:3192
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2804
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ui.0x0x0x0x0.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3636
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1036
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A qb.1c1c1c1c.best 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2540
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4372
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4212
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4448
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A ce.1c1c1c1c.club 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:1000
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1592
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
  2⤵
  PID:4356
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 1.1.1.1
    3⤵
    PID:772
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3036
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:5028
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2716
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
  2⤵
  PID:864
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:2488
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
  2⤵
  PID:2720
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A jz.1c1c1c1c.xyz 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2812
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4208
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1844
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 1.1.1.1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2960
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 1.1.1.1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1840
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.11.11
  2⤵
  - System Location Discovery: System Language Discovery
  PID:204
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4092
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 117.50.22.22
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.222.222
  2⤵
  PID:3460
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:4976
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.heroherohero.info 208.67.220.220
  2⤵
  PID:764
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.heroherohero.info 208.67.220.220
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:3368
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 8.8.8.8
  2⤵
  PID:4904
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 8.8.8.8
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2440
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 1.1.1.1
  2⤵
  PID:1084
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 1.1.1.1
    3⤵
    PID:2460
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.11.11
  2⤵
  PID:4988
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.11.11
    3⤵
    - Unexpected DNS network traffic destination
    - System Location Discovery: System Language Discovery
    PID:2728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 117.50.22.22
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3100
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 117.50.22.22
    3⤵
    PID:4308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c nslookup -qt=A bk.kingminer.club 208.67.222.222
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3876
- - C:\Windows\SysWOW64\nslookup.exe
    nslookup -qt=A bk.kingminer.club 208.67.222.222
    3⤵
    - Unexpected DNS network traffic destination
    PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

wmzfehd.exe

Path C:\Windows\iyyewzvf\wmzfehd.exe
Size 8.3MB
SHA256 60c6780fa7f13e077c65dcfadb6aaf7d7dd98d93221869872f6f8f628d0956ae
MD5 a93f2b5d8d38bf5b8d0f826c0e19b863
SHA1 22ff2be8d11d1a635191b9f5fd66bb5b1102a82c
SHA512 7358f24f63d12a452ec9e4d672a3c776e9f2ba1022254459d0a68ec0069ae7a66708b73e24c1b1f29edee06e6423f8a468b0c7e7e805584044f2b349ca6e10ca
SSDEEP 98304:os0vXTBJYa5mknGzZr+HaOKSVPFtmOZ9G1rxwFB5URUSKnaSOProSCa:o3XTYQmknGzwHaOtVPHd9swFBubKL
TLSH
T15F96F1315B536062C0D642F0C276DEEF38B331B845D8794E778A9AA19E7839065BD32F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2820-0-0x0000000000400000-0x0000000000A6E000-memory.dmp

Download

memory/2820-4-0x0000000000400000-0x0000000000A6E000-memory.dmp