Malware Analysis Report

2025-06-16 04:57

Sample ID 230317-vgkptabc31
Target 0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa
SHA256 0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa
Tags
amadey laplas redline lint rockins clipper discovery evasion infostealer persistence spyware stealer trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa

Threat Level: Known bad

The file 0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa was found to be: Known bad.

Malicious Activity Summary

amadey laplas redline lint rockins clipper discovery evasion infostealer persistence spyware stealer trojan

Laplas Clipper

RedLine

Modifies Windows Defender Real-time Protection settings

Amadey

Downloads MZ/PE file

Reads user/profile data of web browsers

Windows security modification

Loads dropped DLL

Executes dropped EXE

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Suspicious use of SetThreadContext

Program crash

Enumerates physical storage devices

Creates scheduled task(s)

GoLang User-Agent

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-17 16:57

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-17 16:57

Reported

2023-03-17 17:00

Platform

win10-20230220-en

Max time kernel

142s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe"

Signatures

Amadey

trojan amadey

Laplas Clipper

stealer clipper laplas

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe N/A

RedLine

infostealer redline

Downloads MZ/PE file

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe N/A

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Windows\CurrentVersion\Run\NTSystem = "C:\\Users\\Admin\\AppData\\Roaming\\NTSystem\\ntlhost.exe" C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe N/A
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe N/A

Checks installed software on the system

discovery

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4456 set thread context of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

Enumerates physical storage devices

Creates scheduled task(s)

persistence
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

GoLang User-Agent

Description Indicator Process Target
HTTP User-Agent header Go-http-client/1.1 N/A N/A
HTTP User-Agent header Go-http-client/1.1 N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs0958ww.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2060 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe
PID 2060 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe
PID 2060 wrote to memory of 2248 N/A C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe
PID 2248 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe
PID 2248 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe
PID 2248 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe
PID 2600 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe
PID 2600 wrote to memory of 2648 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe
PID 2600 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe
PID 2600 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe
PID 2600 wrote to memory of 3100 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe
PID 2248 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs0958ww.exe
PID 2248 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs0958ww.exe
PID 2248 wrote to memory of 3644 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs0958ww.exe
PID 2060 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe
PID 2060 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe
PID 2060 wrote to memory of 1296 N/A C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe
PID 1296 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1296 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 1296 wrote to memory of 4816 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
PID 4816 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 4816 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 4816 wrote to memory of 4888 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\schtasks.exe
PID 4816 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 4816 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 4816 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 760 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4900 wrote to memory of 392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4900 wrote to memory of 392 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4900 wrote to memory of 3992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4900 wrote to memory of 3992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4900 wrote to memory of 3992 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4900 wrote to memory of 3940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 3940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 3940 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4900 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4900 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4900 wrote to memory of 2736 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4900 wrote to memory of 4696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4900 wrote to memory of 4696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4900 wrote to memory of 4696 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4816 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe
PID 4816 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe
PID 4816 wrote to memory of 4456 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe
PID 4816 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe
PID 4816 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe
PID 4816 wrote to memory of 4324 N/A C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe
PID 4456 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4456 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4456 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4456 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4456 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4456 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4456 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4456 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4456 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4456 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4456 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4456 wrote to memory of 5104 N/A C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
PID 4324 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe
PID 4324 wrote to memory of 3340 N/A C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe

"C:\Users\Admin\AppData\Local\Temp\0dacd88db481e422150c88430190e20aa4c99c22e4bc35c0249e408145e349fa.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs0958ww.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs0958ww.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "legenda.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\f22b669919" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

"C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe"

C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

"C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe

"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4456 -s 592

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Windows\SysWOW64\rundll32.exe

"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Network

Country Destination Domain Proto
DE 193.233.20.28:4125 tcp
US 8.8.8.8:53 28.20.233.193.in-addr.arpa udp
NL 52.178.17.3:443 tcp
RU 62.204.41.87:80 62.204.41.87 tcp
RU 62.204.41.88:80 62.204.41.88 tcp
US 8.8.8.8:53 87.41.204.62.in-addr.arpa udp
US 8.8.8.8:53 88.41.204.62.in-addr.arpa udp
RU 46.3.197.223:44446 tcp
US 8.8.8.8:53 223.197.3.46.in-addr.arpa udp
US 8.8.8.8:53 52.4.107.13.in-addr.arpa udp
NL 45.159.189.105:80 45.159.189.105 tcp
US 8.8.8.8:53 105.189.159.45.in-addr.arpa udp
NL 45.159.189.105:80 45.159.189.105 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe

MD5 863439475ed8f4eebc7a8b971a21c71e
SHA1 8405433a643f07516761ebc44d4ab7f29d1b8fd9
SHA256 13748314d2c6157da220637a705f9e3e52f990c3b3aa5f9d31c9ed6af6a4be6e
SHA512 f76dbad5f30fe3607c363c8a8245ca12c8877e9d74133a4b4863ca8dbead614bf50e308bafa6dedf7c7262d3976bf65c93a299224f10a342da66fb682a857108

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\will7216.exe

MD5 863439475ed8f4eebc7a8b971a21c71e
SHA1 8405433a643f07516761ebc44d4ab7f29d1b8fd9
SHA256 13748314d2c6157da220637a705f9e3e52f990c3b3aa5f9d31c9ed6af6a4be6e
SHA512 f76dbad5f30fe3607c363c8a8245ca12c8877e9d74133a4b4863ca8dbead614bf50e308bafa6dedf7c7262d3976bf65c93a299224f10a342da66fb682a857108

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe

MD5 b303f5f90c2bc58850ce4468dae79581
SHA1 5b5efa929d32da4e390b1a5ec3087af310865235
SHA256 ebdb062fec1795dfd8fe9c04a9c5ca59368072629ecf536dde98e8032b97927c
SHA512 b52c48acef9b94ab27023eef4ffddee233f8e5d7a62ccf7159fc45f9f4d03e66d3a65f62d61760cb55e1c5d25ebfc5152413425812c094888416f75877dc6298

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\will2229.exe

MD5 b303f5f90c2bc58850ce4468dae79581
SHA1 5b5efa929d32da4e390b1a5ec3087af310865235
SHA256 ebdb062fec1795dfd8fe9c04a9c5ca59368072629ecf536dde98e8032b97927c
SHA512 b52c48acef9b94ab27023eef4ffddee233f8e5d7a62ccf7159fc45f9f4d03e66d3a65f62d61760cb55e1c5d25ebfc5152413425812c094888416f75877dc6298

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\ns6596Pa.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/2648-142-0x0000000000420000-0x000000000042A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe

MD5 9de056f2ae02f1323646c3eb25daef01
SHA1 106ec87143b90ba439ab5be4af63f60adb6bf0c6
SHA256 e180d376c5fcb4b7fc7bca2e505fa351c7c84ff8e5b02d2ab96fd46d26232236
SHA512 a02107c94427747a68ec46170915a4441521da063403ed4925e9245073ad0e20c138199acf3251afa0306c16428e2d7c25a92779b41dd20424c9572ea4bdccfa

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\py99lC21.exe

MD5 9de056f2ae02f1323646c3eb25daef01
SHA1 106ec87143b90ba439ab5be4af63f60adb6bf0c6
SHA256 e180d376c5fcb4b7fc7bca2e505fa351c7c84ff8e5b02d2ab96fd46d26232236
SHA512 a02107c94427747a68ec46170915a4441521da063403ed4925e9245073ad0e20c138199acf3251afa0306c16428e2d7c25a92779b41dd20424c9572ea4bdccfa

memory/3100-148-0x00000000049B0000-0x00000000049CA000-memory.dmp

memory/3100-149-0x0000000007060000-0x000000000755E000-memory.dmp

memory/3100-150-0x0000000004B50000-0x0000000004B68000-memory.dmp

memory/3100-151-0x00000000001D0000-0x00000000001FD000-memory.dmp

memory/3100-152-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/3100-153-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/3100-154-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/3100-155-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-156-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-158-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-162-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-160-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-164-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-166-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-168-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-170-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-172-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-174-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-176-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-178-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-180-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-182-0x0000000004B50000-0x0000000004B62000-memory.dmp

memory/3100-183-0x0000000000400000-0x0000000002B05000-memory.dmp

memory/3100-184-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/3100-185-0x00000000049D0000-0x00000000049E0000-memory.dmp

memory/3100-187-0x0000000000400000-0x0000000002B05000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs0958ww.exe

MD5 0ecc8ab62b7278cc6650517251f1543c
SHA1 b4273cda193a20d48e83241275ffc34ddad412f2
SHA256 b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a
SHA512 c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\qs0958ww.exe

MD5 0ecc8ab62b7278cc6650517251f1543c
SHA1 b4273cda193a20d48e83241275ffc34ddad412f2
SHA256 b0f1238e54ac8e3534af7ecb4f834bea3223120fedb1eab80f7a1bf00fb5b97a
SHA512 c79d266c82b766ca39377fd02b3bc307fce4b59f53936e97c162200de3f8b3f72f6beda2aef2ab9ecd9be669b625c6ed0aaefa157cca7ac11d78b1939f660092

memory/3644-191-0x0000000000A80000-0x0000000000AB2000-memory.dmp

memory/3644-192-0x0000000005820000-0x0000000005E26000-memory.dmp

memory/3644-193-0x00000000053B0000-0x00000000054BA000-memory.dmp

memory/3644-194-0x00000000052E0000-0x00000000052F2000-memory.dmp

memory/3644-195-0x00000000055F0000-0x0000000005600000-memory.dmp

memory/3644-196-0x0000000005340000-0x000000000537E000-memory.dmp

memory/3644-197-0x00000000054C0000-0x000000000550B000-memory.dmp

memory/3644-198-0x0000000005670000-0x00000000056D6000-memory.dmp

memory/3644-199-0x0000000006220000-0x00000000062B2000-memory.dmp

memory/3644-200-0x00000000069E0000-0x0000000006A56000-memory.dmp

memory/3644-201-0x0000000006960000-0x00000000069B0000-memory.dmp

memory/3644-202-0x0000000006C30000-0x0000000006DF2000-memory.dmp

memory/3644-203-0x0000000007330000-0x000000000785C000-memory.dmp

memory/3644-204-0x00000000055F0000-0x0000000005600000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ry77xP72.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

MD5 57e3fc905b5cb1811f155ec4aef82795
SHA1 2ca77867f751067d96d1eb27828de238b403e414
SHA256 a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d
SHA512 f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

MD5 57e3fc905b5cb1811f155ec4aef82795
SHA1 2ca77867f751067d96d1eb27828de238b403e414
SHA256 a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d
SHA512 f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

C:\Users\Admin\AppData\Local\Temp\1000056001\w6auj9ii3rp.exe

MD5 57e3fc905b5cb1811f155ec4aef82795
SHA1 2ca77867f751067d96d1eb27828de238b403e414
SHA256 a8509b53acec11ea8c6ca3845a9110d0c3477a60f4ca418f7dfd1a29f320765d
SHA512 f843a3b6a93dea4f1375cd7098bb36edab2096d0657abc0cebf2d95c7b8a424a12c0dfe281bacab26f9b38fc8bb673c0731a39f6b7eccaa111ef3e00286d835d

C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

MD5 665c62d3bd6c21614fafb9a9b50bb574
SHA1 56322f2bb8a61954e6ec974612154402cdd98b29
SHA256 a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99
SHA512 07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

MD5 665c62d3bd6c21614fafb9a9b50bb574
SHA1 56322f2bb8a61954e6ec974612154402cdd98b29
SHA256 a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99
SHA512 07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

C:\Users\Admin\AppData\Local\Temp\1000058001\svhostе.exe

MD5 665c62d3bd6c21614fafb9a9b50bb574
SHA1 56322f2bb8a61954e6ec974612154402cdd98b29
SHA256 a82b9eff2dde393899dfa05985773fc9d124816b675019a0a8c551d9bb6d4d99
SHA512 07fda86a50c1aca80db3906e4201ec4f97be00d1563eb386d750b28160cd30bed1435e473c9330943d5c854a55fc7078bcdd3c99731fabd8019b1b22e10f9ed7

memory/4324-242-0x00000000049A0000-0x0000000004D70000-memory.dmp

memory/5104-243-0x0000000000400000-0x0000000000432000-memory.dmp

memory/5104-244-0x0000000004A80000-0x0000000004ACB000-memory.dmp

memory/5104-245-0x0000000004C00000-0x0000000004C10000-memory.dmp

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 913b08eca647f6d3d31bbadc1bb29829
SHA1 15ec5f650c4329b534ca0821eb1a9bc21986d094
SHA256 6bf575f20c8acc7fafcf339a50f2c9be88d26ca3ff701d2f831ab719ebc1f856
SHA512 851552f54250bc65e91468d20c740f54f9b76f73118e2cd6103ca77cd1cf69041280f4de00a419fefd4cc67427766ed88fbf8de56189c78a167ab52600ba17a2

C:\Users\Admin\AppData\Roaming\NTSystem\ntlhost.exe

MD5 5a75e9ef59e2201ef17f577a7ab7312a
SHA1 ff44831678142858151a497c52bad997593da410
SHA256 8b0e6875ddbc2153fa833cb31dc6f2c14e8f76b521add13e7ab3bc338ded48a7
SHA512 8df6d53945173d7525c1745e9043ab93c3e66dd8d146dd2f5ef1db68d1d2498bd1928b234dc23120625cb48491b2e4c9648c64850c680ea380ca6aef8ecf9714

memory/4324-251-0x0000000000400000-0x0000000002C8E000-memory.dmp

memory/3340-252-0x0000000000400000-0x0000000002C8E000-memory.dmp

memory/5104-253-0x0000000004C00000-0x0000000004C10000-memory.dmp

memory/3340-255-0x0000000000400000-0x0000000002C8E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

memory/3340-257-0x0000000000400000-0x0000000002C8E000-memory.dmp

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

MD5 94cbeec5d4343918fd0e48760e40539c
SHA1 a049266c5c1131f692f306c8710d7e72586ae79d
SHA256 48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA512 4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

MD5 16cf28ebb6d37dbaba93f18320c6086e
SHA1 eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256 c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512 f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

memory/3340-259-0x0000000000400000-0x0000000002C8E000-memory.dmp

memory/3340-279-0x0000000000400000-0x0000000002C8E000-memory.dmp

memory/3340-280-0x0000000000400000-0x0000000002C8E000-memory.dmp

memory/3340-281-0x0000000000400000-0x0000000002C8E000-memory.dmp

memory/3340-282-0x0000000000400000-0x0000000002C8E000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

MD5 5086db99de54fca268169a1c6cf26122
SHA1 003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA256 42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA512 90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

memory/3340-284-0x0000000000400000-0x0000000002C8E000-memory.dmp