amadey | 0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e

Analysis

max time kernel
105s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 13:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exe
Size

1.0MB
MD5

633cb807507db66d8540196b8b993c9f
SHA1

5590179a510417f388b5eb5d550c1b33a67b8399
SHA256

0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e
SHA512

5e915e030ae9b9f187a791646173f88b7015741b0b06d7d5c94f00960aef1df300f776e480ddbf8a52614f39177e8634a71aea9ed1d709040c5e957a3a743644
SSDEEP

24576:7y3VnEHZB9SaZCeh2ERdUofJjDDR1xDgk0muUixfuTUrN2m:ul0ZrSaYeUMfJfDR7Zwx2TUrN2

Score

10^/10

amadey redline gena vint discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

193.233.20.30:4125

Attributes

auth_value
fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz2260.exev2551iF.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz2260.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz2260.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v2551iF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v2551iF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v2551iF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz2260.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz2260.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz2260.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz2260.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v2551iF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v2551iF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v2551iF.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3168-210-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-211-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-213-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-215-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-217-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-219-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-221-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-223-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-225-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-227-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-229-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-231-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-238-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-233-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-241-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-243-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-245-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-247-0x0000000005290000-0x00000000052CE000-memory.dmp	family_redline
behavioral1/memory/3168-1128-0x0000000004B70000-0x0000000004B80000-memory.dmp	family_redline

Downloads MZ/PE file

.NET Reactor proctector 5 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe	net_reactor
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe	net_reactor
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe	net_reactor
behavioral1/memory/3480-1174-0x0000000000410000-0x0000000000984000-memory.dmp	net_reactor
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe	net_reactor

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y65iW98.exelegenda.exeGood.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	y65iW98.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	legenda.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	Good.exe

Executes dropped EXE 12 IoCs

Processes:

zap1667.exezap2185.exezap8902.exetz2260.exev2551iF.exew20Jw96.exexbnEl82.exey65iW98.exelegenda.exeGood.exeGood.exelegenda.exe

pid	process
2768	zap1667.exe
3980	zap2185.exe
2628	zap8902.exe
312	tz2260.exe
2148	v2551iF.exe
3168	w20Jw96.exe
2152	xbnEl82.exe
3444	y65iW98.exe
4828	legenda.exe
3480	Good.exe
4696	Good.exe
3144	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4676 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4676	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz2260.exev2551iF.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz2260.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v2551iF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v2551iF.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap2185.exezap8902.exe0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exezap1667.exeGood.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap2185.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap8902.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1667.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap2185.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyTestApplication = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000112001\\Good.exe"	Good.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap1667.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap8902.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

64 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

Good.exe

description pid process target process

PID 3480 set thread context of 4696 3480 Good.exe Good.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1576 2148 WerFault.exe v2551iF.exe
1472 3168 WerFault.exe w20Jw96.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3668 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4380 PING.EXE
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz2260.exev2551iF.exew20Jw96.exexbnEl82.exe

pid process

312 tz2260.exe
312 tz2260.exe
2148 v2551iF.exe
2148 v2551iF.exe
3168 w20Jw96.exe
3168 w20Jw96.exe
2152 xbnEl82.exe
2152 xbnEl82.exe

flow	ioc
64	ip-api.com

description	pid	process	target process
PID 3480 set thread context of 4696	3480	Good.exe	Good.exe

pid	pid_target	process	target process
1576	2148	WerFault.exe	v2551iF.exe
1472	3168	WerFault.exe	w20Jw96.exe

pid	process
3668	schtasks.exe

pid	process
4380	PING.EXE

pid	process
312	tz2260.exe
312	tz2260.exe
2148	v2551iF.exe
2148	v2551iF.exe
3168	w20Jw96.exe
3168	w20Jw96.exe
2152	xbnEl82.exe
2152	xbnEl82.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

tz2260.exev2551iF.exew20Jw96.exexbnEl82.exeGood.exeGood.exe

description	pid	process
Token: SeDebugPrivilege	312	tz2260.exe
Token: SeDebugPrivilege	2148	v2551iF.exe
Token: SeDebugPrivilege	3168	w20Jw96.exe
Token: SeDebugPrivilege	2152	xbnEl82.exe
Token: SeDebugPrivilege	3480	Good.exe
Token: SeDebugPrivilege	4696	Good.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exezap1667.exezap2185.exezap8902.exey65iW98.exelegenda.execmd.exeGood.exeGood.exe

description	pid	process	target process
PID 1052 wrote to memory of 2768	1052	0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exe	zap1667.exe
PID 1052 wrote to memory of 2768	1052	0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exe	zap1667.exe
PID 1052 wrote to memory of 2768	1052	0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exe	zap1667.exe
PID 2768 wrote to memory of 3980	2768	zap1667.exe	zap2185.exe
PID 2768 wrote to memory of 3980	2768	zap1667.exe	zap2185.exe
PID 2768 wrote to memory of 3980	2768	zap1667.exe	zap2185.exe
PID 3980 wrote to memory of 2628	3980	zap2185.exe	zap8902.exe
PID 3980 wrote to memory of 2628	3980	zap2185.exe	zap8902.exe
PID 3980 wrote to memory of 2628	3980	zap2185.exe	zap8902.exe
PID 2628 wrote to memory of 312	2628	zap8902.exe	tz2260.exe
PID 2628 wrote to memory of 312	2628	zap8902.exe	tz2260.exe
PID 2628 wrote to memory of 2148	2628	zap8902.exe	v2551iF.exe
PID 2628 wrote to memory of 2148	2628	zap8902.exe	v2551iF.exe
PID 2628 wrote to memory of 2148	2628	zap8902.exe	v2551iF.exe
PID 3980 wrote to memory of 3168	3980	zap2185.exe	w20Jw96.exe
PID 3980 wrote to memory of 3168	3980	zap2185.exe	w20Jw96.exe
PID 3980 wrote to memory of 3168	3980	zap2185.exe	w20Jw96.exe
PID 2768 wrote to memory of 2152	2768	zap1667.exe	xbnEl82.exe
PID 2768 wrote to memory of 2152	2768	zap1667.exe	xbnEl82.exe
PID 2768 wrote to memory of 2152	2768	zap1667.exe	xbnEl82.exe
PID 1052 wrote to memory of 3444	1052	0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exe	y65iW98.exe
PID 1052 wrote to memory of 3444	1052	0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exe	y65iW98.exe
PID 1052 wrote to memory of 3444	1052	0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exe	y65iW98.exe
PID 3444 wrote to memory of 4828	3444	y65iW98.exe	legenda.exe
PID 3444 wrote to memory of 4828	3444	y65iW98.exe	legenda.exe
PID 3444 wrote to memory of 4828	3444	y65iW98.exe	legenda.exe
PID 4828 wrote to memory of 3668	4828	legenda.exe	schtasks.exe
PID 4828 wrote to memory of 3668	4828	legenda.exe	schtasks.exe
PID 4828 wrote to memory of 3668	4828	legenda.exe	schtasks.exe
PID 4828 wrote to memory of 3448	4828	legenda.exe	cmd.exe
PID 4828 wrote to memory of 3448	4828	legenda.exe	cmd.exe
PID 4828 wrote to memory of 3448	4828	legenda.exe	cmd.exe
PID 3448 wrote to memory of 1992	3448	cmd.exe	cmd.exe
PID 3448 wrote to memory of 1992	3448	cmd.exe	cmd.exe
PID 3448 wrote to memory of 1992	3448	cmd.exe	cmd.exe
PID 3448 wrote to memory of 964	3448	cmd.exe	cacls.exe
PID 3448 wrote to memory of 964	3448	cmd.exe	cacls.exe
PID 3448 wrote to memory of 964	3448	cmd.exe	cacls.exe
PID 3448 wrote to memory of 3968	3448	cmd.exe	cacls.exe
PID 3448 wrote to memory of 3968	3448	cmd.exe	cacls.exe
PID 3448 wrote to memory of 3968	3448	cmd.exe	cacls.exe
PID 3448 wrote to memory of 4452	3448	cmd.exe	cmd.exe
PID 3448 wrote to memory of 4452	3448	cmd.exe	cmd.exe
PID 3448 wrote to memory of 4452	3448	cmd.exe	cmd.exe
PID 3448 wrote to memory of 3796	3448	cmd.exe	cacls.exe
PID 3448 wrote to memory of 3796	3448	cmd.exe	cacls.exe
PID 3448 wrote to memory of 3796	3448	cmd.exe	cacls.exe
PID 3448 wrote to memory of 3824	3448	cmd.exe	cacls.exe
PID 3448 wrote to memory of 3824	3448	cmd.exe	cacls.exe
PID 3448 wrote to memory of 3824	3448	cmd.exe	cacls.exe
PID 4828 wrote to memory of 3480	4828	legenda.exe	Good.exe
PID 4828 wrote to memory of 3480	4828	legenda.exe	Good.exe
PID 4828 wrote to memory of 3480	4828	legenda.exe	Good.exe
PID 3480 wrote to memory of 4696	3480	Good.exe	Good.exe
PID 3480 wrote to memory of 4696	3480	Good.exe	Good.exe
PID 3480 wrote to memory of 4696	3480	Good.exe	Good.exe
PID 3480 wrote to memory of 4696	3480	Good.exe	Good.exe
PID 3480 wrote to memory of 4696	3480	Good.exe	Good.exe
PID 3480 wrote to memory of 4696	3480	Good.exe	Good.exe
PID 3480 wrote to memory of 4696	3480	Good.exe	Good.exe
PID 3480 wrote to memory of 4696	3480	Good.exe	Good.exe
PID 4696 wrote to memory of 1408	4696	Good.exe	cmd.exe
PID 4696 wrote to memory of 1408	4696	Good.exe	cmd.exe
PID 4696 wrote to memory of 1408	4696	Good.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exe
"C:\Users\Admin\AppData\Local\Temp\0d5c157807445d2d44cee354ba09bdff9f3a01a817216c6bbfb3ea0605e8b06e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1052

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1667.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1667.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2768

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2185.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2185.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3980

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8902.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8902.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2628

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2260.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2260.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:312

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2551iF.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2551iF.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2148 -s 1084
6⤵
- Program crash
PID:1576

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w20Jw96.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w20Jw96.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 1336
5⤵
- Program crash
PID:1472

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbnEl82.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbnEl82.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y65iW98.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y65iW98.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:3668

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1992

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:964

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:3968

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:4452

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:3796

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:3824

C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe
"C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480

C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe
"C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe"
6⤵
PID:1408

C:\Windows\SysWOW64\chcp.com
chcp 65001
7⤵
PID:2380

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
7⤵
- Runs ping.exe
PID:4380

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2148 -ip 2148
1⤵
PID:3484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3168 -ip 3168
1⤵
PID:2336

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:3144

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Good.exe.log
Filesize
321B

MD5
08027eeee0542c93662aef98d70095e4

SHA1
42402c02bf4763fcd6fb0650fc13386f2eae8f9b

SHA256
1b9ec007ac8e7de37c61313c5e1b9444df6dc0cd9110553bfa281b13204a646d

SHA512
c4e7a17a1dc1f27c91791439d92435a5d750a065508e9539c9af458f21472a7ce45ba0666ef6855a00386e1a75c518d0908b82d929084a1b67ca4c65997a5979

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe
Filesize
5.4MB

MD5
9086ff963ae98510ea0eb9abad045939

SHA1
e9999c73e07daf9ba223fbf796d56ae762b748fa

SHA256
138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f

SHA512
f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe
Filesize
5.4MB

MD5
9086ff963ae98510ea0eb9abad045939

SHA1
e9999c73e07daf9ba223fbf796d56ae762b748fa

SHA256
138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f

SHA512
f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe
Filesize
5.4MB

MD5
9086ff963ae98510ea0eb9abad045939

SHA1
e9999c73e07daf9ba223fbf796d56ae762b748fa

SHA256
138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f

SHA512
f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe
Filesize
5.4MB

MD5
9086ff963ae98510ea0eb9abad045939

SHA1
e9999c73e07daf9ba223fbf796d56ae762b748fa

SHA256
138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f

SHA512
f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y65iW98.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y65iW98.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1667.exe
Filesize
875KB

MD5
d800ed44c8d66e7ef5e9455673b353e9

SHA1
6b80cf007aa6b9a16a6687c9b7d9f20e5ce73cd2

SHA256
8fa8e12c6d513989533d48f6cd38ead556bda5039d7062aa36be81ba1e3f68ec

SHA512
717b8749baa137ac56ac381870809bdfd0a594ddf330d39e7a4c93e1f5b36ae9e7f1f0c54ba2b53e911804b0400e89b9c8eb334918c18b21abdcd3befde4b0a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap1667.exe
Filesize
875KB

MD5
d800ed44c8d66e7ef5e9455673b353e9

SHA1
6b80cf007aa6b9a16a6687c9b7d9f20e5ce73cd2

SHA256
8fa8e12c6d513989533d48f6cd38ead556bda5039d7062aa36be81ba1e3f68ec

SHA512
717b8749baa137ac56ac381870809bdfd0a594ddf330d39e7a4c93e1f5b36ae9e7f1f0c54ba2b53e911804b0400e89b9c8eb334918c18b21abdcd3befde4b0a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbnEl82.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbnEl82.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2185.exe
Filesize
733KB

MD5
a1ca88bd730e93f1b177ddd0d68b81c3

SHA1
913124badcad33866726742884fa44e5dfd2727c

SHA256
128581423de9277085bf81e45b4b84ae75e338c7c5550e229d82ad19d910cf94

SHA512
c6527e124b549b2edd1b1eff3c46a046dbb39cd4755ac205d0179a3e18038486cca9a30080bddf00460fb622e82e1481ee4d6b07c9cd2c14fa83d876a9044893

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap2185.exe
Filesize
733KB

MD5
a1ca88bd730e93f1b177ddd0d68b81c3

SHA1
913124badcad33866726742884fa44e5dfd2727c

SHA256
128581423de9277085bf81e45b4b84ae75e338c7c5550e229d82ad19d910cf94

SHA512
c6527e124b549b2edd1b1eff3c46a046dbb39cd4755ac205d0179a3e18038486cca9a30080bddf00460fb622e82e1481ee4d6b07c9cd2c14fa83d876a9044893

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w20Jw96.exe
Filesize
420KB

MD5
582330936e665996ab94f4d534a27b2d

SHA1
015bc725cc695ba22f513ab1c6b4fbe0ce9fafd7

SHA256
0f2d9825a9150e548292bfde4ede6f3f24f48cce2a1b81284e9c333d8a2e38ef

SHA512
2b13f54e7e0f1da7aa81ceb6563f290c00c0a88b8963f20cca7d1108ee2bb059ad2c17e89ebaed136b6809f36581d5d74062f96d4844999e9cd11291c3c9497b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w20Jw96.exe
Filesize
420KB

MD5
582330936e665996ab94f4d534a27b2d

SHA1
015bc725cc695ba22f513ab1c6b4fbe0ce9fafd7

SHA256
0f2d9825a9150e548292bfde4ede6f3f24f48cce2a1b81284e9c333d8a2e38ef

SHA512
2b13f54e7e0f1da7aa81ceb6563f290c00c0a88b8963f20cca7d1108ee2bb059ad2c17e89ebaed136b6809f36581d5d74062f96d4844999e9cd11291c3c9497b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8902.exe
Filesize
362KB

MD5
c1327a0ebf7bd7591f78d42243aa844a

SHA1
3cc7b79442ccaa4023ca71917a3cf8b2d010781e

SHA256
00bbd21b0b1bdd647e485e64ce36ab5e66d1de2ef40625307fc2013d52a0b62f

SHA512
8cb57a1b363fd875bd1a261ea2de1b7915613b85d69697cb7727fb4d34ca2514b18dadde23c757c28db5a5620e440e930681eaa6fd3e7330c4dbe425abe39ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8902.exe
Filesize
362KB

MD5
c1327a0ebf7bd7591f78d42243aa844a

SHA1
3cc7b79442ccaa4023ca71917a3cf8b2d010781e

SHA256
00bbd21b0b1bdd647e485e64ce36ab5e66d1de2ef40625307fc2013d52a0b62f

SHA512
8cb57a1b363fd875bd1a261ea2de1b7915613b85d69697cb7727fb4d34ca2514b18dadde23c757c28db5a5620e440e930681eaa6fd3e7330c4dbe425abe39ecb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2260.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2260.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2551iF.exe
Filesize
362KB

MD5
d1846408ff93eb58b4f8eeff7367b13d

SHA1
3ea32720b45ac0afd33aa827eb37c37ddd5d9ad8

SHA256
0918d840553f2f63e36a7dc4df170f8a3a26442b49e8ef17018614f1b3267279

SHA512
f6834d745b63f3a715eef1590d2d09be2bae459877544d7db0434d44564fb8dee63ed657c0dc244af3e68d8601ecbbdf61820c8972170f1c6848a8e5da24f6c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2551iF.exe
Filesize
362KB

MD5
d1846408ff93eb58b4f8eeff7367b13d

SHA1
3ea32720b45ac0afd33aa827eb37c37ddd5d9ad8

SHA256
0918d840553f2f63e36a7dc4df170f8a3a26442b49e8ef17018614f1b3267279

SHA512
f6834d745b63f3a715eef1590d2d09be2bae459877544d7db0434d44564fb8dee63ed657c0dc244af3e68d8601ecbbdf61820c8972170f1c6848a8e5da24f6c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/312-161-0x0000000000410000-0x000000000041A000-memory.dmp

Filesize
40KB

Download
memory/2148-191-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-193-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-195-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-197-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-199-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-200-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2148-201-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/2148-202-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/2148-203-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/2148-205-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/2148-189-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-187-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-185-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-183-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-181-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-179-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-177-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-175-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-173-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-172-0x0000000002460000-0x0000000002472000-memory.dmp

Filesize
72KB

Download
memory/2148-170-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/2148-171-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/2148-169-0x0000000004EF0000-0x0000000004F00000-memory.dmp

Filesize
64KB

Download
memory/2148-168-0x0000000000720000-0x000000000074D000-memory.dmp

Filesize
180KB

Download
memory/2148-167-0x0000000004F00000-0x00000000054A4000-memory.dmp

Filesize
5.6MB

Download
memory/2152-1140-0x00000000002B0000-0x00000000002E2000-memory.dmp

Filesize
200KB

Download
memory/2152-1141-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/3168-225-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-234-0x0000000000800000-0x000000000084B000-memory.dmp

Filesize
300KB

Download
memory/3168-243-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-245-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-247-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-1120-0x0000000005470000-0x0000000005A88000-memory.dmp

Filesize
6.1MB

Download
memory/3168-1121-0x0000000005B10000-0x0000000005C1A000-memory.dmp

Filesize
1.0MB

Download
memory/3168-1122-0x0000000005C50000-0x0000000005C62000-memory.dmp

Filesize
72KB

Download
memory/3168-1123-0x0000000005C70000-0x0000000005CAC000-memory.dmp

Filesize
240KB

Download
memory/3168-1124-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3168-1125-0x0000000005F60000-0x0000000005FF2000-memory.dmp

Filesize
584KB

Download
memory/3168-1126-0x0000000006000000-0x0000000006066000-memory.dmp

Filesize
408KB

Download
memory/3168-1128-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3168-1129-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3168-1130-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3168-1131-0x0000000006720000-0x00000000068E2000-memory.dmp

Filesize
1.8MB

Download
memory/3168-1132-0x0000000006900000-0x0000000006E2C000-memory.dmp

Filesize
5.2MB

Download
memory/3168-233-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-239-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3168-238-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-237-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3168-241-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-235-0x0000000004B70000-0x0000000004B80000-memory.dmp

Filesize
64KB

Download
memory/3168-231-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-229-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-227-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-223-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-1133-0x0000000007080000-0x00000000070F6000-memory.dmp

Filesize
472KB

Download
memory/3168-1134-0x0000000007100000-0x0000000007150000-memory.dmp

Filesize
320KB

Download
memory/3168-210-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-211-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-213-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-221-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-215-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-219-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3168-217-0x0000000005290000-0x00000000052CE000-memory.dmp

Filesize
248KB

Download
memory/3480-1261-0x0000000005230000-0x0000000005231000-memory.dmp

Filesize
4KB

Download
memory/3480-1260-0x0000000005360000-0x0000000005370000-memory.dmp

Filesize
64KB

Download
memory/3480-1174-0x0000000000410000-0x0000000000984000-memory.dmp

Filesize
5.5MB

Download
memory/4696-2646-0x0000000005620000-0x0000000005630000-memory.dmp

Filesize
64KB

Download
memory/4696-2645-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download