amadey | 0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2023 13:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exe
Size

1.0MB
MD5

fde9775898bf60271006b89c53ffbc57
SHA1

29149a9d86e81479d5cdce3da2ba379db9e9c19d
SHA256

0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e
SHA512

8dc547f02cce4c89a066f069b17121f94d5de84eaf82ea839bf55dd45609198cc82a1487cd3dbe023f9578e0b2443091a1d948fd8c18044a90c2c1e64c2ff387
SSDEEP

12288:zMray90B8SC1lDi3XCFJzamHWOPG7yYip7E4ZcWJGbrPA6tLaZAGFNZa6BmTk/Fz:NyHp1li3yFJh69ipnmrJZyhXFBXKx2

Score

10^/10

amadey redline gena vint discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gena

193.233.20.30:4125

Attributes

auth_value
93c20961cb6b06b2d5781c212db6201e

Extracted

Family

redline

Botnet

vint

193.233.20.30:4125

Attributes

auth_value
fb8811912f8370b3d23bffda092d88d0

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

v1905ka.exetz3954.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v1905ka.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v1905ka.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz3954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz3954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz3954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz3954.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v1905ka.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v1905ka.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v1905ka.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v1905ka.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz3954.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz3954.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3140-210-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-211-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-213-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-215-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-217-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-219-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-226-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-223-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-228-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-230-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-232-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-234-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-236-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-238-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-240-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-242-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-244-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline
behavioral1/memory/3140-246-0x0000000004CF0000-0x0000000004D2E000-memory.dmp	family_redline

Downloads MZ/PE file

.NET Reactor proctector 5 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe	net_reactor
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe	net_reactor
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe	net_reactor
behavioral1/memory/2820-1174-0x0000000000E60000-0x00000000013D4000-memory.dmp	net_reactor
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe	net_reactor

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y74IR24.exelegenda.exeGood.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	y74IR24.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	legenda.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	Good.exe

Executes dropped EXE 13 IoCs

Processes:

zap9027.exezap1530.exezap6955.exetz3954.exev1905ka.exew46Yh50.exexIKdO19.exey74IR24.exelegenda.exeGood.exelegenda.exeGood.exelegenda.exe

pid	process
2336	zap9027.exe
2544	zap1530.exe
4588	zap6955.exe
2868	tz3954.exe
4364	v1905ka.exe
3140	w46Yh50.exe
4300	xIKdO19.exe
4788	y74IR24.exe
2272	legenda.exe
2820	Good.exe
3972	legenda.exe
5000	Good.exe
3484	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1924 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1924	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

v1905ka.exetz3954.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v1905ka.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v1905ka.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz3954.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 9 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exezap9027.exezap1530.exezap6955.exeGood.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap9027.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap1530.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap6955.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MyTestApplication = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000112001\\Good.exe"	Good.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap9027.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1530.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap6955.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

42 ip-api.com
Suspicious use of SetThreadContext 1 IoCs

Processes:

Good.exe

description pid process target process

PID 2820 set thread context of 5000 2820 Good.exe Good.exe
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1396 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1336 4364 WerFault.exe v1905ka.exe
368 3140 WerFault.exe w46Yh50.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3328 schtasks.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4952 PING.EXE
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz3954.exev1905ka.exew46Yh50.exexIKdO19.exe

pid process

2868 tz3954.exe
2868 tz3954.exe
4364 v1905ka.exe
4364 v1905ka.exe
3140 w46Yh50.exe
3140 w46Yh50.exe
4300 xIKdO19.exe
4300 xIKdO19.exe

flow	ioc
42	ip-api.com

description	pid	process	target process
PID 2820 set thread context of 5000	2820	Good.exe	Good.exe

pid	process
1396	sc.exe

pid	pid_target	process	target process
1336	4364	WerFault.exe	v1905ka.exe
368	3140	WerFault.exe	w46Yh50.exe

pid	process
3328	schtasks.exe

pid	process
4952	PING.EXE

pid	process
2868	tz3954.exe
2868	tz3954.exe
4364	v1905ka.exe
4364	v1905ka.exe
3140	w46Yh50.exe
3140	w46Yh50.exe
4300	xIKdO19.exe
4300	xIKdO19.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

tz3954.exev1905ka.exew46Yh50.exexIKdO19.exeGood.exeGood.exe

description	pid	process
Token: SeDebugPrivilege	2868	tz3954.exe
Token: SeDebugPrivilege	4364	v1905ka.exe
Token: SeDebugPrivilege	3140	w46Yh50.exe
Token: SeDebugPrivilege	4300	xIKdO19.exe
Token: SeDebugPrivilege	2820	Good.exe
Token: SeDebugPrivilege	5000	Good.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exezap9027.exezap1530.exezap6955.exey74IR24.exelegenda.execmd.exeGood.exeGood.exe

description	pid	process	target process
PID 2084 wrote to memory of 2336	2084	0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exe	zap9027.exe
PID 2084 wrote to memory of 2336	2084	0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exe	zap9027.exe
PID 2084 wrote to memory of 2336	2084	0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exe	zap9027.exe
PID 2336 wrote to memory of 2544	2336	zap9027.exe	zap1530.exe
PID 2336 wrote to memory of 2544	2336	zap9027.exe	zap1530.exe
PID 2336 wrote to memory of 2544	2336	zap9027.exe	zap1530.exe
PID 2544 wrote to memory of 4588	2544	zap1530.exe	zap6955.exe
PID 2544 wrote to memory of 4588	2544	zap1530.exe	zap6955.exe
PID 2544 wrote to memory of 4588	2544	zap1530.exe	zap6955.exe
PID 4588 wrote to memory of 2868	4588	zap6955.exe	tz3954.exe
PID 4588 wrote to memory of 2868	4588	zap6955.exe	tz3954.exe
PID 4588 wrote to memory of 4364	4588	zap6955.exe	v1905ka.exe
PID 4588 wrote to memory of 4364	4588	zap6955.exe	v1905ka.exe
PID 4588 wrote to memory of 4364	4588	zap6955.exe	v1905ka.exe
PID 2544 wrote to memory of 3140	2544	zap1530.exe	w46Yh50.exe
PID 2544 wrote to memory of 3140	2544	zap1530.exe	w46Yh50.exe
PID 2544 wrote to memory of 3140	2544	zap1530.exe	w46Yh50.exe
PID 2336 wrote to memory of 4300	2336	zap9027.exe	xIKdO19.exe
PID 2336 wrote to memory of 4300	2336	zap9027.exe	xIKdO19.exe
PID 2336 wrote to memory of 4300	2336	zap9027.exe	xIKdO19.exe
PID 2084 wrote to memory of 4788	2084	0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exe	y74IR24.exe
PID 2084 wrote to memory of 4788	2084	0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exe	y74IR24.exe
PID 2084 wrote to memory of 4788	2084	0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exe	y74IR24.exe
PID 4788 wrote to memory of 2272	4788	y74IR24.exe	legenda.exe
PID 4788 wrote to memory of 2272	4788	y74IR24.exe	legenda.exe
PID 4788 wrote to memory of 2272	4788	y74IR24.exe	legenda.exe
PID 2272 wrote to memory of 3328	2272	legenda.exe	schtasks.exe
PID 2272 wrote to memory of 3328	2272	legenda.exe	schtasks.exe
PID 2272 wrote to memory of 3328	2272	legenda.exe	schtasks.exe
PID 2272 wrote to memory of 3396	2272	legenda.exe	cmd.exe
PID 2272 wrote to memory of 3396	2272	legenda.exe	cmd.exe
PID 2272 wrote to memory of 3396	2272	legenda.exe	cmd.exe
PID 3396 wrote to memory of 2044	3396	cmd.exe	cmd.exe
PID 3396 wrote to memory of 2044	3396	cmd.exe	cmd.exe
PID 3396 wrote to memory of 2044	3396	cmd.exe	cmd.exe
PID 3396 wrote to memory of 3536	3396	cmd.exe	cacls.exe
PID 3396 wrote to memory of 3536	3396	cmd.exe	cacls.exe
PID 3396 wrote to memory of 3536	3396	cmd.exe	cacls.exe
PID 3396 wrote to memory of 4184	3396	cmd.exe	cacls.exe
PID 3396 wrote to memory of 4184	3396	cmd.exe	cacls.exe
PID 3396 wrote to memory of 4184	3396	cmd.exe	cacls.exe
PID 3396 wrote to memory of 3560	3396	cmd.exe	cmd.exe
PID 3396 wrote to memory of 3560	3396	cmd.exe	cmd.exe
PID 3396 wrote to memory of 3560	3396	cmd.exe	cmd.exe
PID 3396 wrote to memory of 4520	3396	cmd.exe	cacls.exe
PID 3396 wrote to memory of 4520	3396	cmd.exe	cacls.exe
PID 3396 wrote to memory of 4520	3396	cmd.exe	cacls.exe
PID 3396 wrote to memory of 1892	3396	cmd.exe	cacls.exe
PID 3396 wrote to memory of 1892	3396	cmd.exe	cacls.exe
PID 3396 wrote to memory of 1892	3396	cmd.exe	cacls.exe
PID 2272 wrote to memory of 2820	2272	legenda.exe	Good.exe
PID 2272 wrote to memory of 2820	2272	legenda.exe	Good.exe
PID 2272 wrote to memory of 2820	2272	legenda.exe	Good.exe
PID 2820 wrote to memory of 5000	2820	Good.exe	Good.exe
PID 2820 wrote to memory of 5000	2820	Good.exe	Good.exe
PID 2820 wrote to memory of 5000	2820	Good.exe	Good.exe
PID 2820 wrote to memory of 5000	2820	Good.exe	Good.exe
PID 2820 wrote to memory of 5000	2820	Good.exe	Good.exe
PID 2820 wrote to memory of 5000	2820	Good.exe	Good.exe
PID 2820 wrote to memory of 5000	2820	Good.exe	Good.exe
PID 2820 wrote to memory of 5000	2820	Good.exe	Good.exe
PID 5000 wrote to memory of 4608	5000	Good.exe	cmd.exe
PID 5000 wrote to memory of 4608	5000	Good.exe	cmd.exe
PID 5000 wrote to memory of 4608	5000	Good.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exe
"C:\Users\Admin\AppData\Local\Temp\0f761e699c8ac7fbe15d72a8edf0d1eef15c6f241facbc73fa1b80807160cb9e.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2084

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9027.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9027.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2336

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1530.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1530.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2544

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6955.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6955.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4588

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3954.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3954.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1905ka.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1905ka.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 1084
6⤵
- Program crash
PID:1336

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46Yh50.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46Yh50.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 1088
5⤵
- Program crash
PID:368

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xIKdO19.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xIKdO19.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4300

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y74IR24.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y74IR24.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:3328

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3396

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:2044

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:3536

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:4184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3560

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:4520

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:1892

C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe
"C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820

C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe
"C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe"
6⤵
PID:4608

C:\Windows\SysWOW64\chcp.com
chcp 65001
7⤵
PID:1772

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
7⤵
- Runs ping.exe
PID:4952

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4364 -ip 4364
1⤵
PID:1892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3140 -ip 3140
1⤵
PID:3928

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:3972

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:3484

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:1396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Good.exe.log
Filesize
321B

MD5
08027eeee0542c93662aef98d70095e4

SHA1
42402c02bf4763fcd6fb0650fc13386f2eae8f9b

SHA256
1b9ec007ac8e7de37c61313c5e1b9444df6dc0cd9110553bfa281b13204a646d

SHA512
c4e7a17a1dc1f27c91791439d92435a5d750a065508e9539c9af458f21472a7ce45ba0666ef6855a00386e1a75c518d0908b82d929084a1b67ca4c65997a5979

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe
Filesize
5.4MB

MD5
9086ff963ae98510ea0eb9abad045939

SHA1
e9999c73e07daf9ba223fbf796d56ae762b748fa

SHA256
138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f

SHA512
f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe
Filesize
5.4MB

MD5
9086ff963ae98510ea0eb9abad045939

SHA1
e9999c73e07daf9ba223fbf796d56ae762b748fa

SHA256
138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f

SHA512
f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe
Filesize
5.4MB

MD5
9086ff963ae98510ea0eb9abad045939

SHA1
e9999c73e07daf9ba223fbf796d56ae762b748fa

SHA256
138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f

SHA512
f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe
Filesize
5.4MB

MD5
9086ff963ae98510ea0eb9abad045939

SHA1
e9999c73e07daf9ba223fbf796d56ae762b748fa

SHA256
138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f

SHA512
f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y74IR24.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y74IR24.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9027.exe
Filesize
876KB

MD5
cd982e50d7a6cfc28c9a04046057d1ac

SHA1
dd837e33ed684aaacf1eb27bdbbc1a4a791ec167

SHA256
a28c7f9f7bdd96fb7de1b67996b08482db60900a226e4dc26f3ca28b3412310c

SHA512
2065193bcf80ae8f2c906a30541b2f58a6d0c4088381d0e97037de571741be619b57e69e7ffb433da29a956a2e7363be1a4cfefa8b526de6af43cd7bf1fa07b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9027.exe
Filesize
876KB

MD5
cd982e50d7a6cfc28c9a04046057d1ac

SHA1
dd837e33ed684aaacf1eb27bdbbc1a4a791ec167

SHA256
a28c7f9f7bdd96fb7de1b67996b08482db60900a226e4dc26f3ca28b3412310c

SHA512
2065193bcf80ae8f2c906a30541b2f58a6d0c4088381d0e97037de571741be619b57e69e7ffb433da29a956a2e7363be1a4cfefa8b526de6af43cd7bf1fa07b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xIKdO19.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xIKdO19.exe
Filesize
175KB

MD5
3389637c0d072121bf1b127629736d37

SHA1
300e915efdf2479bfd0d3699c0a6bc51260f9655

SHA256
2b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153

SHA512
a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1530.exe
Filesize
734KB

MD5
ec5e28b81ab6361d7f41a0a6a9ca774a

SHA1
5f3c28bb1c307cf9c279c97470f71f7d8c27a7f2

SHA256
71831c7598ac45cf1ec10e56768a9c67072f9f1f3546707024d2ebf2bf48ef6e

SHA512
5543cdff2a1382fe0a6b1bb503ee73d09a55d56af5a319229c1384c38c5f58847ec8d78ed32724ad1492b82e1c356b02cca57276e88d54322914033ab965673c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1530.exe
Filesize
734KB

MD5
ec5e28b81ab6361d7f41a0a6a9ca774a

SHA1
5f3c28bb1c307cf9c279c97470f71f7d8c27a7f2

SHA256
71831c7598ac45cf1ec10e56768a9c67072f9f1f3546707024d2ebf2bf48ef6e

SHA512
5543cdff2a1382fe0a6b1bb503ee73d09a55d56af5a319229c1384c38c5f58847ec8d78ed32724ad1492b82e1c356b02cca57276e88d54322914033ab965673c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46Yh50.exe
Filesize
420KB

MD5
9caa80176e0beb45f2e2296d2181ea00

SHA1
23a6adade26c26bc6143bbc2b8ce9baeaa5b8032

SHA256
a7dd5a3dabecbb8542932a7862694ed899816493f67c92aaec9e4545028f24dc

SHA512
0259b54ec8dde2f0690c49aad3637019bb5749ac48b9e084b20a954d38deb830723e0ba4d9fb68960d28e28fd013cdb50ada2c0410075fa02f3b5a93ec4764e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w46Yh50.exe
Filesize
420KB

MD5
9caa80176e0beb45f2e2296d2181ea00

SHA1
23a6adade26c26bc6143bbc2b8ce9baeaa5b8032

SHA256
a7dd5a3dabecbb8542932a7862694ed899816493f67c92aaec9e4545028f24dc

SHA512
0259b54ec8dde2f0690c49aad3637019bb5749ac48b9e084b20a954d38deb830723e0ba4d9fb68960d28e28fd013cdb50ada2c0410075fa02f3b5a93ec4764e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6955.exe
Filesize
362KB

MD5
f17b5e8b0d9be54bdb4aa75429fc0b3f

SHA1
5486a3ce70552ddcdae9c2acbdc0f40cc0c3857d

SHA256
e4eac39ace1c90b504de3b790e7959a83b0f8899de4818726a04aad338a83892

SHA512
1fe17dc3d94d5bc29417d8ea199aaf6eb25e005beaeb34a365d089d94ebe8259013bb930e5fe64c52499f4cbf25e48471040a2f8ae27ec466a23624d83dc3fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6955.exe
Filesize
362KB

MD5
f17b5e8b0d9be54bdb4aa75429fc0b3f

SHA1
5486a3ce70552ddcdae9c2acbdc0f40cc0c3857d

SHA256
e4eac39ace1c90b504de3b790e7959a83b0f8899de4818726a04aad338a83892

SHA512
1fe17dc3d94d5bc29417d8ea199aaf6eb25e005beaeb34a365d089d94ebe8259013bb930e5fe64c52499f4cbf25e48471040a2f8ae27ec466a23624d83dc3fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3954.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3954.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1905ka.exe
Filesize
362KB

MD5
f2bfea5bde946a8937020b3178e295f3

SHA1
801fb7f488e52c7ef91b9fc4644772f630990e9b

SHA256
89f80bae8948fd6fed7ca007bc5532238209698d889c8139ee5d834177a17490

SHA512
0087599341589b4fbd04cd4cef6c1e92b612572502daa1480763ea5123b01fd838e363ba368b60d1a1c4ac79e9f51122797687b293576c7b7913a0aea182fb54

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1905ka.exe
Filesize
362KB

MD5
f2bfea5bde946a8937020b3178e295f3

SHA1
801fb7f488e52c7ef91b9fc4644772f630990e9b

SHA256
89f80bae8948fd6fed7ca007bc5532238209698d889c8139ee5d834177a17490

SHA512
0087599341589b4fbd04cd4cef6c1e92b612572502daa1480763ea5123b01fd838e363ba368b60d1a1c4ac79e9f51122797687b293576c7b7913a0aea182fb54

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/2820-1174-0x0000000000E60000-0x00000000013D4000-memory.dmp

Filesize
5.5MB

Download
memory/2820-1193-0x0000000005DA0000-0x0000000005DB0000-memory.dmp

Filesize
64KB

Download
memory/2820-1196-0x0000000005CA0000-0x0000000005CA1000-memory.dmp

Filesize
4KB

Download
memory/2868-161-0x0000000000C40000-0x0000000000C4A000-memory.dmp

Filesize
40KB

Download
memory/3140-1133-0x0000000007A80000-0x0000000007C42000-memory.dmp

Filesize
1.8MB

Download
memory/3140-1128-0x0000000005E20000-0x0000000005EB2000-memory.dmp

Filesize
584KB

Download
memory/3140-1134-0x0000000007C50000-0x000000000817C000-memory.dmp

Filesize
5.2MB

Download
memory/3140-1132-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/3140-210-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-211-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-213-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-215-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-217-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-220-0x0000000000800000-0x000000000084B000-memory.dmp

Filesize
300KB

Download
memory/3140-219-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-222-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/3140-226-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-224-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/3140-223-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-228-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-230-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-232-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-234-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-236-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-238-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-240-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-242-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-244-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-246-0x0000000004CF0000-0x0000000004D2E000-memory.dmp

Filesize
248KB

Download
memory/3140-1119-0x0000000005430000-0x0000000005A48000-memory.dmp

Filesize
6.1MB

Download
memory/3140-1120-0x0000000005A50000-0x0000000005B5A000-memory.dmp

Filesize
1.0MB

Download
memory/3140-1121-0x0000000004E20000-0x0000000004E32000-memory.dmp

Filesize
72KB

Download
memory/3140-1122-0x0000000005B60000-0x0000000005B9C000-memory.dmp

Filesize
240KB

Download
memory/3140-1123-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/3140-1125-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/3140-1126-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/3140-1127-0x0000000004E70000-0x0000000004E80000-memory.dmp

Filesize
64KB

Download
memory/3140-1131-0x0000000006660000-0x00000000066B0000-memory.dmp

Filesize
320KB

Download
memory/3140-1129-0x0000000005EC0000-0x0000000005F26000-memory.dmp

Filesize
408KB

Download
memory/3140-1130-0x00000000065E0000-0x0000000006656000-memory.dmp

Filesize
472KB

Download
memory/4300-1140-0x0000000000160000-0x0000000000192000-memory.dmp

Filesize
200KB

Download
memory/4300-1141-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/4364-191-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-167-0x00000000007F0000-0x000000000081D000-memory.dmp

Filesize
180KB

Download
memory/4364-205-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4364-173-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-201-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/4364-202-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/4364-175-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-177-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-183-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-185-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-187-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-189-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-200-0x0000000000400000-0x000000000071C000-memory.dmp

Filesize
3.1MB

Download
memory/4364-203-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/4364-195-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-199-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-193-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-181-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-179-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-172-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-168-0x0000000004F70000-0x0000000005514000-memory.dmp

Filesize
5.6MB

Download
memory/4364-197-0x0000000002660000-0x0000000002672000-memory.dmp

Filesize
72KB

Download
memory/4364-171-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/4364-170-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/4364-169-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/5000-2646-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/5000-2647-0x0000000005CF0000-0x0000000005D00000-memory.dmp

Filesize
64KB

Download