amadey | f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9

Analysis

max time kernel
126s
max time network
123s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
25-03-2023 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exe
Size

1.0MB
MD5

1a17933f0334e4598a68746ea2e47d0f
SHA1

02999be1d7ca27ec4582f5e9f80adbe8a55173b5
SHA256

f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9
SHA512

a4e90ebb52faa7496d315a59487cfe8a894df1485f0934638b3e0fe58b3d9c7d3fc0fbf33c4993e9a9fb3d17bc61afb77178252ac81c85d5b29592bbab5777dd
SSDEEP

24576:cyA9sHnkvnvESoHBTe+kanSXUat9jSdU38IELboevIPyDhBz3ut:LA2HkXESoHJ8anSXr9KIAo+Iq1B7

Score

10^/10

amadey redline boris ngan003 store discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

boris

193.233.20.32:4125

Attributes

auth_value
766b5bdf6dbefcf7ca223351952fc38f

Extracted

Family

redline

Botnet

store

193.233.20.32:4125

Attributes

auth_value
e34e5836de4e256271ab56c648765bcd

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Extracted

Family

redline

Botnet

ngan003

199.115.193.116:11300

Attributes

auth_value
b500a5cf0cb429e32a81c6ddcd8d4545

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz2818.exev5324IQ.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz2818.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v5324IQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v5324IQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v5324IQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz2818.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz2818.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz2818.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v5324IQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v5324IQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz2818.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1304-197-0x00000000048D0000-0x0000000004916000-memory.dmp	family_redline
behavioral1/memory/1304-199-0x0000000007650000-0x0000000007694000-memory.dmp	family_redline
behavioral1/memory/1304-203-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-204-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-206-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-208-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-210-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-212-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-214-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-216-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-218-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-220-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-222-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-224-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-226-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-228-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-230-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-232-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-234-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline
behavioral1/memory/1304-236-0x0000000007650000-0x000000000768F000-memory.dmp	family_redline

Downloads MZ/PE file

Executes dropped EXE 14 IoCs

Processes:

zap5687.exezap9178.exezap8137.exetz2818.exev5324IQ.exew53Kp88.exexHPxT04.exey66ou53.exelegenda.exeSprawl.exeSprawl.exeSprawl.exelegenda.exelegenda.exe

pid	process
4000	zap5687.exe
4460	zap9178.exe
4904	zap8137.exe
2176	tz2818.exe
2204	v5324IQ.exe
1304	w53Kp88.exe
4440	xHPxT04.exe
2976	y66ou53.exe
3524	legenda.exe
4972	Sprawl.exe
4216	Sprawl.exe
516	Sprawl.exe
3300	legenda.exe
660	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

792 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
792	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz2818.exev5324IQ.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz2818.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v5324IQ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v5324IQ.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap9178.exezap8137.exef9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exezap5687.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap9178.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap9178.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap8137.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap8137.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap5687.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap5687.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

Sprawl.exe

description pid process target process

PID 4972 set thread context of 516 4972 Sprawl.exe Sprawl.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3784 schtasks.exe

description	pid	process	target process
PID 4972 set thread context of 516	4972	Sprawl.exe	Sprawl.exe

pid	process
3784	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

tz2818.exev5324IQ.exew53Kp88.exexHPxT04.exeSprawl.exe

pid	process
2176	tz2818.exe
2176	tz2818.exe
2204	v5324IQ.exe
2204	v5324IQ.exe
1304	w53Kp88.exe
1304	w53Kp88.exe
4440	xHPxT04.exe
4440	xHPxT04.exe
516	Sprawl.exe
516	Sprawl.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

tz2818.exev5324IQ.exew53Kp88.exexHPxT04.exeSprawl.exe

description	pid	process
Token: SeDebugPrivilege	2176	tz2818.exe
Token: SeDebugPrivilege	2204	v5324IQ.exe
Token: SeDebugPrivilege	1304	w53Kp88.exe
Token: SeDebugPrivilege	4440	xHPxT04.exe
Token: SeDebugPrivilege	516	Sprawl.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exezap5687.exezap9178.exezap8137.exey66ou53.exelegenda.execmd.exeSprawl.exe

description	pid	process	target process
PID 3648 wrote to memory of 4000	3648	f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exe	zap5687.exe
PID 3648 wrote to memory of 4000	3648	f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exe	zap5687.exe
PID 3648 wrote to memory of 4000	3648	f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exe	zap5687.exe
PID 4000 wrote to memory of 4460	4000	zap5687.exe	zap9178.exe
PID 4000 wrote to memory of 4460	4000	zap5687.exe	zap9178.exe
PID 4000 wrote to memory of 4460	4000	zap5687.exe	zap9178.exe
PID 4460 wrote to memory of 4904	4460	zap9178.exe	zap8137.exe
PID 4460 wrote to memory of 4904	4460	zap9178.exe	zap8137.exe
PID 4460 wrote to memory of 4904	4460	zap9178.exe	zap8137.exe
PID 4904 wrote to memory of 2176	4904	zap8137.exe	tz2818.exe
PID 4904 wrote to memory of 2176	4904	zap8137.exe	tz2818.exe
PID 4904 wrote to memory of 2204	4904	zap8137.exe	v5324IQ.exe
PID 4904 wrote to memory of 2204	4904	zap8137.exe	v5324IQ.exe
PID 4904 wrote to memory of 2204	4904	zap8137.exe	v5324IQ.exe
PID 4460 wrote to memory of 1304	4460	zap9178.exe	w53Kp88.exe
PID 4460 wrote to memory of 1304	4460	zap9178.exe	w53Kp88.exe
PID 4460 wrote to memory of 1304	4460	zap9178.exe	w53Kp88.exe
PID 4000 wrote to memory of 4440	4000	zap5687.exe	xHPxT04.exe
PID 4000 wrote to memory of 4440	4000	zap5687.exe	xHPxT04.exe
PID 4000 wrote to memory of 4440	4000	zap5687.exe	xHPxT04.exe
PID 3648 wrote to memory of 2976	3648	f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exe	y66ou53.exe
PID 3648 wrote to memory of 2976	3648	f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exe	y66ou53.exe
PID 3648 wrote to memory of 2976	3648	f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exe	y66ou53.exe
PID 2976 wrote to memory of 3524	2976	y66ou53.exe	legenda.exe
PID 2976 wrote to memory of 3524	2976	y66ou53.exe	legenda.exe
PID 2976 wrote to memory of 3524	2976	y66ou53.exe	legenda.exe
PID 3524 wrote to memory of 3784	3524	legenda.exe	schtasks.exe
PID 3524 wrote to memory of 3784	3524	legenda.exe	schtasks.exe
PID 3524 wrote to memory of 3784	3524	legenda.exe	schtasks.exe
PID 3524 wrote to memory of 3724	3524	legenda.exe	cmd.exe
PID 3524 wrote to memory of 3724	3524	legenda.exe	cmd.exe
PID 3524 wrote to memory of 3724	3524	legenda.exe	cmd.exe
PID 3724 wrote to memory of 5068	3724	cmd.exe	cmd.exe
PID 3724 wrote to memory of 5068	3724	cmd.exe	cmd.exe
PID 3724 wrote to memory of 5068	3724	cmd.exe	cmd.exe
PID 3724 wrote to memory of 4536	3724	cmd.exe	cacls.exe
PID 3724 wrote to memory of 4536	3724	cmd.exe	cacls.exe
PID 3724 wrote to memory of 4536	3724	cmd.exe	cacls.exe
PID 3724 wrote to memory of 4564	3724	cmd.exe	cacls.exe
PID 3724 wrote to memory of 4564	3724	cmd.exe	cacls.exe
PID 3724 wrote to memory of 4564	3724	cmd.exe	cacls.exe
PID 3724 wrote to memory of 3420	3724	cmd.exe	cmd.exe
PID 3724 wrote to memory of 3420	3724	cmd.exe	cmd.exe
PID 3724 wrote to memory of 3420	3724	cmd.exe	cmd.exe
PID 3724 wrote to memory of 4480	3724	cmd.exe	cacls.exe
PID 3724 wrote to memory of 4480	3724	cmd.exe	cacls.exe
PID 3724 wrote to memory of 4480	3724	cmd.exe	cacls.exe
PID 3724 wrote to memory of 3352	3724	cmd.exe	cacls.exe
PID 3724 wrote to memory of 3352	3724	cmd.exe	cacls.exe
PID 3724 wrote to memory of 3352	3724	cmd.exe	cacls.exe
PID 3524 wrote to memory of 4972	3524	legenda.exe	Sprawl.exe
PID 3524 wrote to memory of 4972	3524	legenda.exe	Sprawl.exe
PID 3524 wrote to memory of 4972	3524	legenda.exe	Sprawl.exe
PID 4972 wrote to memory of 4216	4972	Sprawl.exe	Sprawl.exe
PID 4972 wrote to memory of 4216	4972	Sprawl.exe	Sprawl.exe
PID 4972 wrote to memory of 4216	4972	Sprawl.exe	Sprawl.exe
PID 4972 wrote to memory of 4216	4972	Sprawl.exe	Sprawl.exe
PID 4972 wrote to memory of 516	4972	Sprawl.exe	Sprawl.exe
PID 4972 wrote to memory of 516	4972	Sprawl.exe	Sprawl.exe
PID 4972 wrote to memory of 516	4972	Sprawl.exe	Sprawl.exe
PID 4972 wrote to memory of 516	4972	Sprawl.exe	Sprawl.exe
PID 4972 wrote to memory of 516	4972	Sprawl.exe	Sprawl.exe
PID 4972 wrote to memory of 516	4972	Sprawl.exe	Sprawl.exe
PID 4972 wrote to memory of 516	4972	Sprawl.exe	Sprawl.exe

C:\Users\Admin\AppData\Local\Temp\f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exe
"C:\Users\Admin\AppData\Local\Temp\f9810aae3b3e702359937bee19a5a250aea323dbfb00e3c6bf8e7690b8f53eb9.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3648

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5687.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5687.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4000

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9178.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9178.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4460

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8137.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8137.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4904

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2818.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2818.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2176

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5324IQ.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5324IQ.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w53Kp88.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w53Kp88.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1304

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xHPxT04.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xHPxT04.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4440

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y66ou53.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y66ou53.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:3784

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3724

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:5068

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:4536

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:4564

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3420

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:4480

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:3352

C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe
"C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4972

C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe
5⤵
- Executes dropped EXE
PID:4216

C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:516

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:792

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:3300

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:660

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Sprawl.exe.log
Filesize
1KB

MD5
8268d0ebb3b023f56d9a27f3933f124f

SHA1
def43e831ca0fcbc1df8a1e11a41fe3ea1734f3b

SHA256
2fdfee92c5ce81220a0b66cf0ec1411c923d48ae89232406c237e1bc5204392d

SHA512
c61c2f8df84e4bbcb6f871befd4dde44188cf106c4af91a56b33a45692b83d1c52a953477f14f4239726b66ecab66842e910c2996631137355a4aba4ea793c97

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe
Filesize
895KB

MD5
7f9cc3889e95b39a93593207cc823dd2

SHA1
553b922ae2d755e012792ab495c879f63ab3b923

SHA256
d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5

SHA512
5a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe
Filesize
895KB

MD5
7f9cc3889e95b39a93593207cc823dd2

SHA1
553b922ae2d755e012792ab495c879f63ab3b923

SHA256
d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5

SHA512
5a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe
Filesize
895KB

MD5
7f9cc3889e95b39a93593207cc823dd2

SHA1
553b922ae2d755e012792ab495c879f63ab3b923

SHA256
d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5

SHA512
5a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe
Filesize
895KB

MD5
7f9cc3889e95b39a93593207cc823dd2

SHA1
553b922ae2d755e012792ab495c879f63ab3b923

SHA256
d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5

SHA512
5a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe
Filesize
895KB

MD5
7f9cc3889e95b39a93593207cc823dd2

SHA1
553b922ae2d755e012792ab495c879f63ab3b923

SHA256
d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5

SHA512
5a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y66ou53.exe
Filesize
235KB

MD5
f0451bab1f7afa97a0faf60c83ef82f4

SHA1
0ec1dca3293f5b66736cc44e53e3af61537fc655

SHA256
8239d4d00a8ab9a198f7a1012d9ef01f1101361cbc62eeb693c0014b7d1a5058

SHA512
17317dd201d38c3ac802de5f13034f93280f51da5be1134489d6c65c6d18665a23bf096b15b2b380f0b5e3503763b88b32ca7d4e616ad34ba161492f0b4d27fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y66ou53.exe
Filesize
235KB

MD5
f0451bab1f7afa97a0faf60c83ef82f4

SHA1
0ec1dca3293f5b66736cc44e53e3af61537fc655

SHA256
8239d4d00a8ab9a198f7a1012d9ef01f1101361cbc62eeb693c0014b7d1a5058

SHA512
17317dd201d38c3ac802de5f13034f93280f51da5be1134489d6c65c6d18665a23bf096b15b2b380f0b5e3503763b88b32ca7d4e616ad34ba161492f0b4d27fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5687.exe
Filesize
854KB

MD5
69fe04347afb3bcd84c0a8e0511baea5

SHA1
18746712b3ba85ba467a04524800decb128a92fa

SHA256
3e722dc9300837b43dcb507bf524e94cc88047214504685ad1428933e05480e7

SHA512
035c78be4ae6e49c6ece5b5a5de01d421091c3798d5c01355c9ce319a55065a5a4aaef4fdd6707821113acc02bd005d4543b92a09ed792cfe456ecca46172acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5687.exe
Filesize
854KB

MD5
69fe04347afb3bcd84c0a8e0511baea5

SHA1
18746712b3ba85ba467a04524800decb128a92fa

SHA256
3e722dc9300837b43dcb507bf524e94cc88047214504685ad1428933e05480e7

SHA512
035c78be4ae6e49c6ece5b5a5de01d421091c3798d5c01355c9ce319a55065a5a4aaef4fdd6707821113acc02bd005d4543b92a09ed792cfe456ecca46172acb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xHPxT04.exe
Filesize
175KB

MD5
9157936a975cd090217eb62cb4bc643e

SHA1
6a4c972607e892ce76ffc6e9f94efe0038909ce5

SHA256
ee8cc8d35b409866b0b878fd030af9136904ad6664f109d4f39f5f9241bdbc58

SHA512
0ab07d25dfe9ff38329c4bd88a11db3c3480b3f9faddb6c368ce23266749988d9a4288d00d7b2e76960ff43f24d801ad829fa5ffdbe3fc637471d6e01120bc30

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xHPxT04.exe
Filesize
175KB

MD5
9157936a975cd090217eb62cb4bc643e

SHA1
6a4c972607e892ce76ffc6e9f94efe0038909ce5

SHA256
ee8cc8d35b409866b0b878fd030af9136904ad6664f109d4f39f5f9241bdbc58

SHA512
0ab07d25dfe9ff38329c4bd88a11db3c3480b3f9faddb6c368ce23266749988d9a4288d00d7b2e76960ff43f24d801ad829fa5ffdbe3fc637471d6e01120bc30

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9178.exe
Filesize
712KB

MD5
81f1d4365645b87234baeeb7087e4b1a

SHA1
381c8016b5d3d235b338bf76801c86b6a77c6d59

SHA256
86636e208f123f067db9db71981856207bb75780f7c1c4408ba58942a4a36333

SHA512
6eedf19c437d16e382543e19b4dcbda8140add9343f505c6d80233cf1754a3037d18f74ace6522d66f88cce18edc324cac744bd5443e417a41c7006bbfafee2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap9178.exe
Filesize
712KB

MD5
81f1d4365645b87234baeeb7087e4b1a

SHA1
381c8016b5d3d235b338bf76801c86b6a77c6d59

SHA256
86636e208f123f067db9db71981856207bb75780f7c1c4408ba58942a4a36333

SHA512
6eedf19c437d16e382543e19b4dcbda8140add9343f505c6d80233cf1754a3037d18f74ace6522d66f88cce18edc324cac744bd5443e417a41c7006bbfafee2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w53Kp88.exe
Filesize
383KB

MD5
3bd11904259e263e4abf104c13ecacbe

SHA1
961723a18258ef75b11f93edd7d7f52e6f587f96

SHA256
182204284e13b6e26867562382e9937a7cff16134433b4e3aec3f745665defd3

SHA512
edc807ca20d362897b6eb11a5e7b520e3a2ceaae7c067c6f989274d2a9df0e8561fbec84abbd323565f7725991961d8e27c1ec762da708733f530d4102119567

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w53Kp88.exe
Filesize
383KB

MD5
3bd11904259e263e4abf104c13ecacbe

SHA1
961723a18258ef75b11f93edd7d7f52e6f587f96

SHA256
182204284e13b6e26867562382e9937a7cff16134433b4e3aec3f745665defd3

SHA512
edc807ca20d362897b6eb11a5e7b520e3a2ceaae7c067c6f989274d2a9df0e8561fbec84abbd323565f7725991961d8e27c1ec762da708733f530d4102119567

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8137.exe
Filesize
353KB

MD5
ad0535c2c02fe113c0fad65919b4ecb2

SHA1
8863556d9a733360d6247b2ba49a2125bb2c66dc

SHA256
6a794bc0ebf329c4ae8a1ba5ac3362c765918f58404b705cbf84596aed4471c1

SHA512
18744d9cf559fd55bbe49fe1b4bece7e7a869d9b5140eefa52e43338d936a5158a7c6437bd52a3f132ef401f749f0134625663d7dca5385549a16542ef53655b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8137.exe
Filesize
353KB

MD5
ad0535c2c02fe113c0fad65919b4ecb2

SHA1
8863556d9a733360d6247b2ba49a2125bb2c66dc

SHA256
6a794bc0ebf329c4ae8a1ba5ac3362c765918f58404b705cbf84596aed4471c1

SHA512
18744d9cf559fd55bbe49fe1b4bece7e7a869d9b5140eefa52e43338d936a5158a7c6437bd52a3f132ef401f749f0134625663d7dca5385549a16542ef53655b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2818.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz2818.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5324IQ.exe
Filesize
325KB

MD5
5adb8e12fca71bf5fab3b0131af27865

SHA1
23ae1106e21914f407862a14f1c2dd777c9b4632

SHA256
e680b800f21d53a5c8ad79c8b26f9ee9b0c83ab37a76ff34c1ab3ac6f9d081ed

SHA512
65eb1f58ad77bf7e935746bb918282586aa08d2936844b53b0c8be59ad1ef232d67392c08676f642af7342c8de7a152d004e5614e2c7c5689c287fafeca7fd3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5324IQ.exe
Filesize
325KB

MD5
5adb8e12fca71bf5fab3b0131af27865

SHA1
23ae1106e21914f407862a14f1c2dd777c9b4632

SHA256
e680b800f21d53a5c8ad79c8b26f9ee9b0c83ab37a76ff34c1ab3ac6f9d081ed

SHA512
65eb1f58ad77bf7e935746bb918282586aa08d2936844b53b0c8be59ad1ef232d67392c08676f642af7342c8de7a152d004e5614e2c7c5689c287fafeca7fd3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
f0451bab1f7afa97a0faf60c83ef82f4

SHA1
0ec1dca3293f5b66736cc44e53e3af61537fc655

SHA256
8239d4d00a8ab9a198f7a1012d9ef01f1101361cbc62eeb693c0014b7d1a5058

SHA512
17317dd201d38c3ac802de5f13034f93280f51da5be1134489d6c65c6d18665a23bf096b15b2b380f0b5e3503763b88b32ca7d4e616ad34ba161492f0b4d27fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
f0451bab1f7afa97a0faf60c83ef82f4

SHA1
0ec1dca3293f5b66736cc44e53e3af61537fc655

SHA256
8239d4d00a8ab9a198f7a1012d9ef01f1101361cbc62eeb693c0014b7d1a5058

SHA512
17317dd201d38c3ac802de5f13034f93280f51da5be1134489d6c65c6d18665a23bf096b15b2b380f0b5e3503763b88b32ca7d4e616ad34ba161492f0b4d27fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
f0451bab1f7afa97a0faf60c83ef82f4

SHA1
0ec1dca3293f5b66736cc44e53e3af61537fc655

SHA256
8239d4d00a8ab9a198f7a1012d9ef01f1101361cbc62eeb693c0014b7d1a5058

SHA512
17317dd201d38c3ac802de5f13034f93280f51da5be1134489d6c65c6d18665a23bf096b15b2b380f0b5e3503763b88b32ca7d4e616ad34ba161492f0b4d27fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
f0451bab1f7afa97a0faf60c83ef82f4

SHA1
0ec1dca3293f5b66736cc44e53e3af61537fc655

SHA256
8239d4d00a8ab9a198f7a1012d9ef01f1101361cbc62eeb693c0014b7d1a5058

SHA512
17317dd201d38c3ac802de5f13034f93280f51da5be1134489d6c65c6d18665a23bf096b15b2b380f0b5e3503763b88b32ca7d4e616ad34ba161492f0b4d27fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
f0451bab1f7afa97a0faf60c83ef82f4

SHA1
0ec1dca3293f5b66736cc44e53e3af61537fc655

SHA256
8239d4d00a8ab9a198f7a1012d9ef01f1101361cbc62eeb693c0014b7d1a5058

SHA512
17317dd201d38c3ac802de5f13034f93280f51da5be1134489d6c65c6d18665a23bf096b15b2b380f0b5e3503763b88b32ca7d4e616ad34ba161492f0b4d27fd

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
memory/516-1167-0x0000000003050000-0x0000000003060000-memory.dmp

Filesize
64KB

Download
memory/516-1169-0x0000000003050000-0x0000000003060000-memory.dmp

Filesize
64KB

Download
memory/516-1166-0x0000000005660000-0x00000000056AB000-memory.dmp

Filesize
300KB

Download
memory/516-1165-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1304-220-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-201-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/1304-1125-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/1304-222-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-197-0x00000000048D0000-0x0000000004916000-memory.dmp

Filesize
280KB

Download
memory/1304-226-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-199-0x0000000007650000-0x0000000007694000-memory.dmp

Filesize
272KB

Download
memory/1304-224-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-200-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/1304-202-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/1304-203-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-204-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-206-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-208-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-210-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-212-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-214-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-216-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-218-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-1123-0x0000000008B50000-0x0000000008D12000-memory.dmp

Filesize
1.8MB

Download
memory/1304-1122-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/1304-1124-0x0000000008D20000-0x000000000924C000-memory.dmp

Filesize
5.2MB

Download
memory/1304-198-0x0000000002CC0000-0x0000000002D0B000-memory.dmp

Filesize
300KB

Download
memory/1304-228-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-230-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-232-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-234-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-236-0x0000000007650000-0x000000000768F000-memory.dmp

Filesize
252KB

Download
memory/1304-1109-0x0000000007DF0000-0x00000000083F6000-memory.dmp

Filesize
6.0MB

Download
memory/1304-1110-0x0000000007860000-0x000000000796A000-memory.dmp

Filesize
1.0MB

Download
memory/1304-1111-0x00000000079A0000-0x00000000079B2000-memory.dmp

Filesize
72KB

Download
memory/1304-1112-0x00000000079C0000-0x00000000079FE000-memory.dmp

Filesize
248KB

Download
memory/1304-1113-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/1304-1114-0x0000000007B10000-0x0000000007B5B000-memory.dmp

Filesize
300KB

Download
memory/1304-1116-0x0000000007CA0000-0x0000000007D32000-memory.dmp

Filesize
584KB

Download
memory/1304-1117-0x0000000007D40000-0x0000000007DA6000-memory.dmp

Filesize
408KB

Download
memory/1304-1118-0x0000000008A30000-0x0000000008AA6000-memory.dmp

Filesize
472KB

Download
memory/1304-1119-0x0000000008AC0000-0x0000000008B10000-memory.dmp

Filesize
320KB

Download
memory/1304-1120-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/1304-1121-0x0000000007140000-0x0000000007150000-memory.dmp

Filesize
64KB

Download
memory/2176-147-0x0000000000340000-0x000000000034A000-memory.dmp

Filesize
40KB

Download
memory/2204-177-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-171-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-190-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/2204-189-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/2204-188-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/2204-153-0x0000000002DD0000-0x0000000002DEA000-memory.dmp

Filesize
104KB

Download
memory/2204-154-0x00000000072D0000-0x00000000077CE000-memory.dmp

Filesize
5.0MB

Download
memory/2204-156-0x00000000001D0000-0x00000000001FD000-memory.dmp

Filesize
180KB

Download
memory/2204-187-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-185-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-183-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-181-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-179-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-175-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-173-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-192-0x0000000000400000-0x0000000002B7E000-memory.dmp

Filesize
39.5MB

Download
memory/2204-158-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/2204-155-0x0000000004BC0000-0x0000000004BD8000-memory.dmp

Filesize
96KB

Download
memory/2204-157-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/2204-169-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-167-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-165-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-163-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-161-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-160-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Filesize
72KB

Download
memory/2204-159-0x00000000072C0000-0x00000000072D0000-memory.dmp

Filesize
64KB

Download
memory/4440-1133-0x00000000052F0000-0x0000000005300000-memory.dmp

Filesize
64KB

Download
memory/4440-1132-0x0000000005170000-0x00000000051BB000-memory.dmp

Filesize
300KB

Download
memory/4440-1131-0x0000000000730000-0x0000000000762000-memory.dmp

Filesize
200KB

Download
memory/4972-1159-0x0000000004DB0000-0x0000000004DC0000-memory.dmp

Filesize
64KB

Download
memory/4972-1158-0x0000000004F40000-0x0000000005290000-memory.dmp

Filesize
3.3MB

Download
memory/4972-1157-0x0000000000530000-0x0000000000616000-memory.dmp

Filesize
920KB

Download