amadey | 7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33

Analysis

max time kernel
115s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2023, 13:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33.exe
Size

1020KB
MD5

f8e8c78139501408b775b96caf350566
SHA1

2f0cf8314cb8ce06e427f9a94eb0005f2e214071
SHA256

7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33
SHA512

b95a4b2c144a931945c98e96b7df76c13a978baf9ca3ba19aaa27f50bb5dbad7cdb43cea7c10a4f805d3a677448bf551c744c6544e39999a8df1dc6944d843ae
SSDEEP

24576:TyqUN4xwU8/5IQIAIHnspZjO+Z9saW8QdKXbdgOaJ6AIEH6:mqUNMBDQILHnEjO+S8ODOF

Score

10^/10

amadey redline sony vila discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

sony

193.233.20.33:4125

Attributes

auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

vila

193.233.20.33:4125

Attributes

auth_value
94b115d79ddcab0a0fb9dfab8e225c3b

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v4650vw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz6191.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz6191.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz6191.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz6191.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v4650vw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v4650vw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v4650vw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v4650vw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz6191.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz6191.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v4650vw.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

resource	yara_rule
behavioral1/memory/2432-210-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-209-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-212-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-214-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-216-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-218-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-220-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-222-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-224-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-226-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-228-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-230-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-232-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-234-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-236-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-238-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-240-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline
behavioral1/memory/2432-242-0x0000000004CC0000-0x0000000004CFE000-memory.dmp	family_redline

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	y31Xm34.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	legenda.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	buildjack.exe

Executes dropped EXE 12 IoCs

pid	Process
1148	zap6164.exe
1564	zap5238.exe
2264	zap0559.exe
4344	tz6191.exe
2280	v4650vw.exe
2432	w06mk62.exe
2812	xGfED86.exe
2864	y31Xm34.exe
5004	legenda.exe
3952	buildjack.exe
2196	buildkingkong.exe
436	legenda.exe

Loads dropped DLL 1 IoCs

pid	Process
1504	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz6191.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v4650vw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v4650vw.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap0559.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap6164.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap6164.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap5238.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap5238.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap0559.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4944	2280	WerFault.exe	86
2076	2432	WerFault.exe	90

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3488	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3052	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4344	tz6191.exe
4344	tz6191.exe
2280	v4650vw.exe
2280	v4650vw.exe
2432	w06mk62.exe
2432	w06mk62.exe
2812	xGfED86.exe
2812	xGfED86.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	4344	tz6191.exe
Token: SeDebugPrivilege	2280	v4650vw.exe
Token: SeDebugPrivilege	2432	w06mk62.exe
Token: SeDebugPrivilege	2812	xGfED86.exe
Token: SeDebugPrivilege	3952	buildjack.exe
Token: SeDebugPrivilege	2196	buildkingkong.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 1148	2692	7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33.exe	80
PID 2692 wrote to memory of 1148	2692	7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33.exe	80
PID 2692 wrote to memory of 1148	2692	7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33.exe	80
PID 1148 wrote to memory of 1564	1148	zap6164.exe	81
PID 1148 wrote to memory of 1564	1148	zap6164.exe	81
PID 1148 wrote to memory of 1564	1148	zap6164.exe	81
PID 1564 wrote to memory of 2264	1564	zap5238.exe	82
PID 1564 wrote to memory of 2264	1564	zap5238.exe	82
PID 1564 wrote to memory of 2264	1564	zap5238.exe	82
PID 2264 wrote to memory of 4344	2264	zap0559.exe	83
PID 2264 wrote to memory of 4344	2264	zap0559.exe	83
PID 2264 wrote to memory of 2280	2264	zap0559.exe	86
PID 2264 wrote to memory of 2280	2264	zap0559.exe	86
PID 2264 wrote to memory of 2280	2264	zap0559.exe	86
PID 1564 wrote to memory of 2432	1564	zap5238.exe	90
PID 1564 wrote to memory of 2432	1564	zap5238.exe	90
PID 1564 wrote to memory of 2432	1564	zap5238.exe	90
PID 1148 wrote to memory of 2812	1148	zap6164.exe	93
PID 1148 wrote to memory of 2812	1148	zap6164.exe	93
PID 1148 wrote to memory of 2812	1148	zap6164.exe	93
PID 2692 wrote to memory of 2864	2692	7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33.exe	94
PID 2692 wrote to memory of 2864	2692	7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33.exe	94
PID 2692 wrote to memory of 2864	2692	7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33.exe	94
PID 2864 wrote to memory of 5004	2864	y31Xm34.exe	95
PID 2864 wrote to memory of 5004	2864	y31Xm34.exe	95
PID 2864 wrote to memory of 5004	2864	y31Xm34.exe	95
PID 5004 wrote to memory of 3488	5004	legenda.exe	96
PID 5004 wrote to memory of 3488	5004	legenda.exe	96
PID 5004 wrote to memory of 3488	5004	legenda.exe	96
PID 5004 wrote to memory of 2400	5004	legenda.exe	98
PID 5004 wrote to memory of 2400	5004	legenda.exe	98
PID 5004 wrote to memory of 2400	5004	legenda.exe	98
PID 2400 wrote to memory of 4644	2400	cmd.exe	100
PID 2400 wrote to memory of 4644	2400	cmd.exe	100
PID 2400 wrote to memory of 4644	2400	cmd.exe	100
PID 2400 wrote to memory of 4988	2400	cmd.exe	101
PID 2400 wrote to memory of 4988	2400	cmd.exe	101
PID 2400 wrote to memory of 4988	2400	cmd.exe	101
PID 2400 wrote to memory of 1568	2400	cmd.exe	102
PID 2400 wrote to memory of 1568	2400	cmd.exe	102
PID 2400 wrote to memory of 1568	2400	cmd.exe	102
PID 2400 wrote to memory of 1164	2400	cmd.exe	103
PID 2400 wrote to memory of 1164	2400	cmd.exe	103
PID 2400 wrote to memory of 1164	2400	cmd.exe	103
PID 2400 wrote to memory of 1716	2400	cmd.exe	104
PID 2400 wrote to memory of 1716	2400	cmd.exe	104
PID 2400 wrote to memory of 1716	2400	cmd.exe	104
PID 2400 wrote to memory of 3980	2400	cmd.exe	105
PID 2400 wrote to memory of 3980	2400	cmd.exe	105
PID 2400 wrote to memory of 3980	2400	cmd.exe	105
PID 5004 wrote to memory of 3952	5004	legenda.exe	106
PID 5004 wrote to memory of 3952	5004	legenda.exe	106
PID 5004 wrote to memory of 2196	5004	legenda.exe	107
PID 5004 wrote to memory of 2196	5004	legenda.exe	107
PID 3952 wrote to memory of 4840	3952	buildjack.exe	108
PID 3952 wrote to memory of 4840	3952	buildjack.exe	108
PID 4840 wrote to memory of 4616	4840	cmd.exe	110
PID 4840 wrote to memory of 4616	4840	cmd.exe	110
PID 4840 wrote to memory of 3052	4840	cmd.exe	111
PID 4840 wrote to memory of 3052	4840	cmd.exe	111
PID 5004 wrote to memory of 1504	5004	legenda.exe	112
PID 5004 wrote to memory of 1504	5004	legenda.exe	112
PID 5004 wrote to memory of 1504	5004	legenda.exe	112

C:\Users\Admin\AppData\Local\Temp\7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33.exe
"C:\Users\Admin\AppData\Local\Temp\7a2aa5b53ff3d6228fb0ec3df435442fd3501495f96d22f6a76967e60d11bf33.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6164.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6164.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5238.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5238.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0559.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0559.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6191.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6191.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4650vw.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4650vw.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2280
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 1096
        6⤵
        Program crash
        
        PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w06mk62.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w06mk62.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2432
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 1708
        5⤵
        Program crash
        
        PID:2076
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xGfED86.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xGfED86.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2812
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y31Xm34.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y31Xm34.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
    "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3488
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2400
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4644
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legenda.exe" /P "Admin:N"
        5⤵
        
        PID:4988
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legenda.exe" /P "Admin:R" /E
        5⤵
        
        PID:1568
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:1164
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\f22b669919" /P "Admin:N"
        5⤵
        
        PID:1716
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\f22b669919" /P "Admin:R" /E
        5⤵
        
        PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\1000181001\buildjack.exe
      "C:\Users\Admin\AppData\Local\Temp\1000181001\buildjack.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3952
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1000181001\buildjack.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:4840
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:4616
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\1000182001\buildkingkong.exe
      "C:\Users\Admin\AppData\Local\Temp\1000182001\buildkingkong.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2196
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:1504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2280 -ip 2280
1⤵
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2432 -ip 2432
1⤵
PID:2800

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:436

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000181001\buildjack.exe

Filesize
77KB

MD5
10f57aeea7d69c1fd26302daea446d8d

SHA1
a2c2b246233565b7deade7a4e27b9bf521cdb714

SHA256
e890b9a76c6f9b47913ad5102fd668b556234c6be3488580577a03ed3f61b62c

SHA512
a28fc863f62f48fa26810ae7c099b03fc85b0d2542b3491aa2b5afb54df1114f415636f0ff048d3a8e0d158ff6378403a60c1ad3e3270c49e06ffea85da2ccb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000181001\buildjack.exe

Filesize
77KB

MD5
10f57aeea7d69c1fd26302daea446d8d

SHA1
a2c2b246233565b7deade7a4e27b9bf521cdb714

SHA256
e890b9a76c6f9b47913ad5102fd668b556234c6be3488580577a03ed3f61b62c

SHA512
a28fc863f62f48fa26810ae7c099b03fc85b0d2542b3491aa2b5afb54df1114f415636f0ff048d3a8e0d158ff6378403a60c1ad3e3270c49e06ffea85da2ccb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000181001\buildjack.exe

Filesize
77KB

MD5
10f57aeea7d69c1fd26302daea446d8d

SHA1
a2c2b246233565b7deade7a4e27b9bf521cdb714

SHA256
e890b9a76c6f9b47913ad5102fd668b556234c6be3488580577a03ed3f61b62c

SHA512
a28fc863f62f48fa26810ae7c099b03fc85b0d2542b3491aa2b5afb54df1114f415636f0ff048d3a8e0d158ff6378403a60c1ad3e3270c49e06ffea85da2ccb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000182001\buildkingkong.exe

Filesize
352KB

MD5
77d9c4825efbd2aac09edbb8d068c259

SHA1
79928ad3ea39bd4548e06289652cfbd1830188ba

SHA256
3559d1157a6fad3bcc67ddcecd32ffa8bbb637ed8d7651904b43bdfe8d724065

SHA512
9432795b24ff7f76a743b3e0ffe7ae94cccea4aa1d04b1b6ff3c50fc111730cf6d04b122763124379f76e68d9147e9bc7759817850ec80f77812acda0c31d91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000182001\buildkingkong.exe

Filesize
352KB

MD5
77d9c4825efbd2aac09edbb8d068c259

SHA1
79928ad3ea39bd4548e06289652cfbd1830188ba

SHA256
3559d1157a6fad3bcc67ddcecd32ffa8bbb637ed8d7651904b43bdfe8d724065

SHA512
9432795b24ff7f76a743b3e0ffe7ae94cccea4aa1d04b1b6ff3c50fc111730cf6d04b122763124379f76e68d9147e9bc7759817850ec80f77812acda0c31d91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000182001\buildkingkong.exe

Filesize
352KB

MD5
77d9c4825efbd2aac09edbb8d068c259

SHA1
79928ad3ea39bd4548e06289652cfbd1830188ba

SHA256
3559d1157a6fad3bcc67ddcecd32ffa8bbb637ed8d7651904b43bdfe8d724065

SHA512
9432795b24ff7f76a743b3e0ffe7ae94cccea4aa1d04b1b6ff3c50fc111730cf6d04b122763124379f76e68d9147e9bc7759817850ec80f77812acda0c31d91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y31Xm34.exe

Filesize
236KB

MD5
79a6c96c1c2713b614fbee75b6282b3d

SHA1
486a3d4cdf89e548d7ace96c5aa7fa5d7853cd14

SHA256
bcea762db9071555793323a1c48674ce97d4529f515b4ef4beaf74fa8786f114

SHA512
9bbd9ff4233c9ea0ba3896f47cc52f794d0dab2c43d54854e0e6145f7c4d188398de81e96055dc21e5bcd0adcd8808a12330f54a1bc1c1c1637bda37732e7f2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y31Xm34.exe

Filesize
236KB

MD5
79a6c96c1c2713b614fbee75b6282b3d

SHA1
486a3d4cdf89e548d7ace96c5aa7fa5d7853cd14

SHA256
bcea762db9071555793323a1c48674ce97d4529f515b4ef4beaf74fa8786f114

SHA512
9bbd9ff4233c9ea0ba3896f47cc52f794d0dab2c43d54854e0e6145f7c4d188398de81e96055dc21e5bcd0adcd8808a12330f54a1bc1c1c1637bda37732e7f2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6164.exe

Filesize
839KB

MD5
d72fc96dada4b02e7300946b794756c3

SHA1
f7c57b089d3a1a8c7d8e63400dfe65437f1efc22

SHA256
a7dc37d08215140cc74cf5a5bafb9eb90af3fa8d5ca23719e0045afc875c75dc

SHA512
a38e7e7baab9eb6c1ab5ecbf996dec54c05b73db034d3831c31ce45362a2f0e93968c9b1c6ac0d4bb48aed321d2b7ee3ff29ac0ff1fe6873000789b42885f471

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6164.exe

Filesize
839KB

MD5
d72fc96dada4b02e7300946b794756c3

SHA1
f7c57b089d3a1a8c7d8e63400dfe65437f1efc22

SHA256
a7dc37d08215140cc74cf5a5bafb9eb90af3fa8d5ca23719e0045afc875c75dc

SHA512
a38e7e7baab9eb6c1ab5ecbf996dec54c05b73db034d3831c31ce45362a2f0e93968c9b1c6ac0d4bb48aed321d2b7ee3ff29ac0ff1fe6873000789b42885f471

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xGfED86.exe

Filesize
175KB

MD5
05981e404bf7ac1eec05045bee742f2c

SHA1
1e62a265895999a66c74e4d281f56c5e413b2c23

SHA256
c41237753cafaf7f735b6c1a6b5d7e5e6ef1b2eacde5afd8eaf9c2db34df224a

SHA512
ba6c63a5cfa586819d3f5381caae40048174282edfd1afc9c535c1fcc3a7ac7d84e4a76d8c9e1d674f716a7fc6d7aaa88d935b262685e12999c9ba2e57be6f86

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xGfED86.exe

Filesize
175KB

MD5
05981e404bf7ac1eec05045bee742f2c

SHA1
1e62a265895999a66c74e4d281f56c5e413b2c23

SHA256
c41237753cafaf7f735b6c1a6b5d7e5e6ef1b2eacde5afd8eaf9c2db34df224a

SHA512
ba6c63a5cfa586819d3f5381caae40048174282edfd1afc9c535c1fcc3a7ac7d84e4a76d8c9e1d674f716a7fc6d7aaa88d935b262685e12999c9ba2e57be6f86

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5238.exe

Filesize
696KB

MD5
2fc287fe24eaa97c623c04a80936a128

SHA1
7ee621164f7f83ca78a443ce2f58e0d7ab8d3736

SHA256
620984f9919990cf8d42e051b3130bb4851120752bf2d8acec37146904c8f24f

SHA512
e529a694a8f894dc71b1d112ca8b57c266c355c7e13a5d879b63c50cbfcce93ce918092a2f08f4aa45f88446f3b5e23525b889898a5999506b62fb8a8763aa52

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5238.exe

Filesize
696KB

MD5
2fc287fe24eaa97c623c04a80936a128

SHA1
7ee621164f7f83ca78a443ce2f58e0d7ab8d3736

SHA256
620984f9919990cf8d42e051b3130bb4851120752bf2d8acec37146904c8f24f

SHA512
e529a694a8f894dc71b1d112ca8b57c266c355c7e13a5d879b63c50cbfcce93ce918092a2f08f4aa45f88446f3b5e23525b889898a5999506b62fb8a8763aa52

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w06mk62.exe

Filesize
350KB

MD5
dbd253ccc048be07f6605d8cf9eb5722

SHA1
71fe4a3b7574b7ae7698ef7748248f68de4dec1d

SHA256
673a7eaa9d7be26545d147a4499d689611f90dca6ba84ac6974d9f4f481ea64e

SHA512
6f4dfa595e3377d2e21850cf2b15b116662952f39f8916c5ad598f34eef1e3ae696d002f88d26d5b40910fd6b749437626b8c747e13f6cd78c8e687fb5c2b344

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w06mk62.exe

Filesize
350KB

MD5
dbd253ccc048be07f6605d8cf9eb5722

SHA1
71fe4a3b7574b7ae7698ef7748248f68de4dec1d

SHA256
673a7eaa9d7be26545d147a4499d689611f90dca6ba84ac6974d9f4f481ea64e

SHA512
6f4dfa595e3377d2e21850cf2b15b116662952f39f8916c5ad598f34eef1e3ae696d002f88d26d5b40910fd6b749437626b8c747e13f6cd78c8e687fb5c2b344

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0559.exe

Filesize
345KB

MD5
07c23de9f72c2561839dccb6b0862768

SHA1
f62c5aac29da5a478bcd67afc924e3eaeb3a061d

SHA256
6ffb5c1e0922893485d79e9c9ceab53a8f3ef45f606f92283ccd0e1a0c404305

SHA512
3bb2511672972432963dad64d84aa4be8ddb70964bd577b7c19d13204bb40597a4a06625be1044066c4a9b057d26cd02e1cd2e787e6124be86e65c9a69c01278

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0559.exe

Filesize
345KB

MD5
07c23de9f72c2561839dccb6b0862768

SHA1
f62c5aac29da5a478bcd67afc924e3eaeb3a061d

SHA256
6ffb5c1e0922893485d79e9c9ceab53a8f3ef45f606f92283ccd0e1a0c404305

SHA512
3bb2511672972432963dad64d84aa4be8ddb70964bd577b7c19d13204bb40597a4a06625be1044066c4a9b057d26cd02e1cd2e787e6124be86e65c9a69c01278

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6191.exe

Filesize
12KB

MD5
13b6a7f345f5125a2da350cdf06cce4a

SHA1
742b73aa8d989424215337d33cc05bc7a248d370

SHA256
b3376afa8b5f60d1c34da92bfb255b4116952a10a369847b60839e99de75fc06

SHA512
9dde371707a55a23a44a9cc5af06bb62486b8b1f05332ad3101473394246784a148ac4abca443b6d30b80e7b9c01cc04d5b1a5aa7dda11ac1733715b28bbed71

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6191.exe

Filesize
12KB

MD5
13b6a7f345f5125a2da350cdf06cce4a

SHA1
742b73aa8d989424215337d33cc05bc7a248d370

SHA256
b3376afa8b5f60d1c34da92bfb255b4116952a10a369847b60839e99de75fc06

SHA512
9dde371707a55a23a44a9cc5af06bb62486b8b1f05332ad3101473394246784a148ac4abca443b6d30b80e7b9c01cc04d5b1a5aa7dda11ac1733715b28bbed71

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4650vw.exe

Filesize
292KB

MD5
267fc4a2ce9a499d126e60283f63c8d6

SHA1
37c580ddb73811b5077af0d241728cac731b83ef

SHA256
e4d0c25123228c9e1ab0ed690e18b43d0c9d5b0441355027e11382b534279b6c

SHA512
98816c2a3c7581612b11693e427d37d19e975a2161ab12427c45e148ac6219ce43ef390db778b55c3d6eb04794f1f05d41bb41f50e8edcaf2fe0fd3b8167dc67

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4650vw.exe

Filesize
292KB

MD5
267fc4a2ce9a499d126e60283f63c8d6

SHA1
37c580ddb73811b5077af0d241728cac731b83ef

SHA256
e4d0c25123228c9e1ab0ed690e18b43d0c9d5b0441355027e11382b534279b6c

SHA512
98816c2a3c7581612b11693e427d37d19e975a2161ab12427c45e148ac6219ce43ef390db778b55c3d6eb04794f1f05d41bb41f50e8edcaf2fe0fd3b8167dc67

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
236KB

MD5
79a6c96c1c2713b614fbee75b6282b3d

SHA1
486a3d4cdf89e548d7ace96c5aa7fa5d7853cd14

SHA256
bcea762db9071555793323a1c48674ce97d4529f515b4ef4beaf74fa8786f114

SHA512
9bbd9ff4233c9ea0ba3896f47cc52f794d0dab2c43d54854e0e6145f7c4d188398de81e96055dc21e5bcd0adcd8808a12330f54a1bc1c1c1637bda37732e7f2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
236KB

MD5
79a6c96c1c2713b614fbee75b6282b3d

SHA1
486a3d4cdf89e548d7ace96c5aa7fa5d7853cd14

SHA256
bcea762db9071555793323a1c48674ce97d4529f515b4ef4beaf74fa8786f114

SHA512
9bbd9ff4233c9ea0ba3896f47cc52f794d0dab2c43d54854e0e6145f7c4d188398de81e96055dc21e5bcd0adcd8808a12330f54a1bc1c1c1637bda37732e7f2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
236KB

MD5
79a6c96c1c2713b614fbee75b6282b3d

SHA1
486a3d4cdf89e548d7ace96c5aa7fa5d7853cd14

SHA256
bcea762db9071555793323a1c48674ce97d4529f515b4ef4beaf74fa8786f114

SHA512
9bbd9ff4233c9ea0ba3896f47cc52f794d0dab2c43d54854e0e6145f7c4d188398de81e96055dc21e5bcd0adcd8808a12330f54a1bc1c1c1637bda37732e7f2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
236KB

MD5
79a6c96c1c2713b614fbee75b6282b3d

SHA1
486a3d4cdf89e548d7ace96c5aa7fa5d7853cd14

SHA256
bcea762db9071555793323a1c48674ce97d4529f515b4ef4beaf74fa8786f114

SHA512
9bbd9ff4233c9ea0ba3896f47cc52f794d0dab2c43d54854e0e6145f7c4d188398de81e96055dc21e5bcd0adcd8808a12330f54a1bc1c1c1637bda37732e7f2f

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/2196-1192-0x00000278432A0000-0x00000278432FE000-memory.dmp

Filesize
376KB

Download
memory/2196-1193-0x0000027844E30000-0x0000027844E40000-memory.dmp

Filesize
64KB

Download
memory/2280-170-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/2280-202-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/2280-204-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/2280-201-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/2280-200-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/2280-199-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/2280-198-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-196-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-194-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-192-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-190-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-188-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-186-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-184-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-182-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-180-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-178-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-176-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-174-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-172-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-171-0x0000000002860000-0x0000000002872000-memory.dmp

Filesize
72KB

Download
memory/2280-169-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Filesize
64KB

Download
memory/2280-168-0x0000000004FC0000-0x0000000005564000-memory.dmp

Filesize
5.6MB

Download
memory/2280-167-0x0000000000710000-0x000000000073D000-memory.dmp

Filesize
180KB

Download
memory/2432-230-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-242-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-560-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/2432-1119-0x0000000005460000-0x0000000005A78000-memory.dmp

Filesize
6.1MB

Download
memory/2432-1120-0x0000000005B00000-0x0000000005C0A000-memory.dmp

Filesize
1.0MB

Download
memory/2432-1121-0x0000000005C40000-0x0000000005C52000-memory.dmp

Filesize
72KB

Download
memory/2432-1122-0x0000000005C60000-0x0000000005C9C000-memory.dmp

Filesize
240KB

Download
memory/2432-1123-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/2432-1125-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/2432-1126-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/2432-1127-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Filesize
408KB

Download
memory/2432-1128-0x0000000006740000-0x00000000067D2000-memory.dmp

Filesize
584KB

Download
memory/2432-1129-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/2432-1130-0x0000000006830000-0x00000000068A6000-memory.dmp

Filesize
472KB

Download
memory/2432-1131-0x00000000068C0000-0x0000000006910000-memory.dmp

Filesize
320KB

Download
memory/2432-1132-0x0000000007D00000-0x0000000007EC2000-memory.dmp

Filesize
1.8MB

Download
memory/2432-1133-0x0000000007ED0000-0x00000000083FC000-memory.dmp

Filesize
5.2MB

Download
memory/2432-555-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/2432-554-0x0000000000720000-0x000000000076B000-memory.dmp

Filesize
300KB

Download
memory/2432-210-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-209-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-557-0x0000000004D30000-0x0000000004D40000-memory.dmp

Filesize
64KB

Download
memory/2432-240-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-238-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-236-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-234-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-232-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-228-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-226-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-212-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-214-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-216-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-224-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-222-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-220-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2432-218-0x0000000004CC0000-0x0000000004CFE000-memory.dmp

Filesize
248KB

Download
memory/2812-1140-0x00000000055A0000-0x00000000055B0000-memory.dmp

Filesize
64KB

Download
memory/2812-1139-0x0000000000A20000-0x0000000000A52000-memory.dmp

Filesize
200KB

Download
memory/3952-1175-0x0000026BF4FB0000-0x0000026BF5000000-memory.dmp

Filesize
320KB

Download
memory/3952-1174-0x0000026BF5920000-0x0000026BF5930000-memory.dmp

Filesize
64KB

Download
memory/3952-1173-0x0000026BF3290000-0x0000026BF32A8000-memory.dmp

Filesize
96KB

Download
memory/4344-161-0x0000000000FF0000-0x0000000000FFA000-memory.dmp

Filesize
40KB

Download