amadey | 601207ff2909da97272ca4d22cd8ba62012fe4292e902df7b0c3af0b1940c46b

Analysis

max time kernel
138s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2023, 14:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0161b44615068b3af2425cebd0d8e584.exe
Size

1023KB
MD5

0161b44615068b3af2425cebd0d8e584
SHA1

f221f8a49194f63c75e168e39bfd95897825851a
SHA256

601207ff2909da97272ca4d22cd8ba62012fe4292e902df7b0c3af0b1940c46b
SHA512

45e0ce56f2d12cd78d9e827c23c83fdf2b40f70f44c5bad51bf2b079ceefea8be832c36b9c90163b4e4dd6337241f78f16a992ac9e45a515b787d538b39dffe5
SSDEEP

24576:oyyT/1XYqWCKBjNfUS5idDS/m/+fEcQTa0SYtrzejaBF/:vWX5KBBfdi9mmXcIaXo3BF

Score

10^/10

amadey redline sony vila discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

sony

193.233.20.33:4125

Attributes

auth_value
1d93d1744381eeb4fcfd7c23ffe0f0b4

Extracted

Family

redline

Botnet

vila

193.233.20.33:4125

Attributes

auth_value
94b115d79ddcab0a0fb9dfab8e225c3b

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v9151vo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v9151vo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v9151vo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz1670.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz1670.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz1670.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz1670.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz1670.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v9151vo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz1670.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v9151vo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v9151vo.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

resource	yara_rule
behavioral2/memory/2820-212-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-214-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-211-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-216-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-218-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-220-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-224-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-222-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-226-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-228-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-230-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-234-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-232-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-236-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-238-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-240-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-242-0x00000000028B0000-0x00000000028EE000-memory.dmp	family_redline
behavioral2/memory/2820-260-0x0000000004F60000-0x0000000004F70000-memory.dmp	family_redline

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	y45zt99.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	legenda.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	buildjack.exe

Executes dropped EXE 12 IoCs

pid	Process
2080	zap9963.exe
4176	zap1299.exe
3416	zap7302.exe
220	tz1670.exe
4580	v9151vo.exe
2820	w85tv05.exe
3304	xSDWr17.exe
1996	y45zt99.exe
3772	legenda.exe
1840	buildjack.exe
4004	buildkingkong.exe
4920	legenda.exe

Loads dropped DLL 1 IoCs

pid	Process
996	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz1670.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v9151vo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v9151vo.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap9963.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1299.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap1299.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap7302.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap7302.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	0161b44615068b3af2425cebd0d8e584.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0161b44615068b3af2425cebd0d8e584.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap9963.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
33	ip-api.com

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4588	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5072	4580	WerFault.exe	95
3992	2820	WerFault.exe	98

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
852	schtasks.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3324	PING.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
220	tz1670.exe
220	tz1670.exe
4580	v9151vo.exe
4580	v9151vo.exe
2820	w85tv05.exe
2820	w85tv05.exe
3304	xSDWr17.exe
3304	xSDWr17.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	220	tz1670.exe
Token: SeDebugPrivilege	4580	v9151vo.exe
Token: SeDebugPrivilege	2820	w85tv05.exe
Token: SeDebugPrivilege	3304	xSDWr17.exe
Token: SeDebugPrivilege	1840	buildjack.exe
Token: SeDebugPrivilege	4004	buildkingkong.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 2080	4900	0161b44615068b3af2425cebd0d8e584.exe	88
PID 4900 wrote to memory of 2080	4900	0161b44615068b3af2425cebd0d8e584.exe	88
PID 4900 wrote to memory of 2080	4900	0161b44615068b3af2425cebd0d8e584.exe	88
PID 2080 wrote to memory of 4176	2080	zap9963.exe	89
PID 2080 wrote to memory of 4176	2080	zap9963.exe	89
PID 2080 wrote to memory of 4176	2080	zap9963.exe	89
PID 4176 wrote to memory of 3416	4176	zap1299.exe	90
PID 4176 wrote to memory of 3416	4176	zap1299.exe	90
PID 4176 wrote to memory of 3416	4176	zap1299.exe	90
PID 3416 wrote to memory of 220	3416	zap7302.exe	91
PID 3416 wrote to memory of 220	3416	zap7302.exe	91
PID 3416 wrote to memory of 4580	3416	zap7302.exe	95
PID 3416 wrote to memory of 4580	3416	zap7302.exe	95
PID 3416 wrote to memory of 4580	3416	zap7302.exe	95
PID 4176 wrote to memory of 2820	4176	zap1299.exe	98
PID 4176 wrote to memory of 2820	4176	zap1299.exe	98
PID 4176 wrote to memory of 2820	4176	zap1299.exe	98
PID 2080 wrote to memory of 3304	2080	zap9963.exe	106
PID 2080 wrote to memory of 3304	2080	zap9963.exe	106
PID 2080 wrote to memory of 3304	2080	zap9963.exe	106
PID 4900 wrote to memory of 1996	4900	0161b44615068b3af2425cebd0d8e584.exe	107
PID 4900 wrote to memory of 1996	4900	0161b44615068b3af2425cebd0d8e584.exe	107
PID 4900 wrote to memory of 1996	4900	0161b44615068b3af2425cebd0d8e584.exe	107
PID 1996 wrote to memory of 3772	1996	y45zt99.exe	108
PID 1996 wrote to memory of 3772	1996	y45zt99.exe	108
PID 1996 wrote to memory of 3772	1996	y45zt99.exe	108
PID 3772 wrote to memory of 852	3772	legenda.exe	109
PID 3772 wrote to memory of 852	3772	legenda.exe	109
PID 3772 wrote to memory of 852	3772	legenda.exe	109
PID 3772 wrote to memory of 916	3772	legenda.exe	111
PID 3772 wrote to memory of 916	3772	legenda.exe	111
PID 3772 wrote to memory of 916	3772	legenda.exe	111
PID 916 wrote to memory of 4464	916	cmd.exe	113
PID 916 wrote to memory of 4464	916	cmd.exe	113
PID 916 wrote to memory of 4464	916	cmd.exe	113
PID 916 wrote to memory of 1600	916	cmd.exe	114
PID 916 wrote to memory of 1600	916	cmd.exe	114
PID 916 wrote to memory of 1600	916	cmd.exe	114
PID 916 wrote to memory of 1420	916	cmd.exe	115
PID 916 wrote to memory of 1420	916	cmd.exe	115
PID 916 wrote to memory of 1420	916	cmd.exe	115
PID 916 wrote to memory of 1136	916	cmd.exe	116
PID 916 wrote to memory of 1136	916	cmd.exe	116
PID 916 wrote to memory of 1136	916	cmd.exe	116
PID 916 wrote to memory of 1316	916	cmd.exe	117
PID 916 wrote to memory of 1316	916	cmd.exe	117
PID 916 wrote to memory of 1316	916	cmd.exe	117
PID 916 wrote to memory of 1592	916	cmd.exe	118
PID 916 wrote to memory of 1592	916	cmd.exe	118
PID 916 wrote to memory of 1592	916	cmd.exe	118
PID 3772 wrote to memory of 1840	3772	legenda.exe	119
PID 3772 wrote to memory of 1840	3772	legenda.exe	119
PID 3772 wrote to memory of 4004	3772	legenda.exe	120
PID 3772 wrote to memory of 4004	3772	legenda.exe	120
PID 1840 wrote to memory of 3748	1840	buildjack.exe	121
PID 1840 wrote to memory of 3748	1840	buildjack.exe	121
PID 3748 wrote to memory of 3836	3748	cmd.exe	123
PID 3748 wrote to memory of 3836	3748	cmd.exe	123
PID 3748 wrote to memory of 3324	3748	cmd.exe	124
PID 3748 wrote to memory of 3324	3748	cmd.exe	124
PID 3772 wrote to memory of 996	3772	legenda.exe	125
PID 3772 wrote to memory of 996	3772	legenda.exe	125
PID 3772 wrote to memory of 996	3772	legenda.exe	125

C:\Users\Admin\AppData\Local\Temp\0161b44615068b3af2425cebd0d8e584.exe
"C:\Users\Admin\AppData\Local\Temp\0161b44615068b3af2425cebd0d8e584.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9963.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9963.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1299.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1299.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4176
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7302.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7302.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1670.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1670.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:220
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9151vo.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9151vo.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4580
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 1084
        6⤵
        Program crash
        
        PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w85tv05.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w85tv05.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2820
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2820 -s 1544
        5⤵
        Program crash
        
        PID:3992
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xSDWr17.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xSDWr17.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3304
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y45zt99.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y45zt99.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
    "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:852
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:916
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4464
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legenda.exe" /P "Admin:N"
        5⤵
        
        PID:1600
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legenda.exe" /P "Admin:R" /E
        5⤵
        
        PID:1420
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:1136
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\f22b669919" /P "Admin:N"
        5⤵
        
        PID:1316
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\f22b669919" /P "Admin:R" /E
        5⤵
        
        PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\1000181001\buildjack.exe
      "C:\Users\Admin\AppData\Local\Temp\1000181001\buildjack.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1000181001\buildjack.exe"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3748
      - C:\Windows\system32\chcp.com
        
        chcp 65001
        6⤵
        
        PID:3836
      - C:\Windows\system32\PING.EXE
        
        ping 127.0.0.1
        6⤵
        Runs ping.exe
        
        PID:3324
  - - C:\Users\Admin\AppData\Local\Temp\1000182001\buildkingkong.exe
      "C:\Users\Admin\AppData\Local\Temp\1000182001\buildkingkong.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4004
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4580 -ip 4580
1⤵
PID:4508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2820 -ip 2820
1⤵
PID:4120

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:4920

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:4588

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000181001\buildjack.exe

Filesize
77KB

MD5
10f57aeea7d69c1fd26302daea446d8d

SHA1
a2c2b246233565b7deade7a4e27b9bf521cdb714

SHA256
e890b9a76c6f9b47913ad5102fd668b556234c6be3488580577a03ed3f61b62c

SHA512
a28fc863f62f48fa26810ae7c099b03fc85b0d2542b3491aa2b5afb54df1114f415636f0ff048d3a8e0d158ff6378403a60c1ad3e3270c49e06ffea85da2ccb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000181001\buildjack.exe

Filesize
77KB

MD5
10f57aeea7d69c1fd26302daea446d8d

SHA1
a2c2b246233565b7deade7a4e27b9bf521cdb714

SHA256
e890b9a76c6f9b47913ad5102fd668b556234c6be3488580577a03ed3f61b62c

SHA512
a28fc863f62f48fa26810ae7c099b03fc85b0d2542b3491aa2b5afb54df1114f415636f0ff048d3a8e0d158ff6378403a60c1ad3e3270c49e06ffea85da2ccb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000181001\buildjack.exe

Filesize
77KB

MD5
10f57aeea7d69c1fd26302daea446d8d

SHA1
a2c2b246233565b7deade7a4e27b9bf521cdb714

SHA256
e890b9a76c6f9b47913ad5102fd668b556234c6be3488580577a03ed3f61b62c

SHA512
a28fc863f62f48fa26810ae7c099b03fc85b0d2542b3491aa2b5afb54df1114f415636f0ff048d3a8e0d158ff6378403a60c1ad3e3270c49e06ffea85da2ccb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000182001\buildkingkong.exe

Filesize
352KB

MD5
77d9c4825efbd2aac09edbb8d068c259

SHA1
79928ad3ea39bd4548e06289652cfbd1830188ba

SHA256
3559d1157a6fad3bcc67ddcecd32ffa8bbb637ed8d7651904b43bdfe8d724065

SHA512
9432795b24ff7f76a743b3e0ffe7ae94cccea4aa1d04b1b6ff3c50fc111730cf6d04b122763124379f76e68d9147e9bc7759817850ec80f77812acda0c31d91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000182001\buildkingkong.exe

Filesize
352KB

MD5
77d9c4825efbd2aac09edbb8d068c259

SHA1
79928ad3ea39bd4548e06289652cfbd1830188ba

SHA256
3559d1157a6fad3bcc67ddcecd32ffa8bbb637ed8d7651904b43bdfe8d724065

SHA512
9432795b24ff7f76a743b3e0ffe7ae94cccea4aa1d04b1b6ff3c50fc111730cf6d04b122763124379f76e68d9147e9bc7759817850ec80f77812acda0c31d91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000182001\buildkingkong.exe

Filesize
352KB

MD5
77d9c4825efbd2aac09edbb8d068c259

SHA1
79928ad3ea39bd4548e06289652cfbd1830188ba

SHA256
3559d1157a6fad3bcc67ddcecd32ffa8bbb637ed8d7651904b43bdfe8d724065

SHA512
9432795b24ff7f76a743b3e0ffe7ae94cccea4aa1d04b1b6ff3c50fc111730cf6d04b122763124379f76e68d9147e9bc7759817850ec80f77812acda0c31d91b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y45zt99.exe

Filesize
236KB

MD5
04fdc50c2525a9c5d4ae111fd30ee076

SHA1
caca1dc4712fd6468dfa7f44a21716e14bd53287

SHA256
a95db443e490281e278c9298131af211e3bea5d0cf23e5e8bea8a7d42a15e926

SHA512
5d92e0cc228cecaedb0efc67a4f989bca2c2b2648970ba4630b1843c6af59624ca8a4bf52d6e9ec8cd78a09f08493e51dff2c155fb3e1bcf6007bc1416043056

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y45zt99.exe

Filesize
236KB

MD5
04fdc50c2525a9c5d4ae111fd30ee076

SHA1
caca1dc4712fd6468dfa7f44a21716e14bd53287

SHA256
a95db443e490281e278c9298131af211e3bea5d0cf23e5e8bea8a7d42a15e926

SHA512
5d92e0cc228cecaedb0efc67a4f989bca2c2b2648970ba4630b1843c6af59624ca8a4bf52d6e9ec8cd78a09f08493e51dff2c155fb3e1bcf6007bc1416043056

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9963.exe

Filesize
838KB

MD5
14fa83e98f668e136e639e6c6146821c

SHA1
d0da1d6a411f17e64ba2147884c5cdde0e452ff9

SHA256
de96089206868aa096c7773843e05f0eb4392501f7cabadd036208bae02121dd

SHA512
e576244835a8d0271832c0cbd90a01f35b6009dc37bbc6314812b036d5e49d6573bdf82b74a541053043dc24207e846b76b148a27a1b5a42db5b826dde7f0afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9963.exe

Filesize
838KB

MD5
14fa83e98f668e136e639e6c6146821c

SHA1
d0da1d6a411f17e64ba2147884c5cdde0e452ff9

SHA256
de96089206868aa096c7773843e05f0eb4392501f7cabadd036208bae02121dd

SHA512
e576244835a8d0271832c0cbd90a01f35b6009dc37bbc6314812b036d5e49d6573bdf82b74a541053043dc24207e846b76b148a27a1b5a42db5b826dde7f0afe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xSDWr17.exe

Filesize
175KB

MD5
efc2bc20da3bcef6c978112da368f78f

SHA1
c192dd5b289f4140a347f68a78ef906391761345

SHA256
5f6af6d082f5b2f977bcb890d7bcd4569f9ea6e5d061bc9f11524ffdcee5700a

SHA512
197b6691e996f1214ea6bc61f374aa93d4c99771947e4708f272d3e254da9ec139f6517c4d1ed1aac954e1bbc1ad1b498d3bd2ad4e34f0c2a9d2adb911da5a92

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xSDWr17.exe

Filesize
175KB

MD5
efc2bc20da3bcef6c978112da368f78f

SHA1
c192dd5b289f4140a347f68a78ef906391761345

SHA256
5f6af6d082f5b2f977bcb890d7bcd4569f9ea6e5d061bc9f11524ffdcee5700a

SHA512
197b6691e996f1214ea6bc61f374aa93d4c99771947e4708f272d3e254da9ec139f6517c4d1ed1aac954e1bbc1ad1b498d3bd2ad4e34f0c2a9d2adb911da5a92

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1299.exe

Filesize
696KB

MD5
a8f8c1044e0741600de29021f3bb1c80

SHA1
1f87b77193ea07fa503972178cc7ba76ea8ba982

SHA256
2cf6257e87bf9c44e803834b9030f3199623723ec217e3b167ce371c0d60d230

SHA512
53b9400516a638d59caf0bee4332a972459688ac016c51a4d54a2ec8848e5aa4afcd0cd72ff26fa970348db9b1812d73fbd03e342f4b4b70adbfc4a6cdd43a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1299.exe

Filesize
696KB

MD5
a8f8c1044e0741600de29021f3bb1c80

SHA1
1f87b77193ea07fa503972178cc7ba76ea8ba982

SHA256
2cf6257e87bf9c44e803834b9030f3199623723ec217e3b167ce371c0d60d230

SHA512
53b9400516a638d59caf0bee4332a972459688ac016c51a4d54a2ec8848e5aa4afcd0cd72ff26fa970348db9b1812d73fbd03e342f4b4b70adbfc4a6cdd43a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w85tv05.exe

Filesize
350KB

MD5
f2be8be4df24bb6184a4d70dff7362c3

SHA1
f609a041ee2e3de88b966e2f5f11389fff0e14a6

SHA256
d446dfa20be2cb819cefaa03388300f5ca8514e593f2cc5e8f23b349af3cfbef

SHA512
88221ed4034697d867a385b8b30300b37a9a9424ac66035008c1c8da7c586ac98cb3b626b6660eb3dd2c8a6f0f6a3bbe29013dcb799b717e8cc6ca39adccb009

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w85tv05.exe

Filesize
350KB

MD5
f2be8be4df24bb6184a4d70dff7362c3

SHA1
f609a041ee2e3de88b966e2f5f11389fff0e14a6

SHA256
d446dfa20be2cb819cefaa03388300f5ca8514e593f2cc5e8f23b349af3cfbef

SHA512
88221ed4034697d867a385b8b30300b37a9a9424ac66035008c1c8da7c586ac98cb3b626b6660eb3dd2c8a6f0f6a3bbe29013dcb799b717e8cc6ca39adccb009

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7302.exe

Filesize
345KB

MD5
9dc2d5e1b5fbd9d798b99613ec093702

SHA1
82d86191e944e37de0ab493d86e089ca53aa7cd4

SHA256
2b607a14e95a4cbf105c2293835d335c93313e57099325e25021a6a060a8becc

SHA512
5996c613c027a595e7cd08398ee069b3c0480325ab9d4c8505646034f784dac77ca68f9fb99b61c93fbd0c65550523a598cbc2d834525d459aa41863564580bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7302.exe

Filesize
345KB

MD5
9dc2d5e1b5fbd9d798b99613ec093702

SHA1
82d86191e944e37de0ab493d86e089ca53aa7cd4

SHA256
2b607a14e95a4cbf105c2293835d335c93313e57099325e25021a6a060a8becc

SHA512
5996c613c027a595e7cd08398ee069b3c0480325ab9d4c8505646034f784dac77ca68f9fb99b61c93fbd0c65550523a598cbc2d834525d459aa41863564580bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1670.exe

Filesize
12KB

MD5
4bb96cf0ee2a518368a8a60ec8bc8ba4

SHA1
d5d6923d5279684ccfbf3bf7a2c28f431ff8f425

SHA256
8795c1216cbee8a833f66f735889f923a030dc4e0dc31dd691b3389cade75820

SHA512
9fd96beecf0a7b50bc7979514a71140d50ad58096fbcb79b66ac89c6876780ccacf8d5b93a02560a434ae02a42fabc75a9d618759c94a7466a5753e938950fc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1670.exe

Filesize
12KB

MD5
4bb96cf0ee2a518368a8a60ec8bc8ba4

SHA1
d5d6923d5279684ccfbf3bf7a2c28f431ff8f425

SHA256
8795c1216cbee8a833f66f735889f923a030dc4e0dc31dd691b3389cade75820

SHA512
9fd96beecf0a7b50bc7979514a71140d50ad58096fbcb79b66ac89c6876780ccacf8d5b93a02560a434ae02a42fabc75a9d618759c94a7466a5753e938950fc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9151vo.exe

Filesize
292KB

MD5
956c4dffc97d08dd8b3132743fcd64ec

SHA1
9d2d43742ef28628b1f87967854b8608e8e15252

SHA256
65d2a31debb2e1744cf7a1b5c6edfb92732f2c047d032535cfba89a58c8d9c3c

SHA512
2f61031058e2c2ced8a40b960f406b83e0bf230f3e91bc1209b34a444abb9b40bd3dc857b60019e7f8e259c8edb7bc7aa7e796cfc66f66267ee52008d6340ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9151vo.exe

Filesize
292KB

MD5
956c4dffc97d08dd8b3132743fcd64ec

SHA1
9d2d43742ef28628b1f87967854b8608e8e15252

SHA256
65d2a31debb2e1744cf7a1b5c6edfb92732f2c047d032535cfba89a58c8d9c3c

SHA512
2f61031058e2c2ced8a40b960f406b83e0bf230f3e91bc1209b34a444abb9b40bd3dc857b60019e7f8e259c8edb7bc7aa7e796cfc66f66267ee52008d6340ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
236KB

MD5
04fdc50c2525a9c5d4ae111fd30ee076

SHA1
caca1dc4712fd6468dfa7f44a21716e14bd53287

SHA256
a95db443e490281e278c9298131af211e3bea5d0cf23e5e8bea8a7d42a15e926

SHA512
5d92e0cc228cecaedb0efc67a4f989bca2c2b2648970ba4630b1843c6af59624ca8a4bf52d6e9ec8cd78a09f08493e51dff2c155fb3e1bcf6007bc1416043056

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
236KB

MD5
04fdc50c2525a9c5d4ae111fd30ee076

SHA1
caca1dc4712fd6468dfa7f44a21716e14bd53287

SHA256
a95db443e490281e278c9298131af211e3bea5d0cf23e5e8bea8a7d42a15e926

SHA512
5d92e0cc228cecaedb0efc67a4f989bca2c2b2648970ba4630b1843c6af59624ca8a4bf52d6e9ec8cd78a09f08493e51dff2c155fb3e1bcf6007bc1416043056

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
236KB

MD5
04fdc50c2525a9c5d4ae111fd30ee076

SHA1
caca1dc4712fd6468dfa7f44a21716e14bd53287

SHA256
a95db443e490281e278c9298131af211e3bea5d0cf23e5e8bea8a7d42a15e926

SHA512
5d92e0cc228cecaedb0efc67a4f989bca2c2b2648970ba4630b1843c6af59624ca8a4bf52d6e9ec8cd78a09f08493e51dff2c155fb3e1bcf6007bc1416043056

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe

Filesize
236KB

MD5
04fdc50c2525a9c5d4ae111fd30ee076

SHA1
caca1dc4712fd6468dfa7f44a21716e14bd53287

SHA256
a95db443e490281e278c9298131af211e3bea5d0cf23e5e8bea8a7d42a15e926

SHA512
5d92e0cc228cecaedb0efc67a4f989bca2c2b2648970ba4630b1843c6af59624ca8a4bf52d6e9ec8cd78a09f08493e51dff2c155fb3e1bcf6007bc1416043056

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/220-163-0x000000001B140000-0x000000001B28E000-memory.dmp

Filesize
1.3MB

Download
memory/220-161-0x0000000000620000-0x000000000062A000-memory.dmp

Filesize
40KB

Download
memory/1840-1175-0x0000022ADA900000-0x0000022ADA918000-memory.dmp

Filesize
96KB

Download
memory/1840-1176-0x0000022AF5B40000-0x0000022AF5B90000-memory.dmp

Filesize
320KB

Download
memory/1840-1177-0x0000022AF5BE0000-0x0000022AF5BF0000-memory.dmp

Filesize
64KB

Download
memory/2820-1134-0x0000000006AD0000-0x0000000006FFC000-memory.dmp

Filesize
5.2MB

Download
memory/2820-1128-0x0000000006600000-0x0000000006692000-memory.dmp

Filesize
584KB

Download
memory/2820-1135-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/2820-1133-0x0000000006900000-0x0000000006AC2000-memory.dmp

Filesize
1.8MB

Download
memory/2820-212-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-214-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-211-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-216-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-218-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-220-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-224-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-222-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-226-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-228-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-230-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-234-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-232-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-236-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-238-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-240-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-242-0x00000000028B0000-0x00000000028EE000-memory.dmp

Filesize
248KB

Download
memory/2820-255-0x00000000007F0000-0x000000000083B000-memory.dmp

Filesize
300KB

Download
memory/2820-257-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/2820-258-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/2820-260-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/2820-1121-0x0000000005520000-0x0000000005B38000-memory.dmp

Filesize
6.1MB

Download
memory/2820-1122-0x0000000005B40000-0x0000000005C4A000-memory.dmp

Filesize
1.0MB

Download
memory/2820-1123-0x0000000005C50000-0x0000000005C62000-memory.dmp

Filesize
72KB

Download
memory/2820-1124-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/2820-1125-0x0000000005C70000-0x0000000005CAC000-memory.dmp

Filesize
240KB

Download
memory/2820-1127-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Filesize
408KB

Download
memory/2820-1132-0x0000000006880000-0x00000000068D0000-memory.dmp

Filesize
320KB

Download
memory/2820-1129-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/2820-1130-0x0000000004F60000-0x0000000004F70000-memory.dmp

Filesize
64KB

Download
memory/2820-1131-0x00000000067F0000-0x0000000006866000-memory.dmp

Filesize
472KB

Download
memory/3304-1141-0x0000000000290000-0x00000000002C2000-memory.dmp

Filesize
200KB

Download
memory/3304-1142-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/4004-1195-0x00000271FC380000-0x00000271FC390000-memory.dmp

Filesize
64KB

Download
memory/4004-1194-0x00000271E1230000-0x00000271E128E000-memory.dmp

Filesize
376KB

Download
memory/4580-186-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-180-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-201-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/4580-204-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4580-198-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-196-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-194-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-192-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-190-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-188-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-206-0x0000000000400000-0x000000000070C000-memory.dmp

Filesize
3.0MB

Download
memory/4580-184-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-182-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-200-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-178-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-176-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-174-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-173-0x0000000002740000-0x0000000002752000-memory.dmp

Filesize
72KB

Download
memory/4580-202-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4580-203-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4580-172-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4580-171-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4580-170-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4580-168-0x00000000007E0000-0x000000000080D000-memory.dmp

Filesize
180KB

Download
memory/4580-169-0x0000000004EF0000-0x0000000005494000-memory.dmp

Filesize
5.6MB

Download