amadey | 4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f

Analysis

max time kernel
109s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2023 22:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exe
Size

1.0MB
MD5

42eb4a66e56b8abe59f7b36b9f07b980
SHA1

713434c55941db92804d2f3193e27bbe5c4eb99f
SHA256

4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f
SHA512

61e5aadc99274f7671c9793e079ea5e6f6cb2bc791c9be26111307205f49430f0f4766032882c424df3cf60dadb1fa551ebfc09b5310ff57f0f7a1be2a1e8a64
SSDEEP

24576:ByHU7pdBF4/hZsATtC/DT0+eiDDVzvDgEXzD3o:0eTGhZxTtCreoJvDgEjD3

Score

10^/10

amadey aurora redline nado rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

nado

176.113.115.145:4125

Attributes

auth_value
a648e365d8e0df895a84152ad68ffc56

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Extracted

Family

aurora

212.87.204.93:8081

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Aurora
Aurora is a crypto wallet stealer written in Golang.
stealer aurora

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz3170.exev6947fL.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz3170.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz3170.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz3170.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz3170.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v6947fL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v6947fL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v6947fL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz3170.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz3170.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v6947fL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v6947fL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v6947fL.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1680-209-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-210-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-212-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-214-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-218-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-222-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-224-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-226-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-228-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-230-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-234-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-236-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-232-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-238-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-242-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-244-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-240-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline
behavioral1/memory/1680-246-0x0000000007700000-0x000000000773F000-memory.dmp	family_redline

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y45Yh44.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	y45Yh44.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 12 IoCs

Processes:

zap9479.exezap3345.exezap1511.exetz3170.exev6947fL.exew18vt02.exexmuMJ83.exey45Yh44.exelegenda.exe2023.exew.exelegenda.exe

pid	process
1776	zap9479.exe
3984	zap3345.exe
1564	zap1511.exe
64	tz3170.exe
2296	v6947fL.exe
1680	w18vt02.exe
2900	xmuMJ83.exe
4160	y45Yh44.exe
3948	legenda.exe
3968	2023.exe
1488	w.exe
4728	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4648 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4648	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

v6947fL.exetz3170.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v6947fL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz3170.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v6947fL.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap1511.exew.exe4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exezap9479.exezap3345.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap1511.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows\CurrentVersion\Run	w.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap9479.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap3345.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap1511.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap9479.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap3345.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Updater.exe"	w.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

4448 2296 WerFault.exe v6947fL.exe
2648 1680 WerFault.exe w18vt02.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3364 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz3170.exev6947fL.exew18vt02.exexmuMJ83.exe

pid process

64 tz3170.exe
64 tz3170.exe
2296 v6947fL.exe
2296 v6947fL.exe
1680 w18vt02.exe
1680 w18vt02.exe
2900 xmuMJ83.exe
2900 xmuMJ83.exe

pid	pid_target	process	target process
4448	2296	WerFault.exe	v6947fL.exe
2648	1680	WerFault.exe	w18vt02.exe

pid	process
3364	schtasks.exe

pid	process
64	tz3170.exe
64	tz3170.exe
2296	v6947fL.exe
2296	v6947fL.exe
1680	w18vt02.exe
1680	w18vt02.exe
2900	xmuMJ83.exe
2900	xmuMJ83.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz3170.exev6947fL.exew18vt02.exexmuMJ83.exe

description	pid	process
Token: SeDebugPrivilege	64	tz3170.exe
Token: SeDebugPrivilege	2296	v6947fL.exe
Token: SeDebugPrivilege	1680	w18vt02.exe
Token: SeDebugPrivilege	2900	xmuMJ83.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

w.exe

pid process

1488 w.exe

pid	process
1488	w.exe

Suspicious use of WriteProcessMemory 59 IoCs

Processes:

4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exezap9479.exezap3345.exezap1511.exey45Yh44.exelegenda.execmd.exe

description	pid	process	target process
PID 1628 wrote to memory of 1776	1628	4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exe	zap9479.exe
PID 1628 wrote to memory of 1776	1628	4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exe	zap9479.exe
PID 1628 wrote to memory of 1776	1628	4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exe	zap9479.exe
PID 1776 wrote to memory of 3984	1776	zap9479.exe	zap3345.exe
PID 1776 wrote to memory of 3984	1776	zap9479.exe	zap3345.exe
PID 1776 wrote to memory of 3984	1776	zap9479.exe	zap3345.exe
PID 3984 wrote to memory of 1564	3984	zap3345.exe	zap1511.exe
PID 3984 wrote to memory of 1564	3984	zap3345.exe	zap1511.exe
PID 3984 wrote to memory of 1564	3984	zap3345.exe	zap1511.exe
PID 1564 wrote to memory of 64	1564	zap1511.exe	tz3170.exe
PID 1564 wrote to memory of 64	1564	zap1511.exe	tz3170.exe
PID 1564 wrote to memory of 2296	1564	zap1511.exe	v6947fL.exe
PID 1564 wrote to memory of 2296	1564	zap1511.exe	v6947fL.exe
PID 1564 wrote to memory of 2296	1564	zap1511.exe	v6947fL.exe
PID 3984 wrote to memory of 1680	3984	zap3345.exe	w18vt02.exe
PID 3984 wrote to memory of 1680	3984	zap3345.exe	w18vt02.exe
PID 3984 wrote to memory of 1680	3984	zap3345.exe	w18vt02.exe
PID 1776 wrote to memory of 2900	1776	zap9479.exe	xmuMJ83.exe
PID 1776 wrote to memory of 2900	1776	zap9479.exe	xmuMJ83.exe
PID 1776 wrote to memory of 2900	1776	zap9479.exe	xmuMJ83.exe
PID 1628 wrote to memory of 4160	1628	4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exe	y45Yh44.exe
PID 1628 wrote to memory of 4160	1628	4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exe	y45Yh44.exe
PID 1628 wrote to memory of 4160	1628	4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exe	y45Yh44.exe
PID 4160 wrote to memory of 3948	4160	y45Yh44.exe	legenda.exe
PID 4160 wrote to memory of 3948	4160	y45Yh44.exe	legenda.exe
PID 4160 wrote to memory of 3948	4160	y45Yh44.exe	legenda.exe
PID 3948 wrote to memory of 3364	3948	legenda.exe	schtasks.exe
PID 3948 wrote to memory of 3364	3948	legenda.exe	schtasks.exe
PID 3948 wrote to memory of 3364	3948	legenda.exe	schtasks.exe
PID 3948 wrote to memory of 1980	3948	legenda.exe	cmd.exe
PID 3948 wrote to memory of 1980	3948	legenda.exe	cmd.exe
PID 3948 wrote to memory of 1980	3948	legenda.exe	cmd.exe
PID 1980 wrote to memory of 3784	1980	cmd.exe	cmd.exe
PID 1980 wrote to memory of 3784	1980	cmd.exe	cmd.exe
PID 1980 wrote to memory of 3784	1980	cmd.exe	cmd.exe
PID 1980 wrote to memory of 2804	1980	cmd.exe	cacls.exe
PID 1980 wrote to memory of 2804	1980	cmd.exe	cacls.exe
PID 1980 wrote to memory of 2804	1980	cmd.exe	cacls.exe
PID 1980 wrote to memory of 4264	1980	cmd.exe	cacls.exe
PID 1980 wrote to memory of 4264	1980	cmd.exe	cacls.exe
PID 1980 wrote to memory of 4264	1980	cmd.exe	cacls.exe
PID 1980 wrote to memory of 3728	1980	cmd.exe	cmd.exe
PID 1980 wrote to memory of 3728	1980	cmd.exe	cmd.exe
PID 1980 wrote to memory of 3728	1980	cmd.exe	cmd.exe
PID 1980 wrote to memory of 4052	1980	cmd.exe	cacls.exe
PID 1980 wrote to memory of 4052	1980	cmd.exe	cacls.exe
PID 1980 wrote to memory of 4052	1980	cmd.exe	cacls.exe
PID 1980 wrote to memory of 4000	1980	cmd.exe	cacls.exe
PID 1980 wrote to memory of 4000	1980	cmd.exe	cacls.exe
PID 1980 wrote to memory of 4000	1980	cmd.exe	cacls.exe
PID 3948 wrote to memory of 3968	3948	legenda.exe	2023.exe
PID 3948 wrote to memory of 3968	3948	legenda.exe	2023.exe
PID 3948 wrote to memory of 3968	3948	legenda.exe	2023.exe
PID 3948 wrote to memory of 1488	3948	legenda.exe	w.exe
PID 3948 wrote to memory of 1488	3948	legenda.exe	w.exe
PID 3948 wrote to memory of 1488	3948	legenda.exe	w.exe
PID 3948 wrote to memory of 4648	3948	legenda.exe	rundll32.exe
PID 3948 wrote to memory of 4648	3948	legenda.exe	rundll32.exe
PID 3948 wrote to memory of 4648	3948	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exe
"C:\Users\Admin\AppData\Local\Temp\4867365e5662d18ff0c1a414b74b9fc2adb852b48ce523d4497f104f02e4d84f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1628

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9479.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9479.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1776

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3345.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3345.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3984

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1511.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1511.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3170.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3170.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:64

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6947fL.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6947fL.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 1084
6⤵
- Program crash
PID:4448

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w18vt02.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w18vt02.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 1972
5⤵
- Program crash
PID:2648

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xmuMJ83.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xmuMJ83.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2900

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y45Yh44.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y45Yh44.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:3364

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3784

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:2804

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:4264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:3728

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:4052

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:4000

C:\Users\Admin\AppData\Local\Temp\1000213001\2023.exe
"C:\Users\Admin\AppData\Local\Temp\1000213001\2023.exe"
4⤵
- Executes dropped EXE
PID:3968

C:\Users\Admin\AppData\Local\Temp\1000214001\w.exe
"C:\Users\Admin\AppData\Local\Temp\1000214001\w.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:1488

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2296 -ip 2296
1⤵
PID:652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1680 -ip 1680
1⤵
PID:3008

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:4728

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000213001\2023.exe
Filesize
3.1MB

MD5
027a60b4337dd0847d0414aa8719ffec

SHA1
80f78f880e891adfa8f71fb1447ed19734077062

SHA256
3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168

SHA512
009703b2c57258ccec76aa97807976e3ad693f3ff90b5417ae920e5860354bdaf4b01caaa850f1996391da5b6d75ebc38509a9b124fd9ae0660d7002b54b606d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000213001\2023.exe
Filesize
3.1MB

MD5
027a60b4337dd0847d0414aa8719ffec

SHA1
80f78f880e891adfa8f71fb1447ed19734077062

SHA256
3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168

SHA512
009703b2c57258ccec76aa97807976e3ad693f3ff90b5417ae920e5860354bdaf4b01caaa850f1996391da5b6d75ebc38509a9b124fd9ae0660d7002b54b606d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000213001\2023.exe
Filesize
3.1MB

MD5
027a60b4337dd0847d0414aa8719ffec

SHA1
80f78f880e891adfa8f71fb1447ed19734077062

SHA256
3dbde13894aa65f33217ab351dd3f5c4fb54d570b3371fef1505a7370aab4168

SHA512
009703b2c57258ccec76aa97807976e3ad693f3ff90b5417ae920e5860354bdaf4b01caaa850f1996391da5b6d75ebc38509a9b124fd9ae0660d7002b54b606d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000214001\w.exe
Filesize
16KB

MD5
c200ea136a598e37eb83c8c6031b3f29

SHA1
51ff8101eea8d51a6178635ed26c19678a3d8aa3

SHA256
3b04548e24bcb504a04734a24d47d7f880ca12c5575478d823d27020aea721f8

SHA512
14cc2786c2cb7f7ab87dcb180be9e6962d833c9622aa8facf73b65fd2cf0ccd6ce8bde894cd9dcfef225f9290203fe429007f9e722a2602ecc5ee9bc6e869fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000214001\w.exe
Filesize
16KB

MD5
c200ea136a598e37eb83c8c6031b3f29

SHA1
51ff8101eea8d51a6178635ed26c19678a3d8aa3

SHA256
3b04548e24bcb504a04734a24d47d7f880ca12c5575478d823d27020aea721f8

SHA512
14cc2786c2cb7f7ab87dcb180be9e6962d833c9622aa8facf73b65fd2cf0ccd6ce8bde894cd9dcfef225f9290203fe429007f9e722a2602ecc5ee9bc6e869fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000214001\w.exe
Filesize
16KB

MD5
c200ea136a598e37eb83c8c6031b3f29

SHA1
51ff8101eea8d51a6178635ed26c19678a3d8aa3

SHA256
3b04548e24bcb504a04734a24d47d7f880ca12c5575478d823d27020aea721f8

SHA512
14cc2786c2cb7f7ab87dcb180be9e6962d833c9622aa8facf73b65fd2cf0ccd6ce8bde894cd9dcfef225f9290203fe429007f9e722a2602ecc5ee9bc6e869fc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y45Yh44.exe
Filesize
235KB

MD5
2242b8c29bd18a7770ce3591fbb2a1f2

SHA1
aeecb54187d2198aa0e322af89780194fb0f11d2

SHA256
5e67903e5500f2a33939d77c82e1bbbc09a149ff9ad189c6f018e636d69194af

SHA512
67fb9bed966b5d9ed701a4b45c170bdfc387ad895b4dcb5165afb8ee9a49c5a186bcfe2bd6d536dc2ec7bd4f1d720a8f8ef6c46b0bd7d6982e8b91ede054f7ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y45Yh44.exe
Filesize
235KB

MD5
2242b8c29bd18a7770ce3591fbb2a1f2

SHA1
aeecb54187d2198aa0e322af89780194fb0f11d2

SHA256
5e67903e5500f2a33939d77c82e1bbbc09a149ff9ad189c6f018e636d69194af

SHA512
67fb9bed966b5d9ed701a4b45c170bdfc387ad895b4dcb5165afb8ee9a49c5a186bcfe2bd6d536dc2ec7bd4f1d720a8f8ef6c46b0bd7d6982e8b91ede054f7ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9479.exe
Filesize
872KB

MD5
c961410f1220ad64276aec35947da94b

SHA1
4cd12abf3bad659b8b731b7719c030662efcc116

SHA256
9567896475482bf7e523803e53983175f8f4a4ae72a7aee78099433029e6d014

SHA512
3b2b771f62872c1ab109741b144d3ebce9a40b5014f7485fbab028d123b3cdb60dff71ac2fffd6ee24389b9ebc1093f0a831ff8b029f401371d0caf884d96049

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap9479.exe
Filesize
872KB

MD5
c961410f1220ad64276aec35947da94b

SHA1
4cd12abf3bad659b8b731b7719c030662efcc116

SHA256
9567896475482bf7e523803e53983175f8f4a4ae72a7aee78099433029e6d014

SHA512
3b2b771f62872c1ab109741b144d3ebce9a40b5014f7485fbab028d123b3cdb60dff71ac2fffd6ee24389b9ebc1093f0a831ff8b029f401371d0caf884d96049

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xmuMJ83.exe
Filesize
175KB

MD5
1627e8a815a4c8e61906c71ec3ff9e6e

SHA1
244c1400a7b154cb426f2bbec1db92c0f56277fc

SHA256
90cc5832513047ab7c3dd7d945f47c56fefd5f50c890e1d9957919ee6a02f868

SHA512
34f279829b85a90b465904d43439d95cd000e49b24cdc310cf0a4e3c15aa5c1b68c5481619c710520fa25760658167b470081706db215d5e1b3d622f57038099

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xmuMJ83.exe
Filesize
175KB

MD5
1627e8a815a4c8e61906c71ec3ff9e6e

SHA1
244c1400a7b154cb426f2bbec1db92c0f56277fc

SHA256
90cc5832513047ab7c3dd7d945f47c56fefd5f50c890e1d9957919ee6a02f868

SHA512
34f279829b85a90b465904d43439d95cd000e49b24cdc310cf0a4e3c15aa5c1b68c5481619c710520fa25760658167b470081706db215d5e1b3d622f57038099

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3345.exe
Filesize
730KB

MD5
efc8c20e1000fa95ad8e73bf7a590a5c

SHA1
c39dae952eec3fd4b0d03fff14d342ff1fc0ec59

SHA256
6cf9e3b904b488771d60be1531d4ebc8adbc72a6e62fe6a03ca4672bae13a1c3

SHA512
e9e3b69ba39527b7a50d38f826160392161ecc9e9d5b3b8ab988921afb7c7a74f87e4b2e68a4cf8b46f5acd3788419e2a7153d964b408bf80e4c22392afa4024

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3345.exe
Filesize
730KB

MD5
efc8c20e1000fa95ad8e73bf7a590a5c

SHA1
c39dae952eec3fd4b0d03fff14d342ff1fc0ec59

SHA256
6cf9e3b904b488771d60be1531d4ebc8adbc72a6e62fe6a03ca4672bae13a1c3

SHA512
e9e3b69ba39527b7a50d38f826160392161ecc9e9d5b3b8ab988921afb7c7a74f87e4b2e68a4cf8b46f5acd3788419e2a7153d964b408bf80e4c22392afa4024

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w18vt02.exe
Filesize
403KB

MD5
4b56efe82d7041e8c58728598c4a89ca

SHA1
6fdd614612018cbac45d8a648f92f62a968fe3e1

SHA256
793744d74d0e11606b2256d168507544aed8443b1798c41092b0760f0abac37e

SHA512
80fedd2879524e614298fe5ee6f2a1e6fb9c317638d45469f241b8b2d3b15355753fd8bb29358b9c996ed4d0834d4c0efcafcf811569d941bf0a46c610eccdf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w18vt02.exe
Filesize
403KB

MD5
4b56efe82d7041e8c58728598c4a89ca

SHA1
6fdd614612018cbac45d8a648f92f62a968fe3e1

SHA256
793744d74d0e11606b2256d168507544aed8443b1798c41092b0760f0abac37e

SHA512
80fedd2879524e614298fe5ee6f2a1e6fb9c317638d45469f241b8b2d3b15355753fd8bb29358b9c996ed4d0834d4c0efcafcf811569d941bf0a46c610eccdf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1511.exe
Filesize
362KB

MD5
0b114027440fb9ec63eba0c2f6fb5d1a

SHA1
41eb3db609fecbae8f8d64193e29e3cb477a07f3

SHA256
770bb2eace7a5544f2d352279aaa94ed3a80a0aac3bae59af4f0af53cac7eb6c

SHA512
142e348fc2c8615f9fa465eeefbf731885fcaa70f0c2448db650bb7f95185758a03a1be1869356db51d67019a4ad0aee20ae9dd5bd99b1317f1e5d5d81669846

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap1511.exe
Filesize
362KB

MD5
0b114027440fb9ec63eba0c2f6fb5d1a

SHA1
41eb3db609fecbae8f8d64193e29e3cb477a07f3

SHA256
770bb2eace7a5544f2d352279aaa94ed3a80a0aac3bae59af4f0af53cac7eb6c

SHA512
142e348fc2c8615f9fa465eeefbf731885fcaa70f0c2448db650bb7f95185758a03a1be1869356db51d67019a4ad0aee20ae9dd5bd99b1317f1e5d5d81669846

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3170.exe
Filesize
12KB

MD5
62232ac48f2f5cd7e7d16a58a261a585

SHA1
d0a05d00bf83381418dd0796882f2f81ad1db6f5

SHA256
22dbed9ae2d549738f4e4687ea5e5a00a6d1f2ff57bbb3f3e9789d44cbc0717a

SHA512
f2ab4768743b27caa2ed596d12d6404ee06ed587bd9c96551bc53238f2b4d136b9f1a9bcc56ddd59f7ecd2c3aabed3f0f04314ac99eb3c27c42f25cad4711782

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3170.exe
Filesize
12KB

MD5
62232ac48f2f5cd7e7d16a58a261a585

SHA1
d0a05d00bf83381418dd0796882f2f81ad1db6f5

SHA256
22dbed9ae2d549738f4e4687ea5e5a00a6d1f2ff57bbb3f3e9789d44cbc0717a

SHA512
f2ab4768743b27caa2ed596d12d6404ee06ed587bd9c96551bc53238f2b4d136b9f1a9bcc56ddd59f7ecd2c3aabed3f0f04314ac99eb3c27c42f25cad4711782

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6947fL.exe
Filesize
345KB

MD5
1312227c747a143d37d4bd8475fede13

SHA1
a0211f67b2ea44eb1599d4a1641691251a15b1e1

SHA256
cf49f50dc7eb18cdf0474c7efcab72980bdd66248c4ccc7a1630747a847cb858

SHA512
6c56aa6a62faf5f41a9d7b60fa1fbef5122ee11eb593cd90475d2b421315a2adcbd9b23f9b87f64dcda0fda632b9f56fabc67b990fba6ef1b0549408f6ad6ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v6947fL.exe
Filesize
345KB

MD5
1312227c747a143d37d4bd8475fede13

SHA1
a0211f67b2ea44eb1599d4a1641691251a15b1e1

SHA256
cf49f50dc7eb18cdf0474c7efcab72980bdd66248c4ccc7a1630747a847cb858

SHA512
6c56aa6a62faf5f41a9d7b60fa1fbef5122ee11eb593cd90475d2b421315a2adcbd9b23f9b87f64dcda0fda632b9f56fabc67b990fba6ef1b0549408f6ad6ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
2242b8c29bd18a7770ce3591fbb2a1f2

SHA1
aeecb54187d2198aa0e322af89780194fb0f11d2

SHA256
5e67903e5500f2a33939d77c82e1bbbc09a149ff9ad189c6f018e636d69194af

SHA512
67fb9bed966b5d9ed701a4b45c170bdfc387ad895b4dcb5165afb8ee9a49c5a186bcfe2bd6d536dc2ec7bd4f1d720a8f8ef6c46b0bd7d6982e8b91ede054f7ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
2242b8c29bd18a7770ce3591fbb2a1f2

SHA1
aeecb54187d2198aa0e322af89780194fb0f11d2

SHA256
5e67903e5500f2a33939d77c82e1bbbc09a149ff9ad189c6f018e636d69194af

SHA512
67fb9bed966b5d9ed701a4b45c170bdfc387ad895b4dcb5165afb8ee9a49c5a186bcfe2bd6d536dc2ec7bd4f1d720a8f8ef6c46b0bd7d6982e8b91ede054f7ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
2242b8c29bd18a7770ce3591fbb2a1f2

SHA1
aeecb54187d2198aa0e322af89780194fb0f11d2

SHA256
5e67903e5500f2a33939d77c82e1bbbc09a149ff9ad189c6f018e636d69194af

SHA512
67fb9bed966b5d9ed701a4b45c170bdfc387ad895b4dcb5165afb8ee9a49c5a186bcfe2bd6d536dc2ec7bd4f1d720a8f8ef6c46b0bd7d6982e8b91ede054f7ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
2242b8c29bd18a7770ce3591fbb2a1f2

SHA1
aeecb54187d2198aa0e322af89780194fb0f11d2

SHA256
5e67903e5500f2a33939d77c82e1bbbc09a149ff9ad189c6f018e636d69194af

SHA512
67fb9bed966b5d9ed701a4b45c170bdfc387ad895b4dcb5165afb8ee9a49c5a186bcfe2bd6d536dc2ec7bd4f1d720a8f8ef6c46b0bd7d6982e8b91ede054f7ac

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/64-161-0x0000000000F90000-0x0000000000F9A000-memory.dmp

Filesize
40KB

Download
memory/1680-1130-0x0000000008C90000-0x0000000008E52000-memory.dmp

Filesize
1.8MB

Download
memory/1680-1122-0x00000000046B0000-0x00000000046C0000-memory.dmp

Filesize
64KB

Download
memory/1680-1134-0x00000000046B0000-0x00000000046C0000-memory.dmp

Filesize
64KB

Download
memory/1680-1133-0x0000000009560000-0x00000000095B0000-memory.dmp

Filesize
320KB

Download
memory/1680-1132-0x00000000094E0000-0x0000000009556000-memory.dmp

Filesize
472KB

Download
memory/1680-1131-0x0000000008E60000-0x000000000938C000-memory.dmp

Filesize
5.2MB

Download
memory/1680-209-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-210-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-212-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-214-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-215-0x0000000002CA0000-0x0000000002CEB000-memory.dmp

Filesize
300KB

Download
memory/1680-217-0x00000000046B0000-0x00000000046C0000-memory.dmp

Filesize
64KB

Download
memory/1680-221-0x00000000046B0000-0x00000000046C0000-memory.dmp

Filesize
64KB

Download
memory/1680-218-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-220-0x00000000046B0000-0x00000000046C0000-memory.dmp

Filesize
64KB

Download
memory/1680-222-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-224-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-226-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-228-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-230-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-234-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-236-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-232-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-238-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-242-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-244-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-240-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-246-0x0000000007700000-0x000000000773F000-memory.dmp

Filesize
252KB

Download
memory/1680-1119-0x00000000078E0000-0x0000000007EF8000-memory.dmp

Filesize
6.1MB

Download
memory/1680-1120-0x0000000007F80000-0x000000000808A000-memory.dmp

Filesize
1.0MB

Download
memory/1680-1121-0x00000000080C0000-0x00000000080D2000-memory.dmp

Filesize
72KB

Download
memory/1680-1129-0x00000000046B0000-0x00000000046C0000-memory.dmp

Filesize
64KB

Download
memory/1680-1123-0x00000000080E0000-0x000000000811C000-memory.dmp

Filesize
240KB

Download
memory/1680-1125-0x00000000083D0000-0x0000000008436000-memory.dmp

Filesize
408KB

Download
memory/1680-1126-0x0000000008BA0000-0x0000000008C32000-memory.dmp

Filesize
584KB

Download
memory/1680-1127-0x00000000046B0000-0x00000000046C0000-memory.dmp

Filesize
64KB

Download
memory/1680-1128-0x00000000046B0000-0x00000000046C0000-memory.dmp

Filesize
64KB

Download
memory/2296-191-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-167-0x0000000007280000-0x0000000007824000-memory.dmp

Filesize
5.6MB

Download
memory/2296-203-0x0000000007270000-0x0000000007280000-memory.dmp

Filesize
64KB

Download
memory/2296-200-0x0000000000400000-0x0000000002B83000-memory.dmp

Filesize
39.5MB

Download
memory/2296-204-0x0000000000400000-0x0000000002B83000-memory.dmp

Filesize
39.5MB

Download
memory/2296-202-0x0000000007270000-0x0000000007280000-memory.dmp

Filesize
64KB

Download
memory/2296-198-0x0000000007270000-0x0000000007280000-memory.dmp

Filesize
64KB

Download
memory/2296-199-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-192-0x0000000002B90000-0x0000000002BBD000-memory.dmp

Filesize
180KB

Download
memory/2296-168-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-169-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-195-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-194-0x0000000007270000-0x0000000007280000-memory.dmp

Filesize
64KB

Download
memory/2296-196-0x0000000007270000-0x0000000007280000-memory.dmp

Filesize
64KB

Download
memory/2296-175-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-187-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-185-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-183-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-181-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-179-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-177-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-189-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-173-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2296-171-0x00000000070F0000-0x0000000007102000-memory.dmp

Filesize
72KB

Download
memory/2900-1142-0x0000000005030000-0x0000000005040000-memory.dmp

Filesize
64KB

Download
memory/2900-1141-0x0000000005030000-0x0000000005040000-memory.dmp

Filesize
64KB

Download
memory/2900-1140-0x00000000007A0000-0x00000000007D2000-memory.dmp

Filesize
200KB

Download