amadey | 6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7

Analysis

max time kernel
141s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2023, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe
Size

1.4MB
MD5

c874fc37572082c6567b01db076e6fe7
SHA1

f0cf760a8b93924eed418f0121e2791df59ce2e7
SHA256

6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7
SHA512

0577854d57d32bb731f748fbf2379d1dcf4b20b21d22b0a2bde75b9012fd2058568042d5bf50475e12dc0208864b2fc7aef1ad2cf3bbf96ab9075ed7b00451c0
SSDEEP

24576:N8si5N60tKXs8DhM/HGEbA5PQlgBI/mPJEqJQurSOE6FgvW6KSA7vs:45M8BvGEcPQ+B9PJkuRdxnrs

Score

10^/10

amadey healer dropper evasion persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral1/memory/896-39-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	t9286576.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	w9928732.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 16 IoCs

pid	Process
1692	z8907605.exe
4476	z2863361.exe
3024	z9044481.exe
1804	z1938088.exe
3968	q1473912.exe
4148	r8864827.exe
2516	s4619288.exe
4480	t9286576.exe
5028	explonde.exe
1940	u6973167.exe
3148	w9928732.exe
4400	legota.exe
1988	explonde.exe
384	legota.exe
2100	explonde.exe
1880	legota.exe

Loads dropped DLL 2 IoCs

pid	Process
3732	rundll32.exe
2564	rundll32.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z9044481.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z1938088.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	AppLaunch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z8907605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z2863361.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 4428 set thread context of 3100	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	86
PID 3968 set thread context of 896	3968	q1473912.exe	94
PID 4148 set thread context of 4296	4148	r8864827.exe	97

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4996	2516	WerFault.exe	99
216	4296	WerFault.exe	97
4396	1940	WerFault.exe	107

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
540	schtasks.exe
1204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
896	AppLaunch.exe
896	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	896	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 1480	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	85
PID 4428 wrote to memory of 1480	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	85
PID 4428 wrote to memory of 1480	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	85
PID 4428 wrote to memory of 3100	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	86
PID 4428 wrote to memory of 3100	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	86
PID 4428 wrote to memory of 3100	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	86
PID 4428 wrote to memory of 3100	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	86
PID 4428 wrote to memory of 3100	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	86
PID 4428 wrote to memory of 3100	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	86
PID 4428 wrote to memory of 3100	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	86
PID 4428 wrote to memory of 3100	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	86
PID 4428 wrote to memory of 3100	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	86
PID 4428 wrote to memory of 3100	4428	6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe	86
PID 3100 wrote to memory of 1692	3100	AppLaunch.exe	87
PID 3100 wrote to memory of 1692	3100	AppLaunch.exe	87
PID 3100 wrote to memory of 1692	3100	AppLaunch.exe	87
PID 1692 wrote to memory of 4476	1692	z8907605.exe	88
PID 1692 wrote to memory of 4476	1692	z8907605.exe	88
PID 1692 wrote to memory of 4476	1692	z8907605.exe	88
PID 4476 wrote to memory of 3024	4476	z2863361.exe	89
PID 4476 wrote to memory of 3024	4476	z2863361.exe	89
PID 4476 wrote to memory of 3024	4476	z2863361.exe	89
PID 3024 wrote to memory of 1804	3024	z9044481.exe	90
PID 3024 wrote to memory of 1804	3024	z9044481.exe	90
PID 3024 wrote to memory of 1804	3024	z9044481.exe	90
PID 1804 wrote to memory of 3968	1804	z1938088.exe	91
PID 1804 wrote to memory of 3968	1804	z1938088.exe	91
PID 1804 wrote to memory of 3968	1804	z1938088.exe	91
PID 3968 wrote to memory of 2328	3968	q1473912.exe	93
PID 3968 wrote to memory of 2328	3968	q1473912.exe	93
PID 3968 wrote to memory of 2328	3968	q1473912.exe	93
PID 3968 wrote to memory of 896	3968	q1473912.exe	94
PID 3968 wrote to memory of 896	3968	q1473912.exe	94
PID 3968 wrote to memory of 896	3968	q1473912.exe	94
PID 3968 wrote to memory of 896	3968	q1473912.exe	94
PID 3968 wrote to memory of 896	3968	q1473912.exe	94
PID 3968 wrote to memory of 896	3968	q1473912.exe	94
PID 3968 wrote to memory of 896	3968	q1473912.exe	94
PID 3968 wrote to memory of 896	3968	q1473912.exe	94
PID 1804 wrote to memory of 4148	1804	z1938088.exe	95
PID 1804 wrote to memory of 4148	1804	z1938088.exe	95
PID 1804 wrote to memory of 4148	1804	z1938088.exe	95
PID 4148 wrote to memory of 4296	4148	r8864827.exe	97
PID 4148 wrote to memory of 4296	4148	r8864827.exe	97
PID 4148 wrote to memory of 4296	4148	r8864827.exe	97
PID 4148 wrote to memory of 4296	4148	r8864827.exe	97
PID 4148 wrote to memory of 4296	4148	r8864827.exe	97
PID 4148 wrote to memory of 4296	4148	r8864827.exe	97
PID 4148 wrote to memory of 4296	4148	r8864827.exe	97
PID 4148 wrote to memory of 4296	4148	r8864827.exe	97
PID 4148 wrote to memory of 4296	4148	r8864827.exe	97
PID 4148 wrote to memory of 4296	4148	r8864827.exe	97
PID 3024 wrote to memory of 2516	3024	z9044481.exe	99
PID 3024 wrote to memory of 2516	3024	z9044481.exe	99
PID 3024 wrote to memory of 2516	3024	z9044481.exe	99
PID 4476 wrote to memory of 4480	4476	z2863361.exe	105
PID 4476 wrote to memory of 4480	4476	z2863361.exe	105
PID 4476 wrote to memory of 4480	4476	z2863361.exe	105
PID 4480 wrote to memory of 5028	4480	t9286576.exe	106
PID 4480 wrote to memory of 5028	4480	t9286576.exe	106
PID 4480 wrote to memory of 5028	4480	t9286576.exe	106
PID 1692 wrote to memory of 1940	1692	z8907605.exe	107
PID 1692 wrote to memory of 1940	1692	z8907605.exe	107
PID 1692 wrote to memory of 1940	1692	z8907605.exe	107

C:\Users\Admin\AppData\Local\Temp\6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe
"C:\Users\Admin\AppData\Local\Temp\6d32b8f6f370f85d6e6627e821c47d1151875a8872449d7f5d46855034deecb7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:1480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8907605.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8907605.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2863361.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2863361.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9044481.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9044481.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1938088.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1938088.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1473912.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1473912.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:2328
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:896
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8864827.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8864827.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4296 -s 540
        9⤵
        Program crash
        
        PID:216
      - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4619288.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4619288.exe
        6⤵
        Executes dropped EXE
        
        PID:2516
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2516 -s 560
        7⤵
        Program crash
        
        PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9286576.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9286576.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:540
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        7⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        8⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        8⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        8⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        8⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        7⤵
        Loads dropped DLL
        
        PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6973167.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6973167.exe
      4⤵
      Executes dropped EXE
      PID:1940
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 560
        5⤵
        Program crash
        
        PID:4396
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9928732.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9928732.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3148
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:4400
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:1204
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:3280
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2568
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:3544
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:3452
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2360
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:4184
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:4136
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:2564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4296 -ip 4296
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2516 -ip 2516
1⤵
PID:1532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1940 -ip 1940
1⤵
PID:4700

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1988

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:384

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:2100

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:1880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9928732.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9928732.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8907605.exe

Filesize
1.0MB

MD5
2fca7838c41a71a4b1bf988371285b61

SHA1
84f65e6638dbd34381a3fa1e20dc0b4efdd1d0be

SHA256
244364dd708280e1a0e6697874355411df7c780103e562280bb78b3e0c88ac4d

SHA512
8f5ef16f9ed10d0cbcf12ad89fc73205693142f24ce392f579507a31bc646a3a0e9195aee175479b14f0d51f42512e12d6fe35fe3674e26c91eb25d3ea5c0684

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8907605.exe

Filesize
1.0MB

MD5
2fca7838c41a71a4b1bf988371285b61

SHA1
84f65e6638dbd34381a3fa1e20dc0b4efdd1d0be

SHA256
244364dd708280e1a0e6697874355411df7c780103e562280bb78b3e0c88ac4d

SHA512
8f5ef16f9ed10d0cbcf12ad89fc73205693142f24ce392f579507a31bc646a3a0e9195aee175479b14f0d51f42512e12d6fe35fe3674e26c91eb25d3ea5c0684

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6973167.exe

Filesize
399KB

MD5
b60679e2c715761477cf99dbecc5da79

SHA1
eda9713cdf4a6bcd7933ab7d94d744c8e904dc69

SHA256
a52b33d4aaf3337f504bfacfd2a2e3f407e30f8faf12de8db5874de42b93328e

SHA512
ceb734aed32e9a470965c893e6c400c0d92a536d916f382d580c32c84ebee6d769887d95785a1e39039951e31114da2aaa36f361a91c7aaa1f18e16a7de1ea3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6973167.exe

Filesize
399KB

MD5
b60679e2c715761477cf99dbecc5da79

SHA1
eda9713cdf4a6bcd7933ab7d94d744c8e904dc69

SHA256
a52b33d4aaf3337f504bfacfd2a2e3f407e30f8faf12de8db5874de42b93328e

SHA512
ceb734aed32e9a470965c893e6c400c0d92a536d916f382d580c32c84ebee6d769887d95785a1e39039951e31114da2aaa36f361a91c7aaa1f18e16a7de1ea3b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2863361.exe

Filesize
784KB

MD5
7383c9eaa3722c707b475c295ad9eeff

SHA1
976614e94f47d4505432e90694f4b03df867788b

SHA256
1f6276687a73de689f65f05d3aa4b5956297c5755740f07f6366821a42472576

SHA512
3e043832c58602c697f95251fac184f142d73933bc5fbe56b2dae3dd8fb930881ec0f06176076bf75103444ac685ae980ae303c4c004e8855e3b0c3dc079945c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2863361.exe

Filesize
784KB

MD5
7383c9eaa3722c707b475c295ad9eeff

SHA1
976614e94f47d4505432e90694f4b03df867788b

SHA256
1f6276687a73de689f65f05d3aa4b5956297c5755740f07f6366821a42472576

SHA512
3e043832c58602c697f95251fac184f142d73933bc5fbe56b2dae3dd8fb930881ec0f06176076bf75103444ac685ae980ae303c4c004e8855e3b0c3dc079945c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9286576.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9286576.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9044481.exe

Filesize
601KB

MD5
18e14e5e0aacde2e9354a1073112c455

SHA1
9674c73be4c00c09270794263c6e3f4c5d8b22aa

SHA256
8e47d81f5bdec9744529ddef725abc0c4892dd6749655c3c51ea65ff30046d61

SHA512
b89bf5f7a52c721d9f6b56139f98f95adadcd2990bdedb0303ebb5fc1bf556ba2d945ff0ce15453ec10702f143a32e662408b6b912bee0040d7cfd180f1de1e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9044481.exe

Filesize
601KB

MD5
18e14e5e0aacde2e9354a1073112c455

SHA1
9674c73be4c00c09270794263c6e3f4c5d8b22aa

SHA256
8e47d81f5bdec9744529ddef725abc0c4892dd6749655c3c51ea65ff30046d61

SHA512
b89bf5f7a52c721d9f6b56139f98f95adadcd2990bdedb0303ebb5fc1bf556ba2d945ff0ce15453ec10702f143a32e662408b6b912bee0040d7cfd180f1de1e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4619288.exe

Filesize
255KB

MD5
0ba435efc75775522ff1435eab7068c4

SHA1
0d5673177a5e6a19bfabf69d88de24dbde97016c

SHA256
a1ef9c1186b012b0c0a1536aebc277e10148654465cb66c5d7627a7752c5db51

SHA512
44e8bd0c93cd2525235040894a49f5ff3135a23aed6b64e2db7796a539a7d95f6dac7ca28107d4b77fa1a1df95283cce12c0b461a2e36a41d5fb3bbdd6e1fded

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4619288.exe

Filesize
255KB

MD5
0ba435efc75775522ff1435eab7068c4

SHA1
0d5673177a5e6a19bfabf69d88de24dbde97016c

SHA256
a1ef9c1186b012b0c0a1536aebc277e10148654465cb66c5d7627a7752c5db51

SHA512
44e8bd0c93cd2525235040894a49f5ff3135a23aed6b64e2db7796a539a7d95f6dac7ca28107d4b77fa1a1df95283cce12c0b461a2e36a41d5fb3bbdd6e1fded

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1938088.exe

Filesize
363KB

MD5
ec74c19a93f267fbe1f0797d1d29f94f

SHA1
41eba113b341ba80b8c47cf1444abadc918bf0ee

SHA256
ef8feafd809657236ebbf0d707d2e4a12fa3c2896b2d81c63cb01f8504727765

SHA512
83b2715e01d1a9b6ddf4899a93d9bf8357ab22c8c486db69a6f0de94d87763ea2732f30af61590f21d6c477263006d19f8dd289167a036f86db58f21e2a58c21

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1938088.exe

Filesize
363KB

MD5
ec74c19a93f267fbe1f0797d1d29f94f

SHA1
41eba113b341ba80b8c47cf1444abadc918bf0ee

SHA256
ef8feafd809657236ebbf0d707d2e4a12fa3c2896b2d81c63cb01f8504727765

SHA512
83b2715e01d1a9b6ddf4899a93d9bf8357ab22c8c486db69a6f0de94d87763ea2732f30af61590f21d6c477263006d19f8dd289167a036f86db58f21e2a58c21

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1473912.exe

Filesize
236KB

MD5
17a6daa364e5518b016c7f23531c79e1

SHA1
a95d12e2a27fdb026737a5a3b16f1cb07595e55c

SHA256
e255b495265c74209567d5862a10e8e358031202c2e60856cfc7aa54cc5813c9

SHA512
aea93e70e6d08fede6602a36d2c54a284a10debac141e121d4b167c7c7da0c28cfcaa5987cdd74d6cfdc32b902250acc1c25f82dab0493ead7faef1518ef9fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1473912.exe

Filesize
236KB

MD5
17a6daa364e5518b016c7f23531c79e1

SHA1
a95d12e2a27fdb026737a5a3b16f1cb07595e55c

SHA256
e255b495265c74209567d5862a10e8e358031202c2e60856cfc7aa54cc5813c9

SHA512
aea93e70e6d08fede6602a36d2c54a284a10debac141e121d4b167c7c7da0c28cfcaa5987cdd74d6cfdc32b902250acc1c25f82dab0493ead7faef1518ef9fad

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8864827.exe

Filesize
393KB

MD5
c63d2bd5de31907e84e184d19c936ee9

SHA1
08a313e5d54fa4f356e5af79bf151b287a09654f

SHA256
25b5bf3480536145285559a702aa4809a06fb85822d2e6061568b60c40310272

SHA512
c7e1e8b166026b79fa024046a809503ed531cfc058d2f62e2d311b20313d3bdb7c5b55013997e73bc4c2bda3a8e7da82cbaeb8464c0c5bf03f5e706e29bb1fc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8864827.exe

Filesize
393KB

MD5
c63d2bd5de31907e84e184d19c936ee9

SHA1
08a313e5d54fa4f356e5af79bf151b287a09654f

SHA256
25b5bf3480536145285559a702aa4809a06fb85822d2e6061568b60c40310272

SHA512
c7e1e8b166026b79fa024046a809503ed531cfc058d2f62e2d311b20313d3bdb7c5b55013997e73bc4c2bda3a8e7da82cbaeb8464c0c5bf03f5e706e29bb1fc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
0c459e65bcc6d38574f0c0d63a87088a

SHA1
41e53d5f2b3e7ca859b842a1c7b677e0847e6d65

SHA256
871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4

SHA512
be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/896-43-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/896-80-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/896-82-0x0000000073FD0000-0x0000000074780000-memory.dmp

Filesize
7.7MB

Download
memory/896-39-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3100-0-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/3100-79-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/3100-1-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/3100-2-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/3100-3-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/4296-48-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4296-45-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4296-46-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4296-44-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download