amadey | 5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
01-10-2023 13:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8.exe
Size

1.0MB
MD5

9ea89321485e45e0673797ed4f7cb512
SHA1

4a05bd2a3803851f46eaa1e0322412cb9c07bcdb
SHA256

5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8
SHA512

7715f8d6a052e371eac523483889f6209572a74296b9fb931c1e47fbe9109eb93612e8a772359e7659460329d10768f14627bd154b0ea46f114f824d6fc7e02e
SSDEEP

12288:HMrIy90vBYLSv4/ZhkIBL3OKdwBqdjR/hk4ROuEIF1Z1OQAGtxc6jHLa932r7G+m:Xy4MfBqKd9jM4ROIF1QGtxDs32r7K

Score

10^/10

amadey healer redline lada dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

lada

77.91.124.55:19071

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000023093-33.dat	healer
behavioral1/files/0x0007000000023093-34.dat	healer
behavioral1/memory/1404-35-0x0000000000010000-0x000000000001A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q3569345.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q3569345.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q3569345.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q3569345.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q3569345.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q3569345.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral1/memory/3904-51-0x0000000000400000-0x000000000043E000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	legota.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	t4116215.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	u9395834.exe

Executes dropped EXE 16 IoCs

pid	Process
552	z0624376.exe
4044	z3521203.exe
4176	z2705359.exe
2392	z3110487.exe
1404	q3569345.exe
2736	r2468371.exe
2624	s1207250.exe
5112	t4116215.exe
2924	explothe.exe
4512	u9395834.exe
3172	legota.exe
2864	w5005172.exe
4504	legota.exe
3716	explothe.exe
3848	legota.exe
972	explothe.exe

Loads dropped DLL 2 IoCs

pid	Process
676	rundll32.exe
1432	rundll32.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q3569345.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z0624376.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z3521203.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z2705359.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z3110487.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 4212	2736	r2468371.exe	94
PID 2624 set thread context of 3904	2624	s1207250.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1552	2736	WerFault.exe	92
660	4212	WerFault.exe	94
4660	2624	WerFault.exe	101

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4572	schtasks.exe
4204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1404	q3569345.exe
1404	q3569345.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1404	q3569345.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 552	2632	5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8.exe	87
PID 2632 wrote to memory of 552	2632	5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8.exe	87
PID 2632 wrote to memory of 552	2632	5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8.exe	87
PID 552 wrote to memory of 4044	552	z0624376.exe	88
PID 552 wrote to memory of 4044	552	z0624376.exe	88
PID 552 wrote to memory of 4044	552	z0624376.exe	88
PID 4044 wrote to memory of 4176	4044	z3521203.exe	89
PID 4044 wrote to memory of 4176	4044	z3521203.exe	89
PID 4044 wrote to memory of 4176	4044	z3521203.exe	89
PID 4176 wrote to memory of 2392	4176	z2705359.exe	90
PID 4176 wrote to memory of 2392	4176	z2705359.exe	90
PID 4176 wrote to memory of 2392	4176	z2705359.exe	90
PID 2392 wrote to memory of 1404	2392	z3110487.exe	91
PID 2392 wrote to memory of 1404	2392	z3110487.exe	91
PID 2392 wrote to memory of 2736	2392	z3110487.exe	92
PID 2392 wrote to memory of 2736	2392	z3110487.exe	92
PID 2392 wrote to memory of 2736	2392	z3110487.exe	92
PID 2736 wrote to memory of 4212	2736	r2468371.exe	94
PID 2736 wrote to memory of 4212	2736	r2468371.exe	94
PID 2736 wrote to memory of 4212	2736	r2468371.exe	94
PID 2736 wrote to memory of 4212	2736	r2468371.exe	94
PID 2736 wrote to memory of 4212	2736	r2468371.exe	94
PID 2736 wrote to memory of 4212	2736	r2468371.exe	94
PID 2736 wrote to memory of 4212	2736	r2468371.exe	94
PID 2736 wrote to memory of 4212	2736	r2468371.exe	94
PID 2736 wrote to memory of 4212	2736	r2468371.exe	94
PID 2736 wrote to memory of 4212	2736	r2468371.exe	94
PID 4176 wrote to memory of 2624	4176	z2705359.exe	101
PID 4176 wrote to memory of 2624	4176	z2705359.exe	101
PID 4176 wrote to memory of 2624	4176	z2705359.exe	101
PID 2624 wrote to memory of 3036	2624	s1207250.exe	103
PID 2624 wrote to memory of 3036	2624	s1207250.exe	103
PID 2624 wrote to memory of 3036	2624	s1207250.exe	103
PID 2624 wrote to memory of 3904	2624	s1207250.exe	104
PID 2624 wrote to memory of 3904	2624	s1207250.exe	104
PID 2624 wrote to memory of 3904	2624	s1207250.exe	104
PID 2624 wrote to memory of 3904	2624	s1207250.exe	104
PID 2624 wrote to memory of 3904	2624	s1207250.exe	104
PID 2624 wrote to memory of 3904	2624	s1207250.exe	104
PID 2624 wrote to memory of 3904	2624	s1207250.exe	104
PID 2624 wrote to memory of 3904	2624	s1207250.exe	104
PID 4044 wrote to memory of 5112	4044	z3521203.exe	107
PID 4044 wrote to memory of 5112	4044	z3521203.exe	107
PID 4044 wrote to memory of 5112	4044	z3521203.exe	107
PID 5112 wrote to memory of 2924	5112	t4116215.exe	108
PID 5112 wrote to memory of 2924	5112	t4116215.exe	108
PID 5112 wrote to memory of 2924	5112	t4116215.exe	108
PID 552 wrote to memory of 4512	552	z0624376.exe	109
PID 552 wrote to memory of 4512	552	z0624376.exe	109
PID 552 wrote to memory of 4512	552	z0624376.exe	109
PID 4512 wrote to memory of 3172	4512	u9395834.exe	110
PID 4512 wrote to memory of 3172	4512	u9395834.exe	110
PID 4512 wrote to memory of 3172	4512	u9395834.exe	110
PID 2924 wrote to memory of 4572	2924	explothe.exe	111
PID 2924 wrote to memory of 4572	2924	explothe.exe	111
PID 2924 wrote to memory of 4572	2924	explothe.exe	111
PID 2924 wrote to memory of 2904	2924	explothe.exe	113
PID 2924 wrote to memory of 2904	2924	explothe.exe	113
PID 2924 wrote to memory of 2904	2924	explothe.exe	113
PID 2632 wrote to memory of 2864	2632	5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8.exe	115
PID 2632 wrote to memory of 2864	2632	5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8.exe	115
PID 2632 wrote to memory of 2864	2632	5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8.exe	115
PID 3172 wrote to memory of 4204	3172	legota.exe	117
PID 3172 wrote to memory of 4204	3172	legota.exe	117

C:\Users\Admin\AppData\Local\Temp\5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8.exe
"C:\Users\Admin\AppData\Local\Temp\5d8972792d632847e377066d7dfc5440cfdff8e9d7c7005ee7f8931c516295f8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0624376.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0624376.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3521203.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3521203.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2705359.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2705359.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3110487.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3110487.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3569345.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3569345.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2468371.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2468371.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 560
        8⤵
        Program crash
        
        PID:660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 592
        7⤵
        Program crash
        
        PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1207250.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1207250.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2624
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3036
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3904
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2624 -s 604
        6⤵
        Program crash
        
        PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4116215.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4116215.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2924
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4572
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2180
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        7⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        7⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:860
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:676
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9395834.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9395834.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3172
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4204
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:4880
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1516
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:2876
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:752
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2164
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:4620
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:3480
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:1432
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5005172.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5005172.exe
  2⤵
  - Executes dropped EXE
  PID:2864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4212 -ip 4212
1⤵
PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2736 -ip 2736
1⤵
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2624 -ip 2624
1⤵
PID:220

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:4504

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:3716

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:3848

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5005172.exe

Filesize
24KB

MD5
40dca607f0f137c83f5536a52c9c8cee

SHA1
71fdea45247e353cff66d5f5d7d132b45d1b78ac

SHA256
db97914f605399d534fd97f3caac00c3e07c63cf1e638f53c792bf9229a6b509

SHA512
7f36fd817cc134fa8625bc25f9d23e9c7a6380995a36f2c8434ec1a933f71f7ee237674e863bb466593a477b7eb60d874ae5960c9fe2a569edff282dd16dac3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5005172.exe

Filesize
24KB

MD5
40dca607f0f137c83f5536a52c9c8cee

SHA1
71fdea45247e353cff66d5f5d7d132b45d1b78ac

SHA256
db97914f605399d534fd97f3caac00c3e07c63cf1e638f53c792bf9229a6b509

SHA512
7f36fd817cc134fa8625bc25f9d23e9c7a6380995a36f2c8434ec1a933f71f7ee237674e863bb466593a477b7eb60d874ae5960c9fe2a569edff282dd16dac3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0624376.exe

Filesize
937KB

MD5
90866554f979e957059928e2dd8e0212

SHA1
7b4f139ce2d50dbc1c12be6144080aa4b709b386

SHA256
4a23fbb7888d14ab82a07e7d035664977f37f5743564af8bad408ce4568dd2ce

SHA512
909fbfd9973c072b9e8943fd4b6b46dae1278798b1668d0fb1c32fa9480818a6084db9c39e3d482903d1fe81f91ae53685c4b5b69275f14212e38b845a7accba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0624376.exe

Filesize
937KB

MD5
90866554f979e957059928e2dd8e0212

SHA1
7b4f139ce2d50dbc1c12be6144080aa4b709b386

SHA256
4a23fbb7888d14ab82a07e7d035664977f37f5743564af8bad408ce4568dd2ce

SHA512
909fbfd9973c072b9e8943fd4b6b46dae1278798b1668d0fb1c32fa9480818a6084db9c39e3d482903d1fe81f91ae53685c4b5b69275f14212e38b845a7accba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9395834.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9395834.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3521203.exe

Filesize
755KB

MD5
415a4f591d80d9282ad2ab2449addc5a

SHA1
71bdf746567ebb0fbff8b1720887e354f68d3779

SHA256
12f7cc3ec08d18f62a2c912e689899f7a6d443aecd3b5fd97b92b76cedec33f0

SHA512
1d79d9d6eb903c76209e889471ac18dcb397f306a1cd842f9ecee78c4ba2a197179750ce38a21e92bb517a812a848b83d8d947bcb0bd07fc2911218c8850724e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3521203.exe

Filesize
755KB

MD5
415a4f591d80d9282ad2ab2449addc5a

SHA1
71bdf746567ebb0fbff8b1720887e354f68d3779

SHA256
12f7cc3ec08d18f62a2c912e689899f7a6d443aecd3b5fd97b92b76cedec33f0

SHA512
1d79d9d6eb903c76209e889471ac18dcb397f306a1cd842f9ecee78c4ba2a197179750ce38a21e92bb517a812a848b83d8d947bcb0bd07fc2911218c8850724e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4116215.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4116215.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2705359.exe

Filesize
572KB

MD5
f0d97cd2162f7c75a548aefb97af99d0

SHA1
426cfdd83500f0612e06008f5b2b70f3ee5a330e

SHA256
94b4b322050dfab082b094fef7b2ea5ae34527f38802989646b49c8412e57f96

SHA512
4b45b149c613b534bf6a4c382597686e578c399bdaca944cd1998ac9a83d6e6ec2e46c99da8be03e41be52554367c22ce41e07371a0934d95fc6f2db89d72b1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2705359.exe

Filesize
572KB

MD5
f0d97cd2162f7c75a548aefb97af99d0

SHA1
426cfdd83500f0612e06008f5b2b70f3ee5a330e

SHA256
94b4b322050dfab082b094fef7b2ea5ae34527f38802989646b49c8412e57f96

SHA512
4b45b149c613b534bf6a4c382597686e578c399bdaca944cd1998ac9a83d6e6ec2e46c99da8be03e41be52554367c22ce41e07371a0934d95fc6f2db89d72b1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1207250.exe

Filesize
386KB

MD5
0fef8e177308cd6b939621f06c7154f2

SHA1
20f424edcf16e2e0aa1ca8cc850c918a7dcaa4b8

SHA256
7a7f4708f24e98ec83b16587988d553cd7175420192d4e5372805b5d2e2476c9

SHA512
06f85345b46195bd04cdc3353546f6ac15749859ccec3e429935d9beac6fcd22ab796046491e803f9f17c8280e6d7bf1358d7458d8bfbeba9dd1c63e3f6defb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1207250.exe

Filesize
386KB

MD5
0fef8e177308cd6b939621f06c7154f2

SHA1
20f424edcf16e2e0aa1ca8cc850c918a7dcaa4b8

SHA256
7a7f4708f24e98ec83b16587988d553cd7175420192d4e5372805b5d2e2476c9

SHA512
06f85345b46195bd04cdc3353546f6ac15749859ccec3e429935d9beac6fcd22ab796046491e803f9f17c8280e6d7bf1358d7458d8bfbeba9dd1c63e3f6defb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3110487.exe

Filesize
309KB

MD5
9b487fc854223279bc68ff23e1e6b073

SHA1
bf725652e3b526026b226b1bbd5ae7260b4fd8bd

SHA256
9e64c5d4e1f51c3a66e947b6c6ac4a2c90df5c4096b1764d8229348280ebc7dd

SHA512
90e95979c88665e182c6fa03272546f5da383bec5acaa7392cababd2d739eb602b16d00d363252c5da4d528483cf77a115b9c967c0e59ad7eb7ba921b4dfaba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3110487.exe

Filesize
309KB

MD5
9b487fc854223279bc68ff23e1e6b073

SHA1
bf725652e3b526026b226b1bbd5ae7260b4fd8bd

SHA256
9e64c5d4e1f51c3a66e947b6c6ac4a2c90df5c4096b1764d8229348280ebc7dd

SHA512
90e95979c88665e182c6fa03272546f5da383bec5acaa7392cababd2d739eb602b16d00d363252c5da4d528483cf77a115b9c967c0e59ad7eb7ba921b4dfaba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3569345.exe

Filesize
11KB

MD5
8dd706a687ea3cf2322f398c156d4351

SHA1
7778f6cb9f40430c837040d6534954c233834f19

SHA256
d46797a4b65211e1cd92e515d33fa400d4555d6ecb5d223d76bb00446cdeb4d2

SHA512
a4a5a18945d00b7ddf983d8db20253080a9c248c84c661f394774216dd3875c53949c1f3d346816f8dc144888d28e78c133f4f44ea0d54012dc9f346534ac54e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3569345.exe

Filesize
11KB

MD5
8dd706a687ea3cf2322f398c156d4351

SHA1
7778f6cb9f40430c837040d6534954c233834f19

SHA256
d46797a4b65211e1cd92e515d33fa400d4555d6ecb5d223d76bb00446cdeb4d2

SHA512
a4a5a18945d00b7ddf983d8db20253080a9c248c84c661f394774216dd3875c53949c1f3d346816f8dc144888d28e78c133f4f44ea0d54012dc9f346534ac54e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2468371.exe

Filesize
304KB

MD5
5ae63a9a2b67b914fb5ad3fd2b83f3b2

SHA1
c47c13fa86dbd5c477b9cf25f387e45642d3a712

SHA256
a8af846f767b1e03fcb1e11cfb37f2155c2b778fdbb9e269ec8ece2c41f66023

SHA512
96b82bc7bd4b37f27ae14efc910f91723a65d62f4db3af1922434d9bd28167fd1450ea0eee11248ae40b74b2fee1eaf958a110c9fb3da865bcca02e80ca2cda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2468371.exe

Filesize
304KB

MD5
5ae63a9a2b67b914fb5ad3fd2b83f3b2

SHA1
c47c13fa86dbd5c477b9cf25f387e45642d3a712

SHA256
a8af846f767b1e03fcb1e11cfb37f2155c2b778fdbb9e269ec8ece2c41f66023

SHA512
96b82bc7bd4b37f27ae14efc910f91723a65d62f4db3af1922434d9bd28167fd1450ea0eee11248ae40b74b2fee1eaf958a110c9fb3da865bcca02e80ca2cda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
a5b509a3fb95cc3c8d89cd39fc2a30fb

SHA1
5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c

SHA256
5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529

SHA512
3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/1404-39-0x00007FFA96600000-0x00007FFA970C1000-memory.dmp

Filesize
10.8MB

Download
memory/1404-37-0x00007FFA96600000-0x00007FFA970C1000-memory.dmp

Filesize
10.8MB

Download
memory/1404-36-0x00007FFA96600000-0x00007FFA970C1000-memory.dmp

Filesize
10.8MB

Download
memory/1404-35-0x0000000000010000-0x000000000001A000-memory.dmp

Filesize
40KB

Download
memory/3904-87-0x0000000007560000-0x000000000759C000-memory.dmp

Filesize
240KB

Download
memory/3904-82-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/3904-88-0x00000000076E0000-0x000000000772C000-memory.dmp

Filesize
304KB

Download
memory/3904-89-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/3904-86-0x0000000007500000-0x0000000007512000-memory.dmp

Filesize
72KB

Download
memory/3904-85-0x00000000075D0000-0x00000000076DA000-memory.dmp

Filesize
1.0MB

Download
memory/3904-92-0x0000000007210000-0x0000000007220000-memory.dmp

Filesize
64KB

Download
memory/3904-84-0x0000000008300000-0x0000000008918000-memory.dmp

Filesize
6.1MB

Download
memory/3904-83-0x0000000007330000-0x000000000733A000-memory.dmp

Filesize
40KB

Download
memory/3904-65-0x0000000007730000-0x0000000007CD4000-memory.dmp

Filesize
5.6MB

Download
memory/3904-57-0x00000000745B0000-0x0000000074D60000-memory.dmp

Filesize
7.7MB

Download
memory/3904-78-0x0000000007260000-0x00000000072F2000-memory.dmp

Filesize
584KB

Download
memory/3904-51-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/4212-45-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4212-47-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4212-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4212-43-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download