amadey | 174e56bf44835ab2ef1ebf316ffd9e8591bd27bd3c5f2b42661040e141a5d1e2

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2023, 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

174e56bf44835ab2ef1ebf316ffd9e8591bd27bd3c5f2b42661040e141a5d1e2.exe
Size

994KB
MD5

32e015a2b687ced3b6d0ce00dd562a41
SHA1

4bc84dd0ff1fdd313a1a2207483102ff28a3742a
SHA256

174e56bf44835ab2ef1ebf316ffd9e8591bd27bd3c5f2b42661040e141a5d1e2
SHA512

de05738dc72ba1ee17e53720b9a1e6a38a5343c1f236201ee848149b37eb7f3d8fc26b78abd3a2708a1c53cf2c3ca0ae4a3138a03495d2d83d53ab2ca1385eb8
SSDEEP

24576:oy3FZ/thXd23SpgKv5+Fxzt1UuxJePB8HG6:v3XHk/68TzQuxJuB8

Score

10^/10

amadey healer mystic redline gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

http://77.91.124.1/theme/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explothe.exe
strings_key
36a96139c1118a354edf72b1080d4b2f

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/1572-43-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1572-44-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1572-45-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1572-47-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023206-33.dat	healer
behavioral2/files/0x0008000000023206-34.dat	healer
behavioral2/memory/2552-35-0x0000000000600000-0x000000000060A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q9944549.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q9944549.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q9944549.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q9944549.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q9944549.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q9944549.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	t5640688.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	explothe.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	u6870723.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 16 IoCs

pid	Process
3712	z3560817.exe
2620	z2938605.exe
1492	z2727794.exe
1264	z8439962.exe
2552	q9944549.exe
4972	r2236804.exe
1744	s4739947.exe
3336	t5640688.exe
840	explothe.exe
2972	u6870723.exe
388	legota.exe
2980	w6434656.exe
4992	explothe.exe
1912	legota.exe
544	explothe.exe
4636	legota.exe

Loads dropped DLL 2 IoCs

pid	Process
4176	rundll32.exe
1492	rundll32.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q9944549.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	174e56bf44835ab2ef1ebf316ffd9e8591bd27bd3c5f2b42661040e141a5d1e2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z3560817.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z2938605.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z2727794.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z8439962.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4972 set thread context of 1572	4972	r2236804.exe	102
PID 1744 set thread context of 2204	1744	s4739947.exe	110

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4992	1572	WerFault.exe	102
3976	4972	WerFault.exe	98
4752	1744	WerFault.exe	107

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
484	schtasks.exe
3076	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2552	q9944549.exe
2552	q9944549.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2552	q9944549.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 3712	2108	174e56bf44835ab2ef1ebf316ffd9e8591bd27bd3c5f2b42661040e141a5d1e2.exe	86
PID 2108 wrote to memory of 3712	2108	174e56bf44835ab2ef1ebf316ffd9e8591bd27bd3c5f2b42661040e141a5d1e2.exe	86
PID 2108 wrote to memory of 3712	2108	174e56bf44835ab2ef1ebf316ffd9e8591bd27bd3c5f2b42661040e141a5d1e2.exe	86
PID 3712 wrote to memory of 2620	3712	z3560817.exe	87
PID 3712 wrote to memory of 2620	3712	z3560817.exe	87
PID 3712 wrote to memory of 2620	3712	z3560817.exe	87
PID 2620 wrote to memory of 1492	2620	z2938605.exe	88
PID 2620 wrote to memory of 1492	2620	z2938605.exe	88
PID 2620 wrote to memory of 1492	2620	z2938605.exe	88
PID 1492 wrote to memory of 1264	1492	z2727794.exe	89
PID 1492 wrote to memory of 1264	1492	z2727794.exe	89
PID 1492 wrote to memory of 1264	1492	z2727794.exe	89
PID 1264 wrote to memory of 2552	1264	z8439962.exe	90
PID 1264 wrote to memory of 2552	1264	z8439962.exe	90
PID 1264 wrote to memory of 4972	1264	z8439962.exe	98
PID 1264 wrote to memory of 4972	1264	z8439962.exe	98
PID 1264 wrote to memory of 4972	1264	z8439962.exe	98
PID 4972 wrote to memory of 1572	4972	r2236804.exe	102
PID 4972 wrote to memory of 1572	4972	r2236804.exe	102
PID 4972 wrote to memory of 1572	4972	r2236804.exe	102
PID 4972 wrote to memory of 1572	4972	r2236804.exe	102
PID 4972 wrote to memory of 1572	4972	r2236804.exe	102
PID 4972 wrote to memory of 1572	4972	r2236804.exe	102
PID 4972 wrote to memory of 1572	4972	r2236804.exe	102
PID 4972 wrote to memory of 1572	4972	r2236804.exe	102
PID 4972 wrote to memory of 1572	4972	r2236804.exe	102
PID 4972 wrote to memory of 1572	4972	r2236804.exe	102
PID 1492 wrote to memory of 1744	1492	z2727794.exe	107
PID 1492 wrote to memory of 1744	1492	z2727794.exe	107
PID 1492 wrote to memory of 1744	1492	z2727794.exe	107
PID 1744 wrote to memory of 4004	1744	s4739947.exe	109
PID 1744 wrote to memory of 4004	1744	s4739947.exe	109
PID 1744 wrote to memory of 4004	1744	s4739947.exe	109
PID 1744 wrote to memory of 2204	1744	s4739947.exe	110
PID 1744 wrote to memory of 2204	1744	s4739947.exe	110
PID 1744 wrote to memory of 2204	1744	s4739947.exe	110
PID 1744 wrote to memory of 2204	1744	s4739947.exe	110
PID 1744 wrote to memory of 2204	1744	s4739947.exe	110
PID 1744 wrote to memory of 2204	1744	s4739947.exe	110
PID 1744 wrote to memory of 2204	1744	s4739947.exe	110
PID 1744 wrote to memory of 2204	1744	s4739947.exe	110
PID 2620 wrote to memory of 3336	2620	z2938605.exe	114
PID 2620 wrote to memory of 3336	2620	z2938605.exe	114
PID 2620 wrote to memory of 3336	2620	z2938605.exe	114
PID 3336 wrote to memory of 840	3336	t5640688.exe	115
PID 3336 wrote to memory of 840	3336	t5640688.exe	115
PID 3336 wrote to memory of 840	3336	t5640688.exe	115
PID 3712 wrote to memory of 2972	3712	z3560817.exe	116
PID 3712 wrote to memory of 2972	3712	z3560817.exe	116
PID 3712 wrote to memory of 2972	3712	z3560817.exe	116
PID 840 wrote to memory of 484	840	explothe.exe	117
PID 840 wrote to memory of 484	840	explothe.exe	117
PID 840 wrote to memory of 484	840	explothe.exe	117
PID 840 wrote to memory of 3216	840	explothe.exe	119
PID 840 wrote to memory of 3216	840	explothe.exe	119
PID 840 wrote to memory of 3216	840	explothe.exe	119
PID 2972 wrote to memory of 388	2972	u6870723.exe	124
PID 2972 wrote to memory of 388	2972	u6870723.exe	124
PID 2972 wrote to memory of 388	2972	u6870723.exe	124
PID 3216 wrote to memory of 4448	3216	cmd.exe	121
PID 3216 wrote to memory of 4448	3216	cmd.exe	121
PID 3216 wrote to memory of 4448	3216	cmd.exe	121
PID 3216 wrote to memory of 716	3216	cmd.exe	123
PID 3216 wrote to memory of 716	3216	cmd.exe	123

C:\Users\Admin\AppData\Local\Temp\174e56bf44835ab2ef1ebf316ffd9e8591bd27bd3c5f2b42661040e141a5d1e2.exe
"C:\Users\Admin\AppData\Local\Temp\174e56bf44835ab2ef1ebf316ffd9e8591bd27bd3c5f2b42661040e141a5d1e2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3560817.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3560817.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2938605.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2938605.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2727794.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2727794.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8439962.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8439962.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9944549.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9944549.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2552
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2236804.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2236804.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4972
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 552
        8⤵
        Program crash
        
        PID:4992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4972 -s 584
        7⤵
        Program crash
        
        PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4739947.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4739947.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1744
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4004
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2204
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1744 -s 580
        6⤵
        Program crash
        
        PID:4752
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5640688.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5640688.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:840
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:484
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:N"
        7⤵
        
        PID:716
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explothe.exe" /P "Admin:R" /E
        7⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:2232
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:4176
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6870723.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6870723.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:388
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3076
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:1808
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4088
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:2320
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:4040
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2864
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:4204
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:764
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:1492
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6434656.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6434656.exe
  2⤵
  - Executes dropped EXE
  PID:2980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4972 -ip 4972
1⤵
PID:976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1572 -ip 1572
1⤵
PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1744 -ip 1744
1⤵
PID:5080

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:4992

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:1912

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe
1⤵
- Executes dropped EXE
PID:544

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:4636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6434656.exe

Filesize
23KB

MD5
950b13103fb639c026a51c05a54ee779

SHA1
287a11e911a2f085dc2180c7e202ebe817996291

SHA256
d0f9e60a2c1326300f921314e70472b1cdbd45abb38f05905fa8d92508d9eeab

SHA512
77446cc36c898991bd748dce80d9a8c291be4b0928cc5b51a3435c73a528dfab3d5cc73aaef891ab8d63aa9d889f20c0a8ff1c0a82f116a0b67df28bb0038d11

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6434656.exe

Filesize
23KB

MD5
950b13103fb639c026a51c05a54ee779

SHA1
287a11e911a2f085dc2180c7e202ebe817996291

SHA256
d0f9e60a2c1326300f921314e70472b1cdbd45abb38f05905fa8d92508d9eeab

SHA512
77446cc36c898991bd748dce80d9a8c291be4b0928cc5b51a3435c73a528dfab3d5cc73aaef891ab8d63aa9d889f20c0a8ff1c0a82f116a0b67df28bb0038d11

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3560817.exe

Filesize
892KB

MD5
8f4c4cd9dea78070268d2e3529a6c9fe

SHA1
8662d9d75d9424666c115ed6c1ed2799f28b09fd

SHA256
19321addea70bbc5479e48168924899b5dcbece1f38325178cb658f31a9fa778

SHA512
ee11565f2c6673b7dfa52f59219e4b2c64751d60b230218f3203e7dfe5d860a8b283fdd6274dfa59d1ee30b3054697d1dad40712f58e7a73b8e923e984040b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3560817.exe

Filesize
892KB

MD5
8f4c4cd9dea78070268d2e3529a6c9fe

SHA1
8662d9d75d9424666c115ed6c1ed2799f28b09fd

SHA256
19321addea70bbc5479e48168924899b5dcbece1f38325178cb658f31a9fa778

SHA512
ee11565f2c6673b7dfa52f59219e4b2c64751d60b230218f3203e7dfe5d860a8b283fdd6274dfa59d1ee30b3054697d1dad40712f58e7a73b8e923e984040b5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6870723.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6870723.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2938605.exe

Filesize
709KB

MD5
777fda121dc2c05dac6a859bef06fd9f

SHA1
45c5e60ba4b6560538655f6bf9d26c9ec7f7b990

SHA256
94ef91901cfbee6934713ef56318496400db0d285c4116a2d88067be037d3077

SHA512
71f6cbbceefa5c6b3b189bb01be9cfcfdb7198a6a030fb424da2dd0048fb85d7d10947dddc45a75a277a2806bc36644e05b49ff4202cb974df0d85fbc4dcb349

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2938605.exe

Filesize
709KB

MD5
777fda121dc2c05dac6a859bef06fd9f

SHA1
45c5e60ba4b6560538655f6bf9d26c9ec7f7b990

SHA256
94ef91901cfbee6934713ef56318496400db0d285c4116a2d88067be037d3077

SHA512
71f6cbbceefa5c6b3b189bb01be9cfcfdb7198a6a030fb424da2dd0048fb85d7d10947dddc45a75a277a2806bc36644e05b49ff4202cb974df0d85fbc4dcb349

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5640688.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5640688.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2727794.exe

Filesize
526KB

MD5
8338993f9102c776262f057ca8ee9ad3

SHA1
46fde7d02b32d4a14fb50399453b08761905c621

SHA256
f0897e28d56dc3c6829ab8c4a35493db94daeb97a9490f95c7d75fb1cc12e6c6

SHA512
8a2156fe2e4b916f11f8bae6b545b304472ea3141e68a3ee54c1ca49b2faeeccc415ae4276bf4d08291814aff3fe5ab8d0c2ef07474f2c90ea8b69726a40b457

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2727794.exe

Filesize
526KB

MD5
8338993f9102c776262f057ca8ee9ad3

SHA1
46fde7d02b32d4a14fb50399453b08761905c621

SHA256
f0897e28d56dc3c6829ab8c4a35493db94daeb97a9490f95c7d75fb1cc12e6c6

SHA512
8a2156fe2e4b916f11f8bae6b545b304472ea3141e68a3ee54c1ca49b2faeeccc415ae4276bf4d08291814aff3fe5ab8d0c2ef07474f2c90ea8b69726a40b457

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4739947.exe

Filesize
310KB

MD5
e29129cbf11b9c414404e03bc7ea82f4

SHA1
a2dc6f91896f105b5da16887a37bf1b18f5b3185

SHA256
f2c1d8319c74b498fa88426f9c8e959497af908ffb0a3ee8aa1912300c743f24

SHA512
829bb6af9fc955d96b75462566ed7207986dbb2c3345096e8de5417fdfd7e2ff8783573a7db8c8a5ec50288e5ce9041b3debc11fa3189148ade109dff67a46fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4739947.exe

Filesize
310KB

MD5
e29129cbf11b9c414404e03bc7ea82f4

SHA1
a2dc6f91896f105b5da16887a37bf1b18f5b3185

SHA256
f2c1d8319c74b498fa88426f9c8e959497af908ffb0a3ee8aa1912300c743f24

SHA512
829bb6af9fc955d96b75462566ed7207986dbb2c3345096e8de5417fdfd7e2ff8783573a7db8c8a5ec50288e5ce9041b3debc11fa3189148ade109dff67a46fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8439962.exe

Filesize
296KB

MD5
fa338af5f5b5ac1cadf87a93bde0efb7

SHA1
8da1e51856c3fe9a32e19bfb0e8308b567b526cc

SHA256
4f9cdd5df77cfbba55deb15a25f28fbb539b3a7c8e94d8a8769b5ad05e988ea3

SHA512
045a7b4eb8ccd6ed819d38b65056d287b0eaa747e332ac8ad603eeede8ce8d0b3e3a2adea63c692a1a3e5699ea065445bd8125e2adbf8b13308a298e24f9790e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8439962.exe

Filesize
296KB

MD5
fa338af5f5b5ac1cadf87a93bde0efb7

SHA1
8da1e51856c3fe9a32e19bfb0e8308b567b526cc

SHA256
4f9cdd5df77cfbba55deb15a25f28fbb539b3a7c8e94d8a8769b5ad05e988ea3

SHA512
045a7b4eb8ccd6ed819d38b65056d287b0eaa747e332ac8ad603eeede8ce8d0b3e3a2adea63c692a1a3e5699ea065445bd8125e2adbf8b13308a298e24f9790e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9944549.exe

Filesize
11KB

MD5
cb3f3a4d067169ce76c05db6de8ee8bd

SHA1
96ddcc0df2e979c6306c57689eddcc0dd5acbe10

SHA256
61fbd77ed4a94b1888a04324b477e70d8a347d361862f743921a0ab81ae3d802

SHA512
6f48dc353b47084c4c9a5b5d2d8a1dca41f497bc64b22c98fb9390998a39060258ffae154bb3e765e313475c7f6aef63226870b8f3407278cd71a59d8ea080c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9944549.exe

Filesize
11KB

MD5
cb3f3a4d067169ce76c05db6de8ee8bd

SHA1
96ddcc0df2e979c6306c57689eddcc0dd5acbe10

SHA256
61fbd77ed4a94b1888a04324b477e70d8a347d361862f743921a0ab81ae3d802

SHA512
6f48dc353b47084c4c9a5b5d2d8a1dca41f497bc64b22c98fb9390998a39060258ffae154bb3e765e313475c7f6aef63226870b8f3407278cd71a59d8ea080c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2236804.exe

Filesize
276KB

MD5
8821f3fdb6c4e06871bb3a4e4ac83492

SHA1
707c070a44bb747aa9e40156899a2b3a396797be

SHA256
1f41754a4416206cd608f89ea14631d287e54d3e7d9fff8d3f7fb2510878a98a

SHA512
d542aa865bc50105746beb39acb8ac63a307d328442c47ec97706527f6abeef1ff731ba9ced77d105b30f109da395e8311c51b78279de34c0174876ae053edf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2236804.exe

Filesize
276KB

MD5
8821f3fdb6c4e06871bb3a4e4ac83492

SHA1
707c070a44bb747aa9e40156899a2b3a396797be

SHA256
1f41754a4416206cd608f89ea14631d287e54d3e7d9fff8d3f7fb2510878a98a

SHA512
d542aa865bc50105746beb39acb8ac63a307d328442c47ec97706527f6abeef1ff731ba9ced77d105b30f109da395e8311c51b78279de34c0174876ae053edf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe

Filesize
219KB

MD5
4bd59a6b3207f99fc3435baf3c22bc4e

SHA1
ae90587beed289f177f4143a8380ba27109d0a6f

SHA256
08e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236

SHA512
ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
e913b0d252d36f7c9b71268df4f634fb

SHA1
5ac70d8793712bcd8ede477071146bbb42d3f018

SHA256
4cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da

SHA512
3ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
a5b509a3fb95cc3c8d89cd39fc2a30fb

SHA1
5aff4266a9c0f2af440f28aa865cebc5ddb9cd5c

SHA256
5f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529

SHA512
3cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/1572-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1572-43-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1572-47-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1572-45-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2204-81-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

Filesize
64KB

Download
memory/2204-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2204-88-0x0000000002AB0000-0x0000000002AC0000-memory.dmp

Filesize
64KB

Download
memory/2204-80-0x0000000005210000-0x0000000005222000-memory.dmp

Filesize
72KB

Download
memory/2204-87-0x0000000074140000-0x00000000748F0000-memory.dmp

Filesize
7.7MB

Download
memory/2204-86-0x00000000053F0000-0x000000000543C000-memory.dmp

Filesize
304KB

Download
memory/2204-58-0x0000000001100000-0x0000000001106000-memory.dmp

Filesize
24KB

Download
memory/2204-57-0x0000000074140000-0x00000000748F0000-memory.dmp

Filesize
7.7MB

Download
memory/2204-76-0x00000000052E0000-0x00000000053EA000-memory.dmp

Filesize
1.0MB

Download
memory/2204-71-0x00000000057F0000-0x0000000005E08000-memory.dmp

Filesize
6.1MB

Download
memory/2204-84-0x0000000005270000-0x00000000052AC000-memory.dmp

Filesize
240KB

Download
memory/2552-37-0x00007FF9DB9D0000-0x00007FF9DC491000-memory.dmp

Filesize
10.8MB

Download
memory/2552-39-0x00007FF9DB9D0000-0x00007FF9DC491000-memory.dmp

Filesize
10.8MB

Download
memory/2552-36-0x00007FF9DB9D0000-0x00007FF9DC491000-memory.dmp

Filesize
10.8MB

Download
memory/2552-35-0x0000000000600000-0x000000000060A000-memory.dmp

Filesize
40KB

Download