amadey | 78dec8de750ec13c91291c28fe71fa808a0268a6e198c4e7b2fd3d7cc8b25069

Analysis

max time kernel
168s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

36189d79cecb16a013cb2b7c68884036fd232474c5b019fce8d5f1595005810d.exe
Size

1.0MB
MD5

066556e720a45c049f6887dcb2e50d66
SHA1

4c1c694615904bf83833242c0702810b924e2123
SHA256

36189d79cecb16a013cb2b7c68884036fd232474c5b019fce8d5f1595005810d
SHA512

9a1dc99198dfdf53e56791fd6ac21f1e0678eeda0fd1e2ac599ffe31b689ee209394279578e90e7ee942708c2d116807030f56b6c99fc845c06c3e3ca18d208c
SSDEEP

24576:ByrPJgo92UDmUFxzB+Pl9QKSaKgm9URiRVTr3ZfLO2gNNakw:0rxn2ypyt9xJKgfiRVHZDBgNk

Score

10^/10

amadey healer mystic redline gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1160-40-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1160-41-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1160-42-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1160-44-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2324-35-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

AppLaunch.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explonde.exeu2073456.exelegota.exet9022828.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	u2073456.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	legota.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation	t9022828.exe

Executes dropped EXE 14 IoCs

Processes:

z2965988.exez3314080.exez9706117.exez1793965.exeq6464337.exer2369954.exes8162725.exet9022828.exeexplonde.exeu2073456.exelegota.exew9691732.exeexplonde.exelegota.exe

pid	process
2768	z2965988.exe
3952	z3314080.exe
4564	z9706117.exe
1316	z1793965.exe
2900	q6464337.exe
4928	r2369954.exe
2032	s8162725.exe
1908	t9022828.exe
4624	explonde.exe
1400	u2073456.exe
4268	legota.exe
4156	w9691732.exe
1456	explonde.exe
3040	legota.exe

Loads dropped DLL 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

4968 rundll32.exe
1632 rundll32.exe

pid	process
4968	rundll32.exe
1632	rundll32.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

z3314080.exez9706117.exez1793965.exe36189d79cecb16a013cb2b7c68884036fd232474c5b019fce8d5f1595005810d.exez2965988.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z3314080.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z9706117.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z1793965.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	36189d79cecb16a013cb2b7c68884036fd232474c5b019fce8d5f1595005810d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z2965988.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

q6464337.exer2369954.exes8162725.exe

description	pid	process	target process
PID 2900 set thread context of 2324	2900	q6464337.exe	AppLaunch.exe
PID 4928 set thread context of 1160	4928	r2369954.exe	AppLaunch.exe
PID 2032 set thread context of 3804	2032	s8162725.exe	AppLaunch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3280	2900	WerFault.exe	q6464337.exe
2340	4928	WerFault.exe	r2369954.exe
1692	1160	WerFault.exe	AppLaunch.exe
4712	2032	WerFault.exe	s8162725.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2500 schtasks.exe
3148 schtasks.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AppLaunch.exe

pid process

2324 AppLaunch.exe
2324 AppLaunch.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AppLaunch.exe

description pid process

Token: SeDebugPrivilege 2324 AppLaunch.exe

pid	process
2500	schtasks.exe
3148	schtasks.exe

pid	process
2324	AppLaunch.exe
2324	AppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	2324	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

36189d79cecb16a013cb2b7c68884036fd232474c5b019fce8d5f1595005810d.exez2965988.exez3314080.exez9706117.exez1793965.exeq6464337.exer2369954.exes8162725.exet9022828.exeexplonde.execmd.exe

description	pid	process	target process
PID 228 wrote to memory of 2768	228	36189d79cecb16a013cb2b7c68884036fd232474c5b019fce8d5f1595005810d.exe	z2965988.exe
PID 228 wrote to memory of 2768	228	36189d79cecb16a013cb2b7c68884036fd232474c5b019fce8d5f1595005810d.exe	z2965988.exe
PID 228 wrote to memory of 2768	228	36189d79cecb16a013cb2b7c68884036fd232474c5b019fce8d5f1595005810d.exe	z2965988.exe
PID 2768 wrote to memory of 3952	2768	z2965988.exe	z3314080.exe
PID 2768 wrote to memory of 3952	2768	z2965988.exe	z3314080.exe
PID 2768 wrote to memory of 3952	2768	z2965988.exe	z3314080.exe
PID 3952 wrote to memory of 4564	3952	z3314080.exe	z9706117.exe
PID 3952 wrote to memory of 4564	3952	z3314080.exe	z9706117.exe
PID 3952 wrote to memory of 4564	3952	z3314080.exe	z9706117.exe
PID 4564 wrote to memory of 1316	4564	z9706117.exe	z1793965.exe
PID 4564 wrote to memory of 1316	4564	z9706117.exe	z1793965.exe
PID 4564 wrote to memory of 1316	4564	z9706117.exe	z1793965.exe
PID 1316 wrote to memory of 2900	1316	z1793965.exe	q6464337.exe
PID 1316 wrote to memory of 2900	1316	z1793965.exe	q6464337.exe
PID 1316 wrote to memory of 2900	1316	z1793965.exe	q6464337.exe
PID 2900 wrote to memory of 2324	2900	q6464337.exe	AppLaunch.exe
PID 2900 wrote to memory of 2324	2900	q6464337.exe	AppLaunch.exe
PID 2900 wrote to memory of 2324	2900	q6464337.exe	AppLaunch.exe
PID 2900 wrote to memory of 2324	2900	q6464337.exe	AppLaunch.exe
PID 2900 wrote to memory of 2324	2900	q6464337.exe	AppLaunch.exe
PID 2900 wrote to memory of 2324	2900	q6464337.exe	AppLaunch.exe
PID 2900 wrote to memory of 2324	2900	q6464337.exe	AppLaunch.exe
PID 2900 wrote to memory of 2324	2900	q6464337.exe	AppLaunch.exe
PID 1316 wrote to memory of 4928	1316	z1793965.exe	r2369954.exe
PID 1316 wrote to memory of 4928	1316	z1793965.exe	r2369954.exe
PID 1316 wrote to memory of 4928	1316	z1793965.exe	r2369954.exe
PID 4928 wrote to memory of 1160	4928	r2369954.exe	AppLaunch.exe
PID 4928 wrote to memory of 1160	4928	r2369954.exe	AppLaunch.exe
PID 4928 wrote to memory of 1160	4928	r2369954.exe	AppLaunch.exe
PID 4928 wrote to memory of 1160	4928	r2369954.exe	AppLaunch.exe
PID 4928 wrote to memory of 1160	4928	r2369954.exe	AppLaunch.exe
PID 4928 wrote to memory of 1160	4928	r2369954.exe	AppLaunch.exe
PID 4928 wrote to memory of 1160	4928	r2369954.exe	AppLaunch.exe
PID 4928 wrote to memory of 1160	4928	r2369954.exe	AppLaunch.exe
PID 4928 wrote to memory of 1160	4928	r2369954.exe	AppLaunch.exe
PID 4928 wrote to memory of 1160	4928	r2369954.exe	AppLaunch.exe
PID 4564 wrote to memory of 2032	4564	z9706117.exe	s8162725.exe
PID 4564 wrote to memory of 2032	4564	z9706117.exe	s8162725.exe
PID 4564 wrote to memory of 2032	4564	z9706117.exe	s8162725.exe
PID 2032 wrote to memory of 3804	2032	s8162725.exe	AppLaunch.exe
PID 2032 wrote to memory of 3804	2032	s8162725.exe	AppLaunch.exe
PID 2032 wrote to memory of 3804	2032	s8162725.exe	AppLaunch.exe
PID 2032 wrote to memory of 3804	2032	s8162725.exe	AppLaunch.exe
PID 2032 wrote to memory of 3804	2032	s8162725.exe	AppLaunch.exe
PID 2032 wrote to memory of 3804	2032	s8162725.exe	AppLaunch.exe
PID 2032 wrote to memory of 3804	2032	s8162725.exe	AppLaunch.exe
PID 2032 wrote to memory of 3804	2032	s8162725.exe	AppLaunch.exe
PID 3952 wrote to memory of 1908	3952	z3314080.exe	t9022828.exe
PID 3952 wrote to memory of 1908	3952	z3314080.exe	t9022828.exe
PID 3952 wrote to memory of 1908	3952	z3314080.exe	t9022828.exe
PID 1908 wrote to memory of 4624	1908	t9022828.exe	explonde.exe
PID 1908 wrote to memory of 4624	1908	t9022828.exe	explonde.exe
PID 1908 wrote to memory of 4624	1908	t9022828.exe	explonde.exe
PID 2768 wrote to memory of 1400	2768	z2965988.exe	u2073456.exe
PID 2768 wrote to memory of 1400	2768	z2965988.exe	u2073456.exe
PID 2768 wrote to memory of 1400	2768	z2965988.exe	u2073456.exe
PID 4624 wrote to memory of 2500	4624	explonde.exe	schtasks.exe
PID 4624 wrote to memory of 2500	4624	explonde.exe	schtasks.exe
PID 4624 wrote to memory of 2500	4624	explonde.exe	schtasks.exe
PID 4624 wrote to memory of 988	4624	explonde.exe	cmd.exe
PID 4624 wrote to memory of 988	4624	explonde.exe	cmd.exe
PID 4624 wrote to memory of 988	4624	explonde.exe	cmd.exe
PID 988 wrote to memory of 860	988	cmd.exe	cmd.exe
PID 988 wrote to memory of 860	988	cmd.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\36189d79cecb16a013cb2b7c68884036fd232474c5b019fce8d5f1595005810d.exe
"C:\Users\Admin\AppData\Local\Temp\36189d79cecb16a013cb2b7c68884036fd232474c5b019fce8d5f1595005810d.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:228

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2965988.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2965988.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2768

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3314080.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3314080.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3952

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9706117.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9706117.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4564

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1793965.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1793965.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1316

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6464337.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6464337.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2900 -s 152
7⤵
- Program crash
PID:3280

C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2369954.exe
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2369954.exe
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
7⤵
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 208
8⤵
- Program crash
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4928 -s 156
7⤵
- Program crash
PID:2340

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8162725.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8162725.exe
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
6⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 156
6⤵
- Program crash
PID:4712

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9022828.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9022828.exe
4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
6⤵
- Creates scheduled task(s)
PID:2500

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
6⤵
- Suspicious use of WriteProcessMemory
PID:988

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:860

C:\Windows\SysWOW64\cacls.exe
CACLS "explonde.exe" /P "Admin:N"
7⤵
PID:4244

C:\Windows\SysWOW64\cacls.exe
CACLS "explonde.exe" /P "Admin:R" /E
7⤵
PID:2728

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
7⤵
PID:620

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:N"
7⤵
PID:2248

C:\Windows\SysWOW64\cacls.exe
CACLS "..\fefffe8cea" /P "Admin:R" /E
7⤵
PID:3312

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
6⤵
- Loads dropped DLL
PID:4968

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2073456.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2073456.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
PID:1400

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
4⤵
- Checks computer location settings
- Executes dropped EXE
PID:4268

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
5⤵
- Creates scheduled task(s)
PID:3148

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
5⤵
PID:3688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4196

C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:N"
6⤵
PID:964

C:\Windows\SysWOW64\cacls.exe
CACLS "legota.exe" /P "Admin:R" /E
6⤵
PID:1912

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
6⤵
PID:4576

C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:N"
6⤵
PID:912

C:\Windows\SysWOW64\cacls.exe
CACLS "..\cb378487cf" /P "Admin:R" /E
6⤵
PID:4776

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
5⤵
- Loads dropped DLL
PID:1632

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9691732.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9691732.exe
2⤵
- Executes dropped EXE
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2900 -ip 2900
1⤵
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4928 -ip 4928
1⤵
PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1160 -ip 1160
1⤵
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2032 -ip 2032
1⤵
PID:3992

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1456

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:3040

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9691732.exe
Filesize
22KB

MD5
609d25d0b8d2c1fcfcf9bfbcfa2d55e4

SHA1
524b5dca8f589ff1cce8db4434dccdc99d2eb370

SHA256
bd4dee2c01e979db940d77814d30a56de65e7982588601efb61c981a4c9d61d4

SHA512
1085a813bbf2932cd1515d37e07e49f91dfd323824ca91ddce905edaec5eac4025e0e9da3669ee60fc7e708d4b6ddbaca09bedee50c9bb8aadcd4cfe896fdd74

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9691732.exe
Filesize
22KB

MD5
609d25d0b8d2c1fcfcf9bfbcfa2d55e4

SHA1
524b5dca8f589ff1cce8db4434dccdc99d2eb370

SHA256
bd4dee2c01e979db940d77814d30a56de65e7982588601efb61c981a4c9d61d4

SHA512
1085a813bbf2932cd1515d37e07e49f91dfd323824ca91ddce905edaec5eac4025e0e9da3669ee60fc7e708d4b6ddbaca09bedee50c9bb8aadcd4cfe896fdd74

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2965988.exe
Filesize
961KB

MD5
592182363f4391648ea8a5d315f7f848

SHA1
701061b35765abe5267e48b097980d783eb2c449

SHA256
8cac2918b5719ad98aa10b7c6dd84d59e14cdcaa02d0dfba065ce5b3566b10df

SHA512
a60a073225cdb5ad01ae892f5f89f01945e8fcbb94f78769d47a291baa37fb7354336480299c6cf45f93eee17c351947dcade259164c4931f20ceba6d8cf4e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2965988.exe
Filesize
961KB

MD5
592182363f4391648ea8a5d315f7f848

SHA1
701061b35765abe5267e48b097980d783eb2c449

SHA256
8cac2918b5719ad98aa10b7c6dd84d59e14cdcaa02d0dfba065ce5b3566b10df

SHA512
a60a073225cdb5ad01ae892f5f89f01945e8fcbb94f78769d47a291baa37fb7354336480299c6cf45f93eee17c351947dcade259164c4931f20ceba6d8cf4e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2073456.exe
Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2073456.exe
Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3314080.exe
Filesize
781KB

MD5
3909bf2a34b2accf73dedf3f3541cf87

SHA1
6471d2e5917a68c59ba1dc7c2987aba4112ed32d

SHA256
0d3d87300214143b66493e78b82abc908229d64557c5040d910f58c3f0827ce0

SHA512
60fd893a424a285249c38b1e49a1631f9e7c61a2604b96425904f311bac86266affe7eaa9f7c1b218b5f53f79425710072716dce5a750d19f293ba34b1302b64

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3314080.exe
Filesize
781KB

MD5
3909bf2a34b2accf73dedf3f3541cf87

SHA1
6471d2e5917a68c59ba1dc7c2987aba4112ed32d

SHA256
0d3d87300214143b66493e78b82abc908229d64557c5040d910f58c3f0827ce0

SHA512
60fd893a424a285249c38b1e49a1631f9e7c61a2604b96425904f311bac86266affe7eaa9f7c1b218b5f53f79425710072716dce5a750d19f293ba34b1302b64

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9022828.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9022828.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9706117.exe
Filesize
599KB

MD5
2bd5c356d3009504a8fb76c5b1cb6c52

SHA1
df69541f2053daa5ce0f55b0cd881be1721463ee

SHA256
516e056c4b783fdcde9d77d00038f494223e0d0c8d5466df68186840bc21a4d8

SHA512
372fb9cf8037f29bbd278452216a9d9f9244fb43a8199bc120f6a9c60861f48c733089fe2731401e9dda530a91feff30775378dbec180daf60208e62c93f921c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9706117.exe
Filesize
599KB

MD5
2bd5c356d3009504a8fb76c5b1cb6c52

SHA1
df69541f2053daa5ce0f55b0cd881be1721463ee

SHA256
516e056c4b783fdcde9d77d00038f494223e0d0c8d5466df68186840bc21a4d8

SHA512
372fb9cf8037f29bbd278452216a9d9f9244fb43a8199bc120f6a9c60861f48c733089fe2731401e9dda530a91feff30775378dbec180daf60208e62c93f921c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8162725.exe
Filesize
380KB

MD5
df70e56aba9be11c74c65ad8b84b969c

SHA1
c8d8eb4803a2aaecb55e74016e1f945fdd15e016

SHA256
0a5f258f088df268a919531ada9b3ff6ccdb2ff011e4d8daa73dd7c477967981

SHA512
074dbe0b8acf91af5c825260280cbb29d5aad7d66240b5f841f66fe19fb1f7497725b18563f1b247ed31a165a9d5b5ef410c1355fbaebb2c7eaf6835f56109f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8162725.exe
Filesize
380KB

MD5
df70e56aba9be11c74c65ad8b84b969c

SHA1
c8d8eb4803a2aaecb55e74016e1f945fdd15e016

SHA256
0a5f258f088df268a919531ada9b3ff6ccdb2ff011e4d8daa73dd7c477967981

SHA512
074dbe0b8acf91af5c825260280cbb29d5aad7d66240b5f841f66fe19fb1f7497725b18563f1b247ed31a165a9d5b5ef410c1355fbaebb2c7eaf6835f56109f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1793965.exe
Filesize
337KB

MD5
0c8c237d1ee9852e9a4603b37dd09a09

SHA1
951a3b4d46be2855cf022c25eab6b3838a801c4b

SHA256
db7b5ae513574ae08eb5c5981cff95b7160a5370014b5edf36938daa962c6b01

SHA512
d0d8c82e547c7876459aeebcd03bb398a1f7d222d42350229b96b9160d4c5ad0d0f7b61bc8ac290ccdeea61390ba19dfdf1021c069278fbe2d81a6f2031053c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1793965.exe
Filesize
337KB

MD5
0c8c237d1ee9852e9a4603b37dd09a09

SHA1
951a3b4d46be2855cf022c25eab6b3838a801c4b

SHA256
db7b5ae513574ae08eb5c5981cff95b7160a5370014b5edf36938daa962c6b01

SHA512
d0d8c82e547c7876459aeebcd03bb398a1f7d222d42350229b96b9160d4c5ad0d0f7b61bc8ac290ccdeea61390ba19dfdf1021c069278fbe2d81a6f2031053c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6464337.exe
Filesize
217KB

MD5
590d5218a240695b1eb85f228ef03fdd

SHA1
edcc4b67e0e08bec19a935ae30e2f3f0923d97bc

SHA256
d7c9381c40d542dbd7c3239c163f406ca4c03e8d6fb8fe41b5ca1d29693b3637

SHA512
c29871693b0d440c2a90236bf1caa6454c4f38fdbc41847d9de699f19c6a5f053e7991205cdb45deb1c90bb1e5f3a1b6f01b3219eede2270007bfa25354c1e25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6464337.exe
Filesize
217KB

MD5
590d5218a240695b1eb85f228ef03fdd

SHA1
edcc4b67e0e08bec19a935ae30e2f3f0923d97bc

SHA256
d7c9381c40d542dbd7c3239c163f406ca4c03e8d6fb8fe41b5ca1d29693b3637

SHA512
c29871693b0d440c2a90236bf1caa6454c4f38fdbc41847d9de699f19c6a5f053e7991205cdb45deb1c90bb1e5f3a1b6f01b3219eede2270007bfa25354c1e25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2369954.exe
Filesize
346KB

MD5
ac70c87ab4855c714b63d1c84a5337d5

SHA1
7e10d8a2cb2bce3e310b050cc3d462778a5d986f

SHA256
640f962ffdce6a0f6509cfa3e8af12416e52137a2524db91dac4b3173922744c

SHA512
4aa340e5e0afd47917b7008ee902c51c6122b8bff90ecc77c6e8820cda7a310c44ed3d344b4ac304dd8360c0267dd8779f94b208afdd1f37336c6a8856a5a317

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2369954.exe
Filesize
346KB

MD5
ac70c87ab4855c714b63d1c84a5337d5

SHA1
7e10d8a2cb2bce3e310b050cc3d462778a5d986f

SHA256
640f962ffdce6a0f6509cfa3e8af12416e52137a2524db91dac4b3173922744c

SHA512
4aa340e5e0afd47917b7008ee902c51c6122b8bff90ecc77c6e8820cda7a310c44ed3d344b4ac304dd8360c0267dd8779f94b208afdd1f37336c6a8856a5a317

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
273B

MD5
0c459e65bcc6d38574f0c0d63a87088a

SHA1
41e53d5f2b3e7ca859b842a1c7b677e0847e6d65

SHA256
871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4

SHA512
be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/1160-42-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1160-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1160-40-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1160-41-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2324-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/2324-79-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/2324-71-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/2324-36-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/3804-78-0x0000000004E60000-0x0000000004F6A000-memory.dmp

Filesize
1.0MB

Download
memory/3804-80-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/3804-88-0x0000000004D40000-0x0000000004D50000-memory.dmp

Filesize
64KB

Download
memory/3804-87-0x0000000004DE0000-0x0000000004E2C000-memory.dmp

Filesize
304KB

Download
memory/3804-86-0x0000000004D90000-0x0000000004DCC000-memory.dmp

Filesize
240KB

Download
memory/3804-68-0x0000000005470000-0x0000000005A88000-memory.dmp

Filesize
6.1MB

Download
memory/3804-48-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3804-83-0x0000000004D20000-0x0000000004D32000-memory.dmp

Filesize
72KB

Download
memory/3804-84-0x0000000004D40000-0x0000000004D50000-memory.dmp

Filesize
64KB

Download
memory/3804-49-0x0000000073DC0000-0x0000000074570000-memory.dmp

Filesize
7.7MB

Download
memory/3804-50-0x0000000004CD0000-0x0000000004CD6000-memory.dmp

Filesize
24KB

Download