amadey | addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b

Analysis

max time kernel
155s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b.exe
Size

1.3MB
MD5

85a90bbf8c4498f6b6e8155c00cc1cdb
SHA1

6da94e24761dbe288516a6c701232703b34ca477
SHA256

addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b
SHA512

f2573ccaddecd258d636ccdfd2be6b57c687cb40a829680bb6d183a854c77ad4001b8d354d090d96f5705bb64583dbe4bf9424ceec4726a015002c319919aa43
SSDEEP

24576:eybS9ej9JR8BCYsZWJBY8aWVtnO8Lldi/LQLbStMb/1SR64qKsm2WRlLYtRx0:tbSmDR8B5sZsi4nO8KntCSR64/H9wR

Score

10^/10

amadey healer mystic redline gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/4156-41-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4156-43-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4156-44-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4156-46-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/3396-35-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	t1434449.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	u9151278.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 14 IoCs

pid	Process
544	z0616722.exe
4668	z2784005.exe
5100	z5631318.exe
2680	z2485652.exe
1544	q0713940.exe
3684	r5212841.exe
3456	s2359306.exe
1692	t1434449.exe
4040	explonde.exe
3744	u9151278.exe
1316	legota.exe
372	w9733101.exe
4536	legota.exe
1168	explonde.exe

Loads dropped DLL 2 IoCs

pid	Process
4512	rundll32.exe
5052	rundll32.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z5631318.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z2485652.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z0616722.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z2784005.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 3396	1544	q0713940.exe	94
PID 3684 set thread context of 4156	3684	r5212841.exe	102
PID 3456 set thread context of 3832	3456	s2359306.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3716	1544	WerFault.exe	92
3740	3684	WerFault.exe	100
4952	4156	WerFault.exe	102
2076	3456	WerFault.exe	107

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
232	schtasks.exe
3152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3396	AppLaunch.exe
3396	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3396	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 544	972	addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b.exe	88
PID 972 wrote to memory of 544	972	addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b.exe	88
PID 972 wrote to memory of 544	972	addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b.exe	88
PID 544 wrote to memory of 4668	544	z0616722.exe	89
PID 544 wrote to memory of 4668	544	z0616722.exe	89
PID 544 wrote to memory of 4668	544	z0616722.exe	89
PID 4668 wrote to memory of 5100	4668	z2784005.exe	90
PID 4668 wrote to memory of 5100	4668	z2784005.exe	90
PID 4668 wrote to memory of 5100	4668	z2784005.exe	90
PID 5100 wrote to memory of 2680	5100	z5631318.exe	91
PID 5100 wrote to memory of 2680	5100	z5631318.exe	91
PID 5100 wrote to memory of 2680	5100	z5631318.exe	91
PID 2680 wrote to memory of 1544	2680	z2485652.exe	92
PID 2680 wrote to memory of 1544	2680	z2485652.exe	92
PID 2680 wrote to memory of 1544	2680	z2485652.exe	92
PID 1544 wrote to memory of 3396	1544	q0713940.exe	94
PID 1544 wrote to memory of 3396	1544	q0713940.exe	94
PID 1544 wrote to memory of 3396	1544	q0713940.exe	94
PID 1544 wrote to memory of 3396	1544	q0713940.exe	94
PID 1544 wrote to memory of 3396	1544	q0713940.exe	94
PID 1544 wrote to memory of 3396	1544	q0713940.exe	94
PID 1544 wrote to memory of 3396	1544	q0713940.exe	94
PID 1544 wrote to memory of 3396	1544	q0713940.exe	94
PID 2680 wrote to memory of 3684	2680	z2485652.exe	100
PID 2680 wrote to memory of 3684	2680	z2485652.exe	100
PID 2680 wrote to memory of 3684	2680	z2485652.exe	100
PID 3684 wrote to memory of 4156	3684	r5212841.exe	102
PID 3684 wrote to memory of 4156	3684	r5212841.exe	102
PID 3684 wrote to memory of 4156	3684	r5212841.exe	102
PID 3684 wrote to memory of 4156	3684	r5212841.exe	102
PID 3684 wrote to memory of 4156	3684	r5212841.exe	102
PID 3684 wrote to memory of 4156	3684	r5212841.exe	102
PID 3684 wrote to memory of 4156	3684	r5212841.exe	102
PID 3684 wrote to memory of 4156	3684	r5212841.exe	102
PID 3684 wrote to memory of 4156	3684	r5212841.exe	102
PID 3684 wrote to memory of 4156	3684	r5212841.exe	102
PID 5100 wrote to memory of 3456	5100	z5631318.exe	107
PID 5100 wrote to memory of 3456	5100	z5631318.exe	107
PID 5100 wrote to memory of 3456	5100	z5631318.exe	107
PID 3456 wrote to memory of 3832	3456	s2359306.exe	109
PID 3456 wrote to memory of 3832	3456	s2359306.exe	109
PID 3456 wrote to memory of 3832	3456	s2359306.exe	109
PID 3456 wrote to memory of 3832	3456	s2359306.exe	109
PID 3456 wrote to memory of 3832	3456	s2359306.exe	109
PID 3456 wrote to memory of 3832	3456	s2359306.exe	109
PID 3456 wrote to memory of 3832	3456	s2359306.exe	109
PID 3456 wrote to memory of 3832	3456	s2359306.exe	109
PID 4668 wrote to memory of 1692	4668	z2784005.exe	112
PID 4668 wrote to memory of 1692	4668	z2784005.exe	112
PID 4668 wrote to memory of 1692	4668	z2784005.exe	112
PID 1692 wrote to memory of 4040	1692	t1434449.exe	113
PID 1692 wrote to memory of 4040	1692	t1434449.exe	113
PID 1692 wrote to memory of 4040	1692	t1434449.exe	113
PID 544 wrote to memory of 3744	544	z0616722.exe	114
PID 544 wrote to memory of 3744	544	z0616722.exe	114
PID 544 wrote to memory of 3744	544	z0616722.exe	114
PID 3744 wrote to memory of 1316	3744	u9151278.exe	116
PID 3744 wrote to memory of 1316	3744	u9151278.exe	116
PID 3744 wrote to memory of 1316	3744	u9151278.exe	116
PID 4040 wrote to memory of 232	4040	explonde.exe	115
PID 4040 wrote to memory of 232	4040	explonde.exe	115
PID 4040 wrote to memory of 232	4040	explonde.exe	115
PID 972 wrote to memory of 372	972	addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b.exe	119
PID 972 wrote to memory of 372	972	addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b.exe	119

C:\Users\Admin\AppData\Local\Temp\addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b.exe
"C:\Users\Admin\AppData\Local\Temp\addb2b5d86bb593534df3bfe5b5eebfb172b797ad2bf86fc5b1dbecfaa4c3a7b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:972
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0616722.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0616722.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2784005.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2784005.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5631318.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5631318.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2485652.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2485652.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2680
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0713940.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0713940.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3396
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 140
        7⤵
        Program crash
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5212841.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5212841.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4156 -s 192
        8⤵
        Program crash
        
        PID:4952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3684 -s 148
        7⤵
        Program crash
        
        PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2359306.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2359306.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3456
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3832
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 608
        6⤵
        Program crash
        
        PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1434449.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1434449.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4040
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:232
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        7⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        7⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3128
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:4248
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:5052
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9151278.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9151278.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:1316
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3152
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:4896
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1424
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:3264
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:2740
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2708
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:3612
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:996
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:4512
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9733101.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9733101.exe
  2⤵
  - Executes dropped EXE
  PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1544 -ip 1544
1⤵
PID:1764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3684 -ip 3684
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4156 -ip 4156
1⤵
PID:1488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3456 -ip 3456
1⤵
PID:1652

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:4536

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9733101.exe

Filesize
22KB

MD5
e660d0316c0d087e14b08114be6aeefd

SHA1
5a28afa585e366ce8302a8cf5847651134642292

SHA256
36f83a7e8e6de09cf4c3048e12b14ae9afe132d689c7660710aef39ac3b67024

SHA512
ab38a60ba44b9c160c92a9d53a93a24c327c95c4332800f7538f2104ec6e460b8a8ba35f3076b0878cfbe5e687ec9312a318a930d25fa159692ea87ce65ccc84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9733101.exe

Filesize
22KB

MD5
e660d0316c0d087e14b08114be6aeefd

SHA1
5a28afa585e366ce8302a8cf5847651134642292

SHA256
36f83a7e8e6de09cf4c3048e12b14ae9afe132d689c7660710aef39ac3b67024

SHA512
ab38a60ba44b9c160c92a9d53a93a24c327c95c4332800f7538f2104ec6e460b8a8ba35f3076b0878cfbe5e687ec9312a318a930d25fa159692ea87ce65ccc84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0616722.exe

Filesize
1.2MB

MD5
a6903bf937de8eff8ce4ef52692c82cc

SHA1
b643783ef4683bf3847769db2aa13fbdff1e7b92

SHA256
c96dedf865300f6b85b3641fe85700852db32d08dec4370bf27002aa2f002204

SHA512
f10c4962d25d34222920807e33b0caf00b4e1e2c9b1feafe4222a034448b9944ffc9e23605429b8321c0da58e6647114bb67e0570028604bd99b7c467ba9f5f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0616722.exe

Filesize
1.2MB

MD5
a6903bf937de8eff8ce4ef52692c82cc

SHA1
b643783ef4683bf3847769db2aa13fbdff1e7b92

SHA256
c96dedf865300f6b85b3641fe85700852db32d08dec4370bf27002aa2f002204

SHA512
f10c4962d25d34222920807e33b0caf00b4e1e2c9b1feafe4222a034448b9944ffc9e23605429b8321c0da58e6647114bb67e0570028604bd99b7c467ba9f5f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9151278.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9151278.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2784005.exe

Filesize
1.0MB

MD5
be8316fcc9b35c0f9f999a43c3607aa4

SHA1
d0e131182954df4e5bb06f5ee16f1bf399566405

SHA256
677524a0e50d41fd106bdda9ff9d3c03ee2e8e67ab9c02f289832b19424625cb

SHA512
eedaf2abfd2d96474a7125f86c94c5d37e2dae457708ecbb9825e4006e48eb336581375230c09bca997473c5c2a9046da09bc39777973ac850e8c901d54a9b9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2784005.exe

Filesize
1.0MB

MD5
be8316fcc9b35c0f9f999a43c3607aa4

SHA1
d0e131182954df4e5bb06f5ee16f1bf399566405

SHA256
677524a0e50d41fd106bdda9ff9d3c03ee2e8e67ab9c02f289832b19424625cb

SHA512
eedaf2abfd2d96474a7125f86c94c5d37e2dae457708ecbb9825e4006e48eb336581375230c09bca997473c5c2a9046da09bc39777973ac850e8c901d54a9b9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1434449.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1434449.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5631318.exe

Filesize
885KB

MD5
c76ff5274f0790c0fe31ab121ebf2da8

SHA1
3112b48104c4e7ab44325ba78cb3bec31db43346

SHA256
a787445d1b4b00328ee14e5452c65c503724f5506be9e69d210a24ab077e883a

SHA512
7bbd4c1c5522b6bbe08ca38c7d85e9eb361c8c92dba4fd32416716c6fbd49effcdbe4726c9b62356e0519e3052b971698a7234c885a9cf853d2f3c6686937ed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5631318.exe

Filesize
885KB

MD5
c76ff5274f0790c0fe31ab121ebf2da8

SHA1
3112b48104c4e7ab44325ba78cb3bec31db43346

SHA256
a787445d1b4b00328ee14e5452c65c503724f5506be9e69d210a24ab077e883a

SHA512
7bbd4c1c5522b6bbe08ca38c7d85e9eb361c8c92dba4fd32416716c6fbd49effcdbe4726c9b62356e0519e3052b971698a7234c885a9cf853d2f3c6686937ed8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2359306.exe

Filesize
1.0MB

MD5
255c65c6c0c05fcc71adfdb276ff8286

SHA1
5571f043d04c871af86ea38c82fae30107686d78

SHA256
0a522f036c6455f6430fbc0a79d593a0c67fb5dcdfd35f7e624f6a8dc243509c

SHA512
76d9e0ada2459ce671e4371c731f62ae9f4977ceda2cb8d8abfc8d786d73da1210893bd64cc8f965b3944d00994a2006f6a04849d9654a197328eab61455877b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2359306.exe

Filesize
1.0MB

MD5
255c65c6c0c05fcc71adfdb276ff8286

SHA1
5571f043d04c871af86ea38c82fae30107686d78

SHA256
0a522f036c6455f6430fbc0a79d593a0c67fb5dcdfd35f7e624f6a8dc243509c

SHA512
76d9e0ada2459ce671e4371c731f62ae9f4977ceda2cb8d8abfc8d786d73da1210893bd64cc8f965b3944d00994a2006f6a04849d9654a197328eab61455877b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2485652.exe

Filesize
494KB

MD5
db6ae9fa3b01b46d839adb4c08b80510

SHA1
fe9ef34ceca4e7dad3e4e65a57061df869015f19

SHA256
fffddfe59fc75a6d185dc79c82c6963fbe2a637ae8d33ac6ca414248f5c13394

SHA512
7e3334c85b1ade4d203e1b3b030c741f19cf70dff707ddb9eaa6770c4de13e7c27713e69d0fe4437c34d6d99a512ff1c7dcb22635a34be096e69e317c62dfd5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2485652.exe

Filesize
494KB

MD5
db6ae9fa3b01b46d839adb4c08b80510

SHA1
fe9ef34ceca4e7dad3e4e65a57061df869015f19

SHA256
fffddfe59fc75a6d185dc79c82c6963fbe2a637ae8d33ac6ca414248f5c13394

SHA512
7e3334c85b1ade4d203e1b3b030c741f19cf70dff707ddb9eaa6770c4de13e7c27713e69d0fe4437c34d6d99a512ff1c7dcb22635a34be096e69e317c62dfd5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0713940.exe

Filesize
860KB

MD5
de30430355a4c4ddf98b0f255552e8dd

SHA1
3b98ae1450b79e2f9ef6f225834cc87156692eba

SHA256
d741f3bd3aa8fc1bd19bafdc0a1004495ee864d338d824d31ad6b703f7f6344b

SHA512
0111b0f94717b909810c714a7072d52f0f713eb4b8c36b7a503330f9bfeccfd9792b7ca4d131c5d96b2b896c79bcda2f7a02972e8a16cc71870c40b8ee01bdb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0713940.exe

Filesize
860KB

MD5
de30430355a4c4ddf98b0f255552e8dd

SHA1
3b98ae1450b79e2f9ef6f225834cc87156692eba

SHA256
d741f3bd3aa8fc1bd19bafdc0a1004495ee864d338d824d31ad6b703f7f6344b

SHA512
0111b0f94717b909810c714a7072d52f0f713eb4b8c36b7a503330f9bfeccfd9792b7ca4d131c5d96b2b896c79bcda2f7a02972e8a16cc71870c40b8ee01bdb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5212841.exe

Filesize
1016KB

MD5
5b5ae57dd73eb07799bea048604064d9

SHA1
b9427cb79f9eea330e3d598aadac1cc1c132362e

SHA256
1df4937970afadae4c077f777c457fe4b7aed268eb5c27359a2cf1b7932fe39f

SHA512
143aed2a874d9677694bece88d835b9c88c5bd13267f9c60348332bc613a49377ff6074c74cbc7f9edfb2f58cc39aff21b07a02501ecfd1c74ac1abbd4c24c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5212841.exe

Filesize
1016KB

MD5
5b5ae57dd73eb07799bea048604064d9

SHA1
b9427cb79f9eea330e3d598aadac1cc1c132362e

SHA256
1df4937970afadae4c077f777c457fe4b7aed268eb5c27359a2cf1b7932fe39f

SHA512
143aed2a874d9677694bece88d835b9c88c5bd13267f9c60348332bc613a49377ff6074c74cbc7f9edfb2f58cc39aff21b07a02501ecfd1c74ac1abbd4c24c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
0c459e65bcc6d38574f0c0d63a87088a

SHA1
41e53d5f2b3e7ca859b842a1c7b677e0847e6d65

SHA256
871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4

SHA512
be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/3396-37-0x0000000073DF0000-0x00000000745A0000-memory.dmp

Filesize
7.7MB

Download
memory/3396-47-0x0000000073DF0000-0x00000000745A0000-memory.dmp

Filesize
7.7MB

Download
memory/3396-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3396-36-0x0000000073DF0000-0x00000000745A0000-memory.dmp

Filesize
7.7MB

Download
memory/3832-63-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/3832-65-0x0000000004F60000-0x0000000004F9C000-memory.dmp

Filesize
240KB

Download
memory/3832-53-0x00000000734A0000-0x0000000073C50000-memory.dmp

Filesize
7.7MB

Download
memory/3832-54-0x0000000004EA0000-0x0000000004EA6000-memory.dmp

Filesize
24KB

Download
memory/3832-89-0x0000000004ED0000-0x0000000004EE0000-memory.dmp

Filesize
64KB

Download
memory/3832-70-0x0000000005100000-0x000000000514C000-memory.dmp

Filesize
304KB

Download
memory/3832-66-0x00000000734A0000-0x0000000073C50000-memory.dmp

Filesize
7.7MB

Download
memory/3832-60-0x0000000005500000-0x0000000005B18000-memory.dmp

Filesize
6.1MB

Download
memory/3832-62-0x0000000004F00000-0x0000000004F12000-memory.dmp

Filesize
72KB

Download
memory/3832-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3832-61-0x0000000004FF0000-0x00000000050FA000-memory.dmp

Filesize
1.0MB

Download
memory/4156-41-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4156-46-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4156-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4156-43-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download