amadey | e19d14cd959ce02e0c0f84f955f5f47c4e4aad7001388cda6c37b3503a72f6b8

Analysis

max time kernel
148s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e19d14cd959ce02e0c0f84f955f5f47c4e4aad7001388cda6c37b3503a72f6b8.exe
Size

1.3MB
MD5

39539051e3ce6a6e3689195f9fde6a72
SHA1

6e6c6570c5b2eae3d2df3ddc1585564bc1fccd67
SHA256

e19d14cd959ce02e0c0f84f955f5f47c4e4aad7001388cda6c37b3503a72f6b8
SHA512

aa269844399515ecb2db813d8d31968a673668bb004e66ec9efd5f99343e7a2ac84204eb9bb2ae9d2208e5090aa4429b0af43d96488dcfc95b5b440b5fc59af3
SSDEEP

24576:+yaBtvQzE5Na2nXL9WlDv6UVRYrNEercGQU47O/KOy+VsgQOhT0:NaBtEEtXL9W42RYBXoU8OSSVsPs

Score

10^/10

amadey healer mystic redline gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/3820-40-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3820-41-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3820-42-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/3820-44-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/3168-35-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	t6404480.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	u6859263.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 16 IoCs

pid	Process
4344	z4870533.exe
2556	z2885324.exe
2788	z1209033.exe
5080	z2893663.exe
2204	q0793912.exe
1476	r0347317.exe
2140	s6445815.exe
2224	t6404480.exe
3868	explonde.exe
1112	u6859263.exe
2036	legota.exe
3396	w2743564.exe
3892	explonde.exe
3344	legota.exe
1292	explonde.exe
5064	legota.exe

Loads dropped DLL 2 IoCs

pid	Process
1680	rundll32.exe
1432	rundll32.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	e19d14cd959ce02e0c0f84f955f5f47c4e4aad7001388cda6c37b3503a72f6b8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z4870533.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z2885324.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z1209033.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z2893663.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2204 set thread context of 3168	2204	q0793912.exe	91
PID 1476 set thread context of 3820	1476	r0347317.exe	99
PID 2140 set thread context of 4492	2140	s6445815.exe	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1068	2204	WerFault.exe	89
2936	1476	WerFault.exe	95
1000	3820	WerFault.exe	99
2880	2140	WerFault.exe	105

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4356	schtasks.exe
4664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3168	AppLaunch.exe
3168	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3168	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4344	4292	e19d14cd959ce02e0c0f84f955f5f47c4e4aad7001388cda6c37b3503a72f6b8.exe	85
PID 4292 wrote to memory of 4344	4292	e19d14cd959ce02e0c0f84f955f5f47c4e4aad7001388cda6c37b3503a72f6b8.exe	85
PID 4292 wrote to memory of 4344	4292	e19d14cd959ce02e0c0f84f955f5f47c4e4aad7001388cda6c37b3503a72f6b8.exe	85
PID 4344 wrote to memory of 2556	4344	z4870533.exe	86
PID 4344 wrote to memory of 2556	4344	z4870533.exe	86
PID 4344 wrote to memory of 2556	4344	z4870533.exe	86
PID 2556 wrote to memory of 2788	2556	z2885324.exe	87
PID 2556 wrote to memory of 2788	2556	z2885324.exe	87
PID 2556 wrote to memory of 2788	2556	z2885324.exe	87
PID 2788 wrote to memory of 5080	2788	z1209033.exe	88
PID 2788 wrote to memory of 5080	2788	z1209033.exe	88
PID 2788 wrote to memory of 5080	2788	z1209033.exe	88
PID 5080 wrote to memory of 2204	5080	z2893663.exe	89
PID 5080 wrote to memory of 2204	5080	z2893663.exe	89
PID 5080 wrote to memory of 2204	5080	z2893663.exe	89
PID 2204 wrote to memory of 3168	2204	q0793912.exe	91
PID 2204 wrote to memory of 3168	2204	q0793912.exe	91
PID 2204 wrote to memory of 3168	2204	q0793912.exe	91
PID 2204 wrote to memory of 3168	2204	q0793912.exe	91
PID 2204 wrote to memory of 3168	2204	q0793912.exe	91
PID 2204 wrote to memory of 3168	2204	q0793912.exe	91
PID 2204 wrote to memory of 3168	2204	q0793912.exe	91
PID 2204 wrote to memory of 3168	2204	q0793912.exe	91
PID 5080 wrote to memory of 1476	5080	z2893663.exe	95
PID 5080 wrote to memory of 1476	5080	z2893663.exe	95
PID 5080 wrote to memory of 1476	5080	z2893663.exe	95
PID 1476 wrote to memory of 3820	1476	r0347317.exe	99
PID 1476 wrote to memory of 3820	1476	r0347317.exe	99
PID 1476 wrote to memory of 3820	1476	r0347317.exe	99
PID 1476 wrote to memory of 3820	1476	r0347317.exe	99
PID 1476 wrote to memory of 3820	1476	r0347317.exe	99
PID 1476 wrote to memory of 3820	1476	r0347317.exe	99
PID 1476 wrote to memory of 3820	1476	r0347317.exe	99
PID 1476 wrote to memory of 3820	1476	r0347317.exe	99
PID 1476 wrote to memory of 3820	1476	r0347317.exe	99
PID 1476 wrote to memory of 3820	1476	r0347317.exe	99
PID 2788 wrote to memory of 2140	2788	z1209033.exe	105
PID 2788 wrote to memory of 2140	2788	z1209033.exe	105
PID 2788 wrote to memory of 2140	2788	z1209033.exe	105
PID 2140 wrote to memory of 4492	2140	s6445815.exe	108
PID 2140 wrote to memory of 4492	2140	s6445815.exe	108
PID 2140 wrote to memory of 4492	2140	s6445815.exe	108
PID 2140 wrote to memory of 4492	2140	s6445815.exe	108
PID 2140 wrote to memory of 4492	2140	s6445815.exe	108
PID 2140 wrote to memory of 4492	2140	s6445815.exe	108
PID 2140 wrote to memory of 4492	2140	s6445815.exe	108
PID 2140 wrote to memory of 4492	2140	s6445815.exe	108
PID 2556 wrote to memory of 2224	2556	z2885324.exe	111
PID 2556 wrote to memory of 2224	2556	z2885324.exe	111
PID 2556 wrote to memory of 2224	2556	z2885324.exe	111
PID 2224 wrote to memory of 3868	2224	t6404480.exe	112
PID 2224 wrote to memory of 3868	2224	t6404480.exe	112
PID 2224 wrote to memory of 3868	2224	t6404480.exe	112
PID 4344 wrote to memory of 1112	4344	z4870533.exe	113
PID 4344 wrote to memory of 1112	4344	z4870533.exe	113
PID 4344 wrote to memory of 1112	4344	z4870533.exe	113
PID 3868 wrote to memory of 4356	3868	explonde.exe	114
PID 3868 wrote to memory of 4356	3868	explonde.exe	114
PID 3868 wrote to memory of 4356	3868	explonde.exe	114
PID 1112 wrote to memory of 2036	1112	u6859263.exe	117
PID 1112 wrote to memory of 2036	1112	u6859263.exe	117
PID 1112 wrote to memory of 2036	1112	u6859263.exe	117
PID 3868 wrote to memory of 2160	3868	explonde.exe	116
PID 3868 wrote to memory of 2160	3868	explonde.exe	116

C:\Users\Admin\AppData\Local\Temp\e19d14cd959ce02e0c0f84f955f5f47c4e4aad7001388cda6c37b3503a72f6b8.exe
"C:\Users\Admin\AppData\Local\Temp\e19d14cd959ce02e0c0f84f955f5f47c4e4aad7001388cda6c37b3503a72f6b8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4870533.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4870533.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2885324.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2885324.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1209033.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1209033.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2893663.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2893663.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0793912.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0793912.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 140
        7⤵
        Program crash
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0347317.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0347317.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1476
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 540
        8⤵
        Program crash
        
        PID:1000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1476 -s 216
        7⤵
        Program crash
        
        PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6445815.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6445815.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2140
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4492
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2140 -s 148
        6⤵
        Program crash
        
        PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6404480.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6404480.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3868
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4356
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        7⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        7⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:8
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:1444
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:1680
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6859263.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6859263.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:2036
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:4664
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:4832
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2912
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:5012
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:2864
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3100
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:3848
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:900
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:1432
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2743564.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2743564.exe
  2⤵
  - Executes dropped EXE
  PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2204 -ip 2204
1⤵
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1476 -ip 1476
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3820 -ip 3820
1⤵
PID:2628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2140 -ip 2140
1⤵
PID:4952

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:3892

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:3344

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1292

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2743564.exe

Filesize
22KB

MD5
4fccc7a6d21e963fbeda99b161d8f73d

SHA1
305670ee8743ce9a41bd774b90360ee7af7e770f

SHA256
a3bf10486c37e596872cddaa3263c0040a7d3d40d737bf3419f97d444139b390

SHA512
ad9072984e292ae5f0d788ec9dfb33f3bf8e9bedd9d88cd451b525a424366da842c3cdba2403e472064f98476db6653e551ef5673c25af3c925dae27b35f6794

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2743564.exe

Filesize
22KB

MD5
4fccc7a6d21e963fbeda99b161d8f73d

SHA1
305670ee8743ce9a41bd774b90360ee7af7e770f

SHA256
a3bf10486c37e596872cddaa3263c0040a7d3d40d737bf3419f97d444139b390

SHA512
ad9072984e292ae5f0d788ec9dfb33f3bf8e9bedd9d88cd451b525a424366da842c3cdba2403e472064f98476db6653e551ef5673c25af3c925dae27b35f6794

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4870533.exe

Filesize
1.2MB

MD5
4a12f3d255e8cbd48a23e7ed4cc49482

SHA1
64b5b9711d827fca0d29cdaa7a86836a08771f94

SHA256
2b83b4653508450525f2305853833e8556184f75230615b0df511836fb8bafbf

SHA512
9301b3767e490bac5b8ca9fb21c7e93528172ceec88afb32cb989119e0c821cbfd08475ae0f7b50686df6d17c0305656a707ec4bcbfa322b25b2deead315cf89

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4870533.exe

Filesize
1.2MB

MD5
4a12f3d255e8cbd48a23e7ed4cc49482

SHA1
64b5b9711d827fca0d29cdaa7a86836a08771f94

SHA256
2b83b4653508450525f2305853833e8556184f75230615b0df511836fb8bafbf

SHA512
9301b3767e490bac5b8ca9fb21c7e93528172ceec88afb32cb989119e0c821cbfd08475ae0f7b50686df6d17c0305656a707ec4bcbfa322b25b2deead315cf89

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6859263.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6859263.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2885324.exe

Filesize
1.0MB

MD5
8b20791e0b254f869c170216c1806c9a

SHA1
7e5a653d2a7ed6362c603b333a98263beb2fb11d

SHA256
4c1960b09d7922326857bec49db79c4a9227d315c1762223d7be896a6e16d479

SHA512
fdd1692a50f0496ee5f97aa8760aaa5374893c8f5b0219e66fa7ac1ac3c9cc3e4f7531c7df1046b127447e61336afb515e0b6164417951977f7025310f7c2707

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2885324.exe

Filesize
1.0MB

MD5
8b20791e0b254f869c170216c1806c9a

SHA1
7e5a653d2a7ed6362c603b333a98263beb2fb11d

SHA256
4c1960b09d7922326857bec49db79c4a9227d315c1762223d7be896a6e16d479

SHA512
fdd1692a50f0496ee5f97aa8760aaa5374893c8f5b0219e66fa7ac1ac3c9cc3e4f7531c7df1046b127447e61336afb515e0b6164417951977f7025310f7c2707

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6404480.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6404480.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1209033.exe

Filesize
887KB

MD5
0a1fca2f27b5958e6e6991f5a74e92ed

SHA1
844e1298111e9a1a418e612a90e852e5a36989a4

SHA256
49839f1e0ad3a6f607c50b477cf9ba5241fce689b2c8b0ab1799f203d6c5622e

SHA512
ffbdbf1f013bb3b89c15774ee34dd33f62ef04f627bad17569e188bc01c0c8fdaa111f794ecb64ba62865dd59a3eebb2287c028026217beaa1aa5efc51a5761a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1209033.exe

Filesize
887KB

MD5
0a1fca2f27b5958e6e6991f5a74e92ed

SHA1
844e1298111e9a1a418e612a90e852e5a36989a4

SHA256
49839f1e0ad3a6f607c50b477cf9ba5241fce689b2c8b0ab1799f203d6c5622e

SHA512
ffbdbf1f013bb3b89c15774ee34dd33f62ef04f627bad17569e188bc01c0c8fdaa111f794ecb64ba62865dd59a3eebb2287c028026217beaa1aa5efc51a5761a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6445815.exe

Filesize
1.0MB

MD5
eabb4cb5a539f9543c3d413543fbead4

SHA1
0b9e1ae92d8d2d9aadbadac240b5b53848e816f9

SHA256
749c9a23e6bdf5b1f6710dc12940fc96e5ed783d4aa9c7d4a9854556214a9ecc

SHA512
91525c1f16f5a4eb0a68d2fe83cf0efd61f19526b35c866eaf90944fc128dd094d110a7eb34562e1af3518b76c14f54bbde1a549a9db5e598b8513dd9f1cfe49

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6445815.exe

Filesize
1.0MB

MD5
eabb4cb5a539f9543c3d413543fbead4

SHA1
0b9e1ae92d8d2d9aadbadac240b5b53848e816f9

SHA256
749c9a23e6bdf5b1f6710dc12940fc96e5ed783d4aa9c7d4a9854556214a9ecc

SHA512
91525c1f16f5a4eb0a68d2fe83cf0efd61f19526b35c866eaf90944fc128dd094d110a7eb34562e1af3518b76c14f54bbde1a549a9db5e598b8513dd9f1cfe49

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2893663.exe

Filesize
495KB

MD5
458f2c798e22abd08247aa86edf17042

SHA1
372310ede5dfce51178ada95e9eaf2772c00851f

SHA256
040fd2a34e2521914fb60c9603ae04059e1657504f5c47b37cc9c6934672729f

SHA512
42e1189f00a8487914fd3649b422f769d6057e6fcf1ca122a5c03a36c583298652aa40926d29ca977bfabc2f2bd6d351d406621757b3e2daed836c8cf9bee5a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2893663.exe

Filesize
495KB

MD5
458f2c798e22abd08247aa86edf17042

SHA1
372310ede5dfce51178ada95e9eaf2772c00851f

SHA256
040fd2a34e2521914fb60c9603ae04059e1657504f5c47b37cc9c6934672729f

SHA512
42e1189f00a8487914fd3649b422f769d6057e6fcf1ca122a5c03a36c583298652aa40926d29ca977bfabc2f2bd6d351d406621757b3e2daed836c8cf9bee5a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0793912.exe

Filesize
860KB

MD5
567afe2dd95f14b6f39258250ae13724

SHA1
a426612c5bdfc13ce089fd16648e1f217344f3a8

SHA256
b3db3bb79df6b39d106a998beb0e269055df8848245d1f2b00ab997c264fe674

SHA512
b85a29a7ab3e937ed3c9f66a7cd710596c93ead8fc87e4f753e36014f6df62bdad8a18cff05a3833daa24fcfe867210684528eaa4f8ddc9462a5870bd589e6bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0793912.exe

Filesize
860KB

MD5
567afe2dd95f14b6f39258250ae13724

SHA1
a426612c5bdfc13ce089fd16648e1f217344f3a8

SHA256
b3db3bb79df6b39d106a998beb0e269055df8848245d1f2b00ab997c264fe674

SHA512
b85a29a7ab3e937ed3c9f66a7cd710596c93ead8fc87e4f753e36014f6df62bdad8a18cff05a3833daa24fcfe867210684528eaa4f8ddc9462a5870bd589e6bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0347317.exe

Filesize
1016KB

MD5
ee90f298dc0a3a2ec45588520a64f42d

SHA1
389971144a9acaa35e1b35decd25eafa6d53c72f

SHA256
743e92104305513337235a6bb44731fef82c0b4f635602d44cfd0b0b7bf6f17f

SHA512
052499c85aa2a7695c851951b2b62f7d0aecce89b1f01acf63d88b70b326e351f6309450ffc64a898cd2d9c1cf008d881a792deda3abf3e691707eaab0d398f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0347317.exe

Filesize
1016KB

MD5
ee90f298dc0a3a2ec45588520a64f42d

SHA1
389971144a9acaa35e1b35decd25eafa6d53c72f

SHA256
743e92104305513337235a6bb44731fef82c0b4f635602d44cfd0b0b7bf6f17f

SHA512
052499c85aa2a7695c851951b2b62f7d0aecce89b1f01acf63d88b70b326e351f6309450ffc64a898cd2d9c1cf008d881a792deda3abf3e691707eaab0d398f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
0c459e65bcc6d38574f0c0d63a87088a

SHA1
41e53d5f2b3e7ca859b842a1c7b677e0847e6d65

SHA256
871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4

SHA512
be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/3168-86-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/3168-36-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/3168-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3168-84-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/3820-40-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3820-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3820-41-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3820-42-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4492-57-0x00000000051E0000-0x00000000052EA000-memory.dmp

Filesize
1.0MB

Download
memory/4492-58-0x0000000004F00000-0x0000000004F12000-memory.dmp

Filesize
72KB

Download
memory/4492-59-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download
memory/4492-87-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/4492-56-0x00000000056F0000-0x0000000005D08000-memory.dmp

Filesize
6.1MB

Download
memory/4492-50-0x0000000002820000-0x0000000002826000-memory.dmp

Filesize
24KB

Download
memory/4492-49-0x0000000074890000-0x0000000075040000-memory.dmp

Filesize
7.7MB

Download
memory/4492-48-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4492-61-0x0000000004F60000-0x0000000004F9C000-memory.dmp

Filesize
240KB

Download
memory/4492-68-0x00000000050D0000-0x000000000511C000-memory.dmp

Filesize
304KB

Download
memory/4492-88-0x0000000004FC0000-0x0000000004FD0000-memory.dmp

Filesize
64KB

Download