amadey | 604b728b42ee4df22f9ca5ac383430f963f327f084eb809659e7afada4e6a408

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 09:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

604b728b42ee4df22f9ca5ac383430f963f327f084eb809659e7afada4e6a408.exe
Size

1.0MB
MD5

8433bd7314b2d3888b7913ddf6ba1eb3
SHA1

7de2722684733c5092fd63cc3b7c82d4756575c8
SHA256

604b728b42ee4df22f9ca5ac383430f963f327f084eb809659e7afada4e6a408
SHA512

5edee3d2ea8022b584fc8c16a580cce2c1b0ad275d5097d89e609cd749f3b065a4cf04425c92b2bb8095c1d714861b6868831732590ff32d84ed8136465b2b20
SSDEEP

12288:IMrwy90hZF/Y20cGlFricwpWy/mi3OV5KklFVmD6LU1A8reE9g05XcUDYESoii7x:Yy+rYficA/T3VkVmD0CaE7Evw7PRwK

Score

10^/10

amadey healer mystic redline gruha dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

gruha

77.91.124.55:19071

Attributes

auth_value
2f4cf2e668a540e64775b27535cc6892

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/4976-40-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4976-41-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4976-42-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/4976-44-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/3988-35-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	legota.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	t1627827.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	u0407943.exe

Executes dropped EXE 16 IoCs

pid	Process
4400	z0300128.exe
3040	z9553186.exe
380	z6706604.exe
5016	z1711343.exe
2084	q5582146.exe
5024	r6448056.exe
1420	s8648668.exe
1452	t1627827.exe
3236	explonde.exe
1116	u0407943.exe
4864	legota.exe
2648	w0216022.exe
116	explonde.exe
4624	legota.exe
1596	explonde.exe
2320	legota.exe

Loads dropped DLL 2 IoCs

pid	Process
5012	rundll32.exe
3032	rundll32.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	604b728b42ee4df22f9ca5ac383430f963f327f084eb809659e7afada4e6a408.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z0300128.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z9553186.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z6706604.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z1711343.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 3988	2084	q5582146.exe	92
PID 5024 set thread context of 4976	5024	r6448056.exe	99
PID 1420 set thread context of 3444	1420	s8648668.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1552	2084	WerFault.exe	90
5060	5024	WerFault.exe	96
3180	4976	WerFault.exe	99
4872	1420	WerFault.exe	104

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
5068	schtasks.exe
3732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3988	AppLaunch.exe
3988	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3988	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4084 wrote to memory of 4400	4084	604b728b42ee4df22f9ca5ac383430f963f327f084eb809659e7afada4e6a408.exe	86
PID 4084 wrote to memory of 4400	4084	604b728b42ee4df22f9ca5ac383430f963f327f084eb809659e7afada4e6a408.exe	86
PID 4084 wrote to memory of 4400	4084	604b728b42ee4df22f9ca5ac383430f963f327f084eb809659e7afada4e6a408.exe	86
PID 4400 wrote to memory of 3040	4400	z0300128.exe	87
PID 4400 wrote to memory of 3040	4400	z0300128.exe	87
PID 4400 wrote to memory of 3040	4400	z0300128.exe	87
PID 3040 wrote to memory of 380	3040	z9553186.exe	88
PID 3040 wrote to memory of 380	3040	z9553186.exe	88
PID 3040 wrote to memory of 380	3040	z9553186.exe	88
PID 380 wrote to memory of 5016	380	z6706604.exe	89
PID 380 wrote to memory of 5016	380	z6706604.exe	89
PID 380 wrote to memory of 5016	380	z6706604.exe	89
PID 5016 wrote to memory of 2084	5016	z1711343.exe	90
PID 5016 wrote to memory of 2084	5016	z1711343.exe	90
PID 5016 wrote to memory of 2084	5016	z1711343.exe	90
PID 2084 wrote to memory of 1916	2084	q5582146.exe	91
PID 2084 wrote to memory of 1916	2084	q5582146.exe	91
PID 2084 wrote to memory of 1916	2084	q5582146.exe	91
PID 2084 wrote to memory of 3988	2084	q5582146.exe	92
PID 2084 wrote to memory of 3988	2084	q5582146.exe	92
PID 2084 wrote to memory of 3988	2084	q5582146.exe	92
PID 2084 wrote to memory of 3988	2084	q5582146.exe	92
PID 2084 wrote to memory of 3988	2084	q5582146.exe	92
PID 2084 wrote to memory of 3988	2084	q5582146.exe	92
PID 2084 wrote to memory of 3988	2084	q5582146.exe	92
PID 2084 wrote to memory of 3988	2084	q5582146.exe	92
PID 5016 wrote to memory of 5024	5016	z1711343.exe	96
PID 5016 wrote to memory of 5024	5016	z1711343.exe	96
PID 5016 wrote to memory of 5024	5016	z1711343.exe	96
PID 5024 wrote to memory of 3808	5024	r6448056.exe	98
PID 5024 wrote to memory of 3808	5024	r6448056.exe	98
PID 5024 wrote to memory of 3808	5024	r6448056.exe	98
PID 5024 wrote to memory of 4976	5024	r6448056.exe	99
PID 5024 wrote to memory of 4976	5024	r6448056.exe	99
PID 5024 wrote to memory of 4976	5024	r6448056.exe	99
PID 5024 wrote to memory of 4976	5024	r6448056.exe	99
PID 5024 wrote to memory of 4976	5024	r6448056.exe	99
PID 5024 wrote to memory of 4976	5024	r6448056.exe	99
PID 5024 wrote to memory of 4976	5024	r6448056.exe	99
PID 5024 wrote to memory of 4976	5024	r6448056.exe	99
PID 5024 wrote to memory of 4976	5024	r6448056.exe	99
PID 5024 wrote to memory of 4976	5024	r6448056.exe	99
PID 380 wrote to memory of 1420	380	z6706604.exe	104
PID 380 wrote to memory of 1420	380	z6706604.exe	104
PID 380 wrote to memory of 1420	380	z6706604.exe	104
PID 1420 wrote to memory of 3444	1420	s8648668.exe	107
PID 1420 wrote to memory of 3444	1420	s8648668.exe	107
PID 1420 wrote to memory of 3444	1420	s8648668.exe	107
PID 1420 wrote to memory of 3444	1420	s8648668.exe	107
PID 1420 wrote to memory of 3444	1420	s8648668.exe	107
PID 1420 wrote to memory of 3444	1420	s8648668.exe	107
PID 1420 wrote to memory of 3444	1420	s8648668.exe	107
PID 1420 wrote to memory of 3444	1420	s8648668.exe	107
PID 3040 wrote to memory of 1452	3040	z9553186.exe	112
PID 3040 wrote to memory of 1452	3040	z9553186.exe	112
PID 3040 wrote to memory of 1452	3040	z9553186.exe	112
PID 1452 wrote to memory of 3236	1452	t1627827.exe	113
PID 1452 wrote to memory of 3236	1452	t1627827.exe	113
PID 1452 wrote to memory of 3236	1452	t1627827.exe	113
PID 4400 wrote to memory of 1116	4400	z0300128.exe	114
PID 4400 wrote to memory of 1116	4400	z0300128.exe	114
PID 4400 wrote to memory of 1116	4400	z0300128.exe	114
PID 3236 wrote to memory of 5068	3236	explonde.exe	117
PID 3236 wrote to memory of 5068	3236	explonde.exe	117

C:\Users\Admin\AppData\Local\Temp\604b728b42ee4df22f9ca5ac383430f963f327f084eb809659e7afada4e6a408.exe
"C:\Users\Admin\AppData\Local\Temp\604b728b42ee4df22f9ca5ac383430f963f327f084eb809659e7afada4e6a408.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0300128.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0300128.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4400
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9553186.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9553186.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6706604.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6706604.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:380
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1711343.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1711343.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5582146.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5582146.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1916
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 588
        7⤵
        Program crash
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6448056.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6448056.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:3808
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 540
        8⤵
        Program crash
        
        PID:3180
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 584
        7⤵
        Program crash
        
        PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8648668.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8648668.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1420
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:3444
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 552
        6⤵
        Program crash
        
        PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1627827.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1627827.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3236
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        7⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        7⤵
        
        PID:964
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:1148
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:5068
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:5012
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0407943.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0407943.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:1116
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:4864
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3732
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:4680
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:4856
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:536
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:3416
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1000
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:4560
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:1916
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:3032
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0216022.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0216022.exe
  2⤵
  - Executes dropped EXE
  PID:2648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2084 -ip 2084
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5024 -ip 5024
1⤵
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4976 -ip 4976
1⤵
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1420 -ip 1420
1⤵
PID:2288

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:116

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:4624

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1596

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:2320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0216022.exe

Filesize
22KB

MD5
1fcb7adc814bad49d79b1dc5fce4cdb7

SHA1
8fca61914c8133b3b6585af7409629e1a143de08

SHA256
8e73af836dbd3258f14a2120cfb0a2a50861e8ec44175ff3b7dfc66b8e57a0f4

SHA512
1fbdc87333531eaf599d8756dea298a0fd963942ed36bf11ddc524c6fa81a9b83f60fde9a5519b043d319ec83ea3645dc6061b9a76d5379f96bc285abadcadfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0216022.exe

Filesize
22KB

MD5
1fcb7adc814bad49d79b1dc5fce4cdb7

SHA1
8fca61914c8133b3b6585af7409629e1a143de08

SHA256
8e73af836dbd3258f14a2120cfb0a2a50861e8ec44175ff3b7dfc66b8e57a0f4

SHA512
1fbdc87333531eaf599d8756dea298a0fd963942ed36bf11ddc524c6fa81a9b83f60fde9a5519b043d319ec83ea3645dc6061b9a76d5379f96bc285abadcadfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0300128.exe

Filesize
960KB

MD5
2f678f32b4b614416177403886974f72

SHA1
c19104f56a5286211bbc1cced750eac9a0fccbc8

SHA256
6a7c25c9b8265ab06e6a021803b1ba2c53fd197b765a488f79ba1da1e188e1dc

SHA512
2915bbe1f521dedd72bac946be0b0bad05ac341f88905e7f4b4b7d1cbd0698527965bbd0c64c219aecf224c01098ef5980d783ad723bca2a37c28281bcf648e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0300128.exe

Filesize
960KB

MD5
2f678f32b4b614416177403886974f72

SHA1
c19104f56a5286211bbc1cced750eac9a0fccbc8

SHA256
6a7c25c9b8265ab06e6a021803b1ba2c53fd197b765a488f79ba1da1e188e1dc

SHA512
2915bbe1f521dedd72bac946be0b0bad05ac341f88905e7f4b4b7d1cbd0698527965bbd0c64c219aecf224c01098ef5980d783ad723bca2a37c28281bcf648e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0407943.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0407943.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9553186.exe

Filesize
777KB

MD5
9cc85cef6ae6b9bff93705fc230f0d12

SHA1
833300ae5dc7d13e6d26f6edf1d93eb966e85f49

SHA256
35eafed6c88e3c6e680b24601cc8ccdf41d4f73023b87f9ff87c297cebd1bfe4

SHA512
87343fc32e7dc1f557e549e8ffbf062feae7cbb33adfd3d54f4b23a1f1f6574f18ef3a8cdb53b170cfffb82a5a59e968a5f49eea20d30b4408143bd9fd437bf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9553186.exe

Filesize
777KB

MD5
9cc85cef6ae6b9bff93705fc230f0d12

SHA1
833300ae5dc7d13e6d26f6edf1d93eb966e85f49

SHA256
35eafed6c88e3c6e680b24601cc8ccdf41d4f73023b87f9ff87c297cebd1bfe4

SHA512
87343fc32e7dc1f557e549e8ffbf062feae7cbb33adfd3d54f4b23a1f1f6574f18ef3a8cdb53b170cfffb82a5a59e968a5f49eea20d30b4408143bd9fd437bf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1627827.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1627827.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6706604.exe

Filesize
595KB

MD5
2f76a51d7e42fabd183f4e6f1ee532f0

SHA1
4db239223fe23d32efa5e14437d0d0fa5f08f2af

SHA256
695376c657ebef5cb667e6547921907475ad6fdc5d162e5b54940812e9b9dac7

SHA512
7315de0ec4a0d359d304571f44d0b5b4a2a415258c35ae0ae3ac4f45c565444bcdeb3e1079100ffec03950464a442f995af72722be7b385addd6c100ae2d5f81

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6706604.exe

Filesize
595KB

MD5
2f76a51d7e42fabd183f4e6f1ee532f0

SHA1
4db239223fe23d32efa5e14437d0d0fa5f08f2af

SHA256
695376c657ebef5cb667e6547921907475ad6fdc5d162e5b54940812e9b9dac7

SHA512
7315de0ec4a0d359d304571f44d0b5b4a2a415258c35ae0ae3ac4f45c565444bcdeb3e1079100ffec03950464a442f995af72722be7b385addd6c100ae2d5f81

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8648668.exe

Filesize
384KB

MD5
5b9fc969d5d0d42779dd875a0d28bf8b

SHA1
efc9d9c81c852aa87501daec53a3a5b297733cc8

SHA256
7730684d97fa49f32c1b22bb96adb568803e307985855a5f942a24d9de6e495e

SHA512
f02691b901790177f461667a59d7fb9516d04df301ebc02f96fc92881b9b9c16f7e60e2a006d16272867b6834088be8589ea5dc852c8e533d2944b9fbbd52a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8648668.exe

Filesize
384KB

MD5
5b9fc969d5d0d42779dd875a0d28bf8b

SHA1
efc9d9c81c852aa87501daec53a3a5b297733cc8

SHA256
7730684d97fa49f32c1b22bb96adb568803e307985855a5f942a24d9de6e495e

SHA512
f02691b901790177f461667a59d7fb9516d04df301ebc02f96fc92881b9b9c16f7e60e2a006d16272867b6834088be8589ea5dc852c8e533d2944b9fbbd52a16

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1711343.exe

Filesize
335KB

MD5
73e436587c8572d8e3ba9b01512f478a

SHA1
0d12e5f177dc9bdc525e4942c2a9753f3f640acf

SHA256
5f36f95cf6ed1b37831878621ab22ebce9a1cb2f5789cf930a7e90fca3eac40c

SHA512
42e90280f4dfab078c8bada5bae43758a129970237275cfa3e5e5f9010d0c8cd24159987f5e48349eadd3b857f9c12ffa0b3be1298c8b3b9a9544c9969a3ed33

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1711343.exe

Filesize
335KB

MD5
73e436587c8572d8e3ba9b01512f478a

SHA1
0d12e5f177dc9bdc525e4942c2a9753f3f640acf

SHA256
5f36f95cf6ed1b37831878621ab22ebce9a1cb2f5789cf930a7e90fca3eac40c

SHA512
42e90280f4dfab078c8bada5bae43758a129970237275cfa3e5e5f9010d0c8cd24159987f5e48349eadd3b857f9c12ffa0b3be1298c8b3b9a9544c9969a3ed33

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5582146.exe

Filesize
221KB

MD5
340656d4daac257b56cdf96cd47acf7e

SHA1
5a2a5bda603a202dcd9c231d624afe3363f0092c

SHA256
a7fb66ef7c750edcf2abe3c26ae834d4dec54e1fef3b2e82da9932d9f1e5afe6

SHA512
71b3741cd7d8e01a64caa4bd3c8e92f6fb40f0898204b51f1d439f231a132290fe7c0b16e68b569d3b44ba0c51f6ef0d2debbaf91868fb4842497acfdadbe781

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5582146.exe

Filesize
221KB

MD5
340656d4daac257b56cdf96cd47acf7e

SHA1
5a2a5bda603a202dcd9c231d624afe3363f0092c

SHA256
a7fb66ef7c750edcf2abe3c26ae834d4dec54e1fef3b2e82da9932d9f1e5afe6

SHA512
71b3741cd7d8e01a64caa4bd3c8e92f6fb40f0898204b51f1d439f231a132290fe7c0b16e68b569d3b44ba0c51f6ef0d2debbaf91868fb4842497acfdadbe781

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6448056.exe

Filesize
350KB

MD5
11373bb5a2460ef8fed5fd1a09dfbdfa

SHA1
7496a1f6dfe22372a58a54fc404dfa7b84848581

SHA256
54f0b9ee7c47526cf7495678c2ff70e51c2b4d27e48f50e8661fa5885c0473d7

SHA512
c6acff5d9f8c51f11acb08e60fc308cd0b501bcb16b3ddb0fd2a5ab1ff95fa74dfe201007161011a57d214d0285ab915907d424760d30475e1861aa5036a6207

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6448056.exe

Filesize
350KB

MD5
11373bb5a2460ef8fed5fd1a09dfbdfa

SHA1
7496a1f6dfe22372a58a54fc404dfa7b84848581

SHA256
54f0b9ee7c47526cf7495678c2ff70e51c2b4d27e48f50e8661fa5885c0473d7

SHA512
c6acff5d9f8c51f11acb08e60fc308cd0b501bcb16b3ddb0fd2a5ab1ff95fa74dfe201007161011a57d214d0285ab915907d424760d30475e1861aa5036a6207

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
0c459e65bcc6d38574f0c0d63a87088a

SHA1
41e53d5f2b3e7ca859b842a1c7b677e0847e6d65

SHA256
871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4

SHA512
be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/3444-87-0x0000000073F60000-0x0000000074710000-memory.dmp

Filesize
7.7MB

Download
memory/3444-51-0x0000000073F60000-0x0000000074710000-memory.dmp

Filesize
7.7MB

Download
memory/3444-65-0x000000000AD60000-0x000000000AD9C000-memory.dmp

Filesize
240KB

Download
memory/3444-63-0x0000000005900000-0x0000000005910000-memory.dmp

Filesize
64KB

Download
memory/3444-49-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3444-64-0x000000000AD00000-0x000000000AD12000-memory.dmp

Filesize
72KB

Download
memory/3444-58-0x000000000ADD0000-0x000000000AEDA000-memory.dmp

Filesize
1.0MB

Download
memory/3444-57-0x000000000B2B0000-0x000000000B8C8000-memory.dmp

Filesize
6.1MB

Download
memory/3444-50-0x0000000003250000-0x0000000003256000-memory.dmp

Filesize
24KB

Download
memory/3444-74-0x000000000AEE0000-0x000000000AF2C000-memory.dmp

Filesize
304KB

Download
memory/3988-86-0x0000000073F60000-0x0000000074710000-memory.dmp

Filesize
7.7MB

Download
memory/3988-45-0x0000000073F60000-0x0000000074710000-memory.dmp

Filesize
7.7MB

Download
memory/3988-36-0x0000000073F60000-0x0000000074710000-memory.dmp

Filesize
7.7MB

Download
memory/3988-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4976-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4976-42-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4976-41-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4976-40-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download