amadey | c9ecca99998a256658678b9090d70d3f3c8d51e483754d4048b55ac918f36846

Analysis

max time kernel
139s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c9ecca99998a256658678b9090d70d3f3c8d51e483754d4048b55ac918f36846.exe
Size

1.1MB
MD5

a57d1f6a3427297bb12188479dabd4be
SHA1

af34bb08c113f83a0d7960f9904406b87c28014e
SHA256

c9ecca99998a256658678b9090d70d3f3c8d51e483754d4048b55ac918f36846
SHA512

2a04727b9ea9d1f7881a1b101aca6ee26de6dfbfa002417e70068eb082ace4057001612151e24ae816d764a5017b11574a06ebaaafc9bb2bcc59e29d9e817d4a
SSDEEP

24576:Uy6FN52vOdxvEc9qa5jbyW7ZskO+RcRUnFFeo/tVrvS0fP5:jKiO3vEc9hhyaYKFFe6S

Score

10^/10

amadey healer mystic redline darts dropper evasion infostealer persistence stealer trojan

Malware Config

Extracted

Family

redline

Botnet

darts

77.91.124.82:19071

Attributes

auth_value
3c8818da7045365845f15ec0946ebf11

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detect Mystic stealer payload 4 IoCs

resource	yara_rule
behavioral2/memory/1276-40-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1276-41-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1276-44-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic
behavioral2/memory/1276-42-0x0000000000400000-0x0000000000428000-memory.dmp	family_mystic

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/3852-35-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe

Mystic
Mystic is an infostealer written in C++.
stealer mystic
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	t6548020.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	u6881124.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 16 IoCs

pid	Process
3672	z1372783.exe
4308	z8305240.exe
4720	z1487995.exe
2432	z9426785.exe
1948	q2478645.exe
4068	r7919492.exe
2584	s9391386.exe
2768	t6548020.exe
4500	explonde.exe
3804	u6881124.exe
3112	legota.exe
3596	w5588155.exe
3080	explonde.exe
3672	legota.exe
3592	explonde.exe
1648	legota.exe

Loads dropped DLL 2 IoCs

pid	Process
3704	rundll32.exe
4464	rundll32.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1372783.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z8305240.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z1487995.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z9426785.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	c9ecca99998a256658678b9090d70d3f3c8d51e483754d4048b55ac918f36846.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1948 set thread context of 3852	1948	q2478645.exe	88
PID 4068 set thread context of 1276	4068	r7919492.exe	99
PID 2584 set thread context of 4248	2584	s9391386.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4204	1948	WerFault.exe	87
3996	4068	WerFault.exe	93
2888	1276	WerFault.exe
4668	2584	WerFault.exe	101

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4024	schtasks.exe
4448	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3852	AppLaunch.exe
3852	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3852	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3672	3000	c9ecca99998a256658678b9090d70d3f3c8d51e483754d4048b55ac918f36846.exe	82
PID 3000 wrote to memory of 3672	3000	c9ecca99998a256658678b9090d70d3f3c8d51e483754d4048b55ac918f36846.exe	82
PID 3000 wrote to memory of 3672	3000	c9ecca99998a256658678b9090d70d3f3c8d51e483754d4048b55ac918f36846.exe	82
PID 3672 wrote to memory of 4308	3672	z1372783.exe	84
PID 3672 wrote to memory of 4308	3672	z1372783.exe	84
PID 3672 wrote to memory of 4308	3672	z1372783.exe	84
PID 4308 wrote to memory of 4720	4308	z8305240.exe	85
PID 4308 wrote to memory of 4720	4308	z8305240.exe	85
PID 4308 wrote to memory of 4720	4308	z8305240.exe	85
PID 4720 wrote to memory of 2432	4720	z1487995.exe	86
PID 4720 wrote to memory of 2432	4720	z1487995.exe	86
PID 4720 wrote to memory of 2432	4720	z1487995.exe	86
PID 2432 wrote to memory of 1948	2432	z9426785.exe	87
PID 2432 wrote to memory of 1948	2432	z9426785.exe	87
PID 2432 wrote to memory of 1948	2432	z9426785.exe	87
PID 1948 wrote to memory of 3852	1948	q2478645.exe	88
PID 1948 wrote to memory of 3852	1948	q2478645.exe	88
PID 1948 wrote to memory of 3852	1948	q2478645.exe	88
PID 1948 wrote to memory of 3852	1948	q2478645.exe	88
PID 1948 wrote to memory of 3852	1948	q2478645.exe	88
PID 1948 wrote to memory of 3852	1948	q2478645.exe	88
PID 1948 wrote to memory of 3852	1948	q2478645.exe	88
PID 1948 wrote to memory of 3852	1948	q2478645.exe	88
PID 2432 wrote to memory of 4068	2432	z9426785.exe	93
PID 2432 wrote to memory of 4068	2432	z9426785.exe	93
PID 2432 wrote to memory of 4068	2432	z9426785.exe	93
PID 4068 wrote to memory of 4148	4068	r7919492.exe	94
PID 4068 wrote to memory of 4148	4068	r7919492.exe	94
PID 4068 wrote to memory of 4148	4068	r7919492.exe	94
PID 4068 wrote to memory of 1276	4068	r7919492.exe	99
PID 4068 wrote to memory of 1276	4068	r7919492.exe	99
PID 4068 wrote to memory of 1276	4068	r7919492.exe	99
PID 4068 wrote to memory of 1276	4068	r7919492.exe	99
PID 4068 wrote to memory of 1276	4068	r7919492.exe	99
PID 4068 wrote to memory of 1276	4068	r7919492.exe	99
PID 4068 wrote to memory of 1276	4068	r7919492.exe	99
PID 4068 wrote to memory of 1276	4068	r7919492.exe	99
PID 4068 wrote to memory of 1276	4068	r7919492.exe	99
PID 4068 wrote to memory of 1276	4068	r7919492.exe	99
PID 4720 wrote to memory of 2584	4720	z1487995.exe	101
PID 4720 wrote to memory of 2584	4720	z1487995.exe	101
PID 4720 wrote to memory of 2584	4720	z1487995.exe	101
PID 2584 wrote to memory of 4248	2584	s9391386.exe	104
PID 2584 wrote to memory of 4248	2584	s9391386.exe	104
PID 2584 wrote to memory of 4248	2584	s9391386.exe	104
PID 2584 wrote to memory of 4248	2584	s9391386.exe	104
PID 2584 wrote to memory of 4248	2584	s9391386.exe	104
PID 2584 wrote to memory of 4248	2584	s9391386.exe	104
PID 2584 wrote to memory of 4248	2584	s9391386.exe	104
PID 2584 wrote to memory of 4248	2584	s9391386.exe	104
PID 4308 wrote to memory of 2768	4308	z8305240.exe	105
PID 4308 wrote to memory of 2768	4308	z8305240.exe	105
PID 4308 wrote to memory of 2768	4308	z8305240.exe	105
PID 2768 wrote to memory of 4500	2768	t6548020.exe	106
PID 2768 wrote to memory of 4500	2768	t6548020.exe	106
PID 2768 wrote to memory of 4500	2768	t6548020.exe	106
PID 3672 wrote to memory of 3804	3672	legota.exe	107
PID 3672 wrote to memory of 3804	3672	legota.exe	107
PID 3672 wrote to memory of 3804	3672	legota.exe	107
PID 4500 wrote to memory of 4448	4500	explonde.exe	130
PID 4500 wrote to memory of 4448	4500	explonde.exe	130
PID 4500 wrote to memory of 4448	4500	explonde.exe	130
PID 4500 wrote to memory of 1956	4500	explonde.exe	109
PID 4500 wrote to memory of 1956	4500	explonde.exe	109

C:\Users\Admin\AppData\Local\Temp\c9ecca99998a256658678b9090d70d3f3c8d51e483754d4048b55ac918f36846.exe
"C:\Users\Admin\AppData\Local\Temp\c9ecca99998a256658678b9090d70d3f3c8d51e483754d4048b55ac918f36846.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1372783.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1372783.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8305240.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8305240.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1487995.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1487995.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9426785.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9426785.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2478645.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2478645.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1948
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3852
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 572
        7⤵
        Program crash
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7919492.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7919492.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4068
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4068 -s 588
        7⤵
        Program crash
        
        PID:3996
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9391386.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9391386.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2584
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2584 -s 564
        6⤵
        Program crash
        
        PID:4668
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6548020.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6548020.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4500
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        7⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:924
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        7⤵
        
        PID:1072
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4448
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:3704
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6881124.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6881124.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:3112
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:4464
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5588155.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5588155.exe
  2⤵
  - Executes dropped EXE
  PID:3596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1948 -ip 1948
1⤵
PID:3864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1276 -ip 1276
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1276 -s 540
1⤵
- Program crash
PID:2888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4068 -ip 4068
1⤵
PID:1008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2584 -ip 2584
1⤵
PID:2976

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
1⤵
PID:4880
- C:\Windows\SysWOW64\cacls.exe
  CACLS "legota.exe" /P "Admin:R" /E
  2⤵
  PID:5076
- C:\Windows\SysWOW64\cacls.exe
  CACLS "..\cb378487cf" /P "Admin:N"
  2⤵
  PID:3024
- C:\Windows\SysWOW64\cacls.exe
  CACLS "..\cb378487cf" /P "Admin:R" /E
  2⤵
  PID:732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:836
- C:\Windows\SysWOW64\cacls.exe
  CACLS "legota.exe" /P "Admin:N"
  2⤵
  PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3204

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
1⤵
- Creates scheduled task(s)
PID:4024

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:3080

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:3592

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5588155.exe

Filesize
21KB

MD5
351a724fefab62b1da50a8e261e2eecc

SHA1
6915a73621d986e974550c8ea2079e73a686da6b

SHA256
71c0e5da75985ef7c3255d4d70945bee8410b4a968b39fb2171655299b2d5467

SHA512
d5272cb5575b2799cfb247c3f6591680e32e2d0911e2cb8f483672d25725ef248a5eaeb0e50c43693a80d6d47c8fc87e8abca4f2a630b9e4477e52df7f3654c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5588155.exe

Filesize
21KB

MD5
351a724fefab62b1da50a8e261e2eecc

SHA1
6915a73621d986e974550c8ea2079e73a686da6b

SHA256
71c0e5da75985ef7c3255d4d70945bee8410b4a968b39fb2171655299b2d5467

SHA512
d5272cb5575b2799cfb247c3f6591680e32e2d0911e2cb8f483672d25725ef248a5eaeb0e50c43693a80d6d47c8fc87e8abca4f2a630b9e4477e52df7f3654c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1372783.exe

Filesize
997KB

MD5
85002871a2ed4fe17c3f72441689c83e

SHA1
00e45994df9d677353fde9181728d3ce06fe120f

SHA256
f0ee22a81fd577b537d71be9e721f5469d5e2a6d7c3efb296909c4d1ed888372

SHA512
de6a5a4c5771f31c963fee6839a9231e3402516034c3af47d459be39c98f43f25bfedcf140ce44c5d2bc92a65deea172d3448b66e1fd580c11f8dcb2d5e6fd18

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1372783.exe

Filesize
997KB

MD5
85002871a2ed4fe17c3f72441689c83e

SHA1
00e45994df9d677353fde9181728d3ce06fe120f

SHA256
f0ee22a81fd577b537d71be9e721f5469d5e2a6d7c3efb296909c4d1ed888372

SHA512
de6a5a4c5771f31c963fee6839a9231e3402516034c3af47d459be39c98f43f25bfedcf140ce44c5d2bc92a65deea172d3448b66e1fd580c11f8dcb2d5e6fd18

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6881124.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6881124.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8305240.exe

Filesize
815KB

MD5
2a8b44eed39ab702740bcf82fd565fb4

SHA1
61384e31881520dc08c661019ec53820e808fcb1

SHA256
d9a4e367a69fad30bae8620729adba06f398873c933f6f3f9104f940735aacb7

SHA512
46c79f84e40da69dbf3c8ec2353a71945e6e5d8177dd3ccfa5b1cade98f9a9b3e529c1cce4ff9eebcdbf8a1642827e0d43fa0c01be1d9f6e0aafa309a3546233

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8305240.exe

Filesize
815KB

MD5
2a8b44eed39ab702740bcf82fd565fb4

SHA1
61384e31881520dc08c661019ec53820e808fcb1

SHA256
d9a4e367a69fad30bae8620729adba06f398873c933f6f3f9104f940735aacb7

SHA512
46c79f84e40da69dbf3c8ec2353a71945e6e5d8177dd3ccfa5b1cade98f9a9b3e529c1cce4ff9eebcdbf8a1642827e0d43fa0c01be1d9f6e0aafa309a3546233

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6548020.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6548020.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1487995.exe

Filesize
632KB

MD5
e76ef8d029e922397f5c1a0be6d2c0ec

SHA1
3d9c07ff586791b2d709deaec95ea299376ad0f0

SHA256
0f171eac3b156b42e6798b77800b2ebb4c0b28389c6a72d8d923db850febbe50

SHA512
b2cf577451a23807f7118ace9fa7087911d30a3cc18ee4f3e5f86cf43bfa9b323667a789be59dff8271a2895f2a188f58a4d0e852af87f60f9753071ef871730

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1487995.exe

Filesize
632KB

MD5
e76ef8d029e922397f5c1a0be6d2c0ec

SHA1
3d9c07ff586791b2d709deaec95ea299376ad0f0

SHA256
0f171eac3b156b42e6798b77800b2ebb4c0b28389c6a72d8d923db850febbe50

SHA512
b2cf577451a23807f7118ace9fa7087911d30a3cc18ee4f3e5f86cf43bfa9b323667a789be59dff8271a2895f2a188f58a4d0e852af87f60f9753071ef871730

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9391386.exe

Filesize
413KB

MD5
007dd542bc35c8b52c3c7e9dfa649d26

SHA1
8aa124c71ad0b2e7725227b8918a41de163f9635

SHA256
dfb93a22b68e630549961f4e6ece253ff1e19b5c31e1d47b5bd3cc0c0fd2901f

SHA512
98397e8af1d3a6da5c796441960bd109bc93cd25e672e917d494f90e80184b8d694fb91c7f572efc3499f68c106f1e32b3c1be4b2232b465e6a525ae96702813

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9391386.exe

Filesize
413KB

MD5
007dd542bc35c8b52c3c7e9dfa649d26

SHA1
8aa124c71ad0b2e7725227b8918a41de163f9635

SHA256
dfb93a22b68e630549961f4e6ece253ff1e19b5c31e1d47b5bd3cc0c0fd2901f

SHA512
98397e8af1d3a6da5c796441960bd109bc93cd25e672e917d494f90e80184b8d694fb91c7f572efc3499f68c106f1e32b3c1be4b2232b465e6a525ae96702813

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9426785.exe

Filesize
354KB

MD5
0786e4b895105a3f2cfe4cd2752506e5

SHA1
01ac7d9dd441e75381819c4d3311bae01e539f12

SHA256
96bdb586e27c81912651edc0264d9cc8f4b6d37588ce24fc492f3d8c42218274

SHA512
f573c36ffdb46858b4132e513f54c56189638b4483d0ea44b949bfddab3ceb71fabd746fbb7823e0fbdfda5a8eebf9946de55feb60227cd253b375bf6f4ef86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9426785.exe

Filesize
354KB

MD5
0786e4b895105a3f2cfe4cd2752506e5

SHA1
01ac7d9dd441e75381819c4d3311bae01e539f12

SHA256
96bdb586e27c81912651edc0264d9cc8f4b6d37588ce24fc492f3d8c42218274

SHA512
f573c36ffdb46858b4132e513f54c56189638b4483d0ea44b949bfddab3ceb71fabd746fbb7823e0fbdfda5a8eebf9946de55feb60227cd253b375bf6f4ef86a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2478645.exe

Filesize
250KB

MD5
cb8744534ada10ea58ad5877059da4f3

SHA1
df0bf8e196cd6e25ab525259aea905ae89fff95f

SHA256
1a6dea038248ca8c837a0cf5a97b67ecf38b838bb692782106d8f154cec78c43

SHA512
9245ed1f4b296b2b6f282f502d1ad179c3366774bb9cbb5501db90b02ef7bb99b61546feca06bc416d01ce35edd7f266abef05e72e3a62d3f42ed4e1029577a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2478645.exe

Filesize
250KB

MD5
cb8744534ada10ea58ad5877059da4f3

SHA1
df0bf8e196cd6e25ab525259aea905ae89fff95f

SHA256
1a6dea038248ca8c837a0cf5a97b67ecf38b838bb692782106d8f154cec78c43

SHA512
9245ed1f4b296b2b6f282f502d1ad179c3366774bb9cbb5501db90b02ef7bb99b61546feca06bc416d01ce35edd7f266abef05e72e3a62d3f42ed4e1029577a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7919492.exe

Filesize
379KB

MD5
b29f7e67bdb3215a1366c66a5abb14fd

SHA1
cb2979ca9dd140cd47f16d5374fdb7c7c767341b

SHA256
33634d8b510eecf9a35580c5068df6eb68ffdcfa192114e47c3d8d78109a5098

SHA512
f1efa82bab8a016236e9ad84a0a62978c7edee475b02211b01c4c1dcf63fd770dc9e1b2ca6c1d27ef9473af7934c2f9e0680bdef68e8136815e69995ff646dbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7919492.exe

Filesize
379KB

MD5
b29f7e67bdb3215a1366c66a5abb14fd

SHA1
cb2979ca9dd140cd47f16d5374fdb7c7c767341b

SHA256
33634d8b510eecf9a35580c5068df6eb68ffdcfa192114e47c3d8d78109a5098

SHA512
f1efa82bab8a016236e9ad84a0a62978c7edee475b02211b01c4c1dcf63fd770dc9e1b2ca6c1d27ef9473af7934c2f9e0680bdef68e8136815e69995ff646dbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
0c459e65bcc6d38574f0c0d63a87088a

SHA1
41e53d5f2b3e7ca859b842a1c7b677e0847e6d65

SHA256
871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4

SHA512
be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/1276-40-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1276-41-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1276-44-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1276-42-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3852-53-0x0000000073D30000-0x00000000744E0000-memory.dmp

Filesize
7.7MB

Download
memory/3852-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3852-36-0x0000000073D30000-0x00000000744E0000-memory.dmp

Filesize
7.7MB

Download
memory/3852-49-0x0000000073D30000-0x00000000744E0000-memory.dmp

Filesize
7.7MB

Download
memory/4248-87-0x0000000073D30000-0x00000000744E0000-memory.dmp

Filesize
7.7MB

Download
memory/4248-59-0x00000000054F0000-0x0000000005B08000-memory.dmp

Filesize
6.1MB

Download
memory/4248-51-0x0000000073D30000-0x00000000744E0000-memory.dmp

Filesize
7.7MB

Download
memory/4248-50-0x0000000002630000-0x0000000002636000-memory.dmp

Filesize
24KB

Download
memory/4248-60-0x0000000004FE0000-0x00000000050EA000-memory.dmp

Filesize
1.0MB

Download
memory/4248-48-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4248-88-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4248-76-0x0000000004F10000-0x0000000004F5C000-memory.dmp

Filesize
304KB

Download
memory/4248-61-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

Filesize
64KB

Download
memory/4248-63-0x0000000004E60000-0x0000000004E72000-memory.dmp

Filesize
72KB

Download
memory/4248-67-0x0000000004ED0000-0x0000000004F0C000-memory.dmp

Filesize
240KB

Download