amadey | 17809bbdb6f008f151d6fd21fc3b0aba6620887a4e27eeefa0b90d680b2b9040

Analysis

max time kernel
148s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17809bbdb6f008f151d6fd21fc3b0aba6620887a4e27eeefa0b90d680b2b9040.exe
Size

1.0MB
MD5

188ee8bdb796ae70e2522cf4c2c9a73a
SHA1

4060a9928171f372ed7334cc3caf9eef85a637bd
SHA256

17809bbdb6f008f151d6fd21fc3b0aba6620887a4e27eeefa0b90d680b2b9040
SHA512

a70af672573e89ea751bacb855a298f31a2ad92ded27a1e0c4fe6cbf3f8de5d49583e2afd6084ace3d6c66dc92ba56fa34fe37b01a4fb4844974e02e1c2d7a7a
SSDEEP

24576:0yEyIZup5i51N2kNOE9a4TE02+xkskCLIM3YpzUtyatKK:DfpONna46+ysk3c+zI

Score

10^/10

amadey healer redline kurda dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

kurda

77.91.124.82:19071

Attributes

auth_value
07989fb69b4f47fc5e6e900d2ee16833

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/4696-35-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	t0358332.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	u5460036.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 16 IoCs

pid	Process
4476	z2351527.exe
1092	z7333414.exe
3364	z2734407.exe
224	z8418228.exe
116	q7081784.exe
2644	r0696188.exe
3952	s1399983.exe
3056	t0358332.exe
4500	explonde.exe
848	u5460036.exe
3468	legota.exe
940	w3361767.exe
2124	legota.exe
4660	explonde.exe
1216	legota.exe
1480	explonde.exe

Loads dropped DLL 2 IoCs

pid	Process
3904	rundll32.exe
3808	rundll32.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	17809bbdb6f008f151d6fd21fc3b0aba6620887a4e27eeefa0b90d680b2b9040.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z2351527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z7333414.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z2734407.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z8418228.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 116 set thread context of 4696	116	q7081784.exe	91
PID 2644 set thread context of 4912	2644	r0696188.exe	101
PID 3952 set thread context of 2420	3952	s1399983.exe	108

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
4524	116	WerFault.exe	90
4940	2644	WerFault.exe	96
4148	4912	WerFault.exe	101
4900	3952	WerFault.exe	106

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2824	schtasks.exe
2124	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4696	AppLaunch.exe
4696	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 4476	1080	17809bbdb6f008f151d6fd21fc3b0aba6620887a4e27eeefa0b90d680b2b9040.exe	86
PID 1080 wrote to memory of 4476	1080	17809bbdb6f008f151d6fd21fc3b0aba6620887a4e27eeefa0b90d680b2b9040.exe	86
PID 1080 wrote to memory of 4476	1080	17809bbdb6f008f151d6fd21fc3b0aba6620887a4e27eeefa0b90d680b2b9040.exe	86
PID 4476 wrote to memory of 1092	4476	z2351527.exe	87
PID 4476 wrote to memory of 1092	4476	z2351527.exe	87
PID 4476 wrote to memory of 1092	4476	z2351527.exe	87
PID 1092 wrote to memory of 3364	1092	z7333414.exe	88
PID 1092 wrote to memory of 3364	1092	z7333414.exe	88
PID 1092 wrote to memory of 3364	1092	z7333414.exe	88
PID 3364 wrote to memory of 224	3364	z2734407.exe	89
PID 3364 wrote to memory of 224	3364	z2734407.exe	89
PID 3364 wrote to memory of 224	3364	z2734407.exe	89
PID 224 wrote to memory of 116	224	z8418228.exe	90
PID 224 wrote to memory of 116	224	z8418228.exe	90
PID 224 wrote to memory of 116	224	z8418228.exe	90
PID 116 wrote to memory of 4696	116	q7081784.exe	91
PID 116 wrote to memory of 4696	116	q7081784.exe	91
PID 116 wrote to memory of 4696	116	q7081784.exe	91
PID 116 wrote to memory of 4696	116	q7081784.exe	91
PID 116 wrote to memory of 4696	116	q7081784.exe	91
PID 116 wrote to memory of 4696	116	q7081784.exe	91
PID 116 wrote to memory of 4696	116	q7081784.exe	91
PID 116 wrote to memory of 4696	116	q7081784.exe	91
PID 224 wrote to memory of 2644	224	z8418228.exe	96
PID 224 wrote to memory of 2644	224	z8418228.exe	96
PID 224 wrote to memory of 2644	224	z8418228.exe	96
PID 2644 wrote to memory of 4912	2644	r0696188.exe	101
PID 2644 wrote to memory of 4912	2644	r0696188.exe	101
PID 2644 wrote to memory of 4912	2644	r0696188.exe	101
PID 2644 wrote to memory of 4912	2644	r0696188.exe	101
PID 2644 wrote to memory of 4912	2644	r0696188.exe	101
PID 2644 wrote to memory of 4912	2644	r0696188.exe	101
PID 2644 wrote to memory of 4912	2644	r0696188.exe	101
PID 2644 wrote to memory of 4912	2644	r0696188.exe	101
PID 2644 wrote to memory of 4912	2644	r0696188.exe	101
PID 2644 wrote to memory of 4912	2644	r0696188.exe	101
PID 3364 wrote to memory of 3952	3364	z2734407.exe	106
PID 3364 wrote to memory of 3952	3364	z2734407.exe	106
PID 3364 wrote to memory of 3952	3364	z2734407.exe	106
PID 3952 wrote to memory of 2420	3952	s1399983.exe	108
PID 3952 wrote to memory of 2420	3952	s1399983.exe	108
PID 3952 wrote to memory of 2420	3952	s1399983.exe	108
PID 3952 wrote to memory of 2420	3952	s1399983.exe	108
PID 3952 wrote to memory of 2420	3952	s1399983.exe	108
PID 3952 wrote to memory of 2420	3952	s1399983.exe	108
PID 3952 wrote to memory of 2420	3952	s1399983.exe	108
PID 3952 wrote to memory of 2420	3952	s1399983.exe	108
PID 1092 wrote to memory of 3056	1092	z7333414.exe	114
PID 1092 wrote to memory of 3056	1092	z7333414.exe	114
PID 1092 wrote to memory of 3056	1092	z7333414.exe	114
PID 3056 wrote to memory of 4500	3056	t0358332.exe	120
PID 3056 wrote to memory of 4500	3056	t0358332.exe	120
PID 3056 wrote to memory of 4500	3056	t0358332.exe	120
PID 4476 wrote to memory of 848	4476	z2351527.exe	121
PID 4476 wrote to memory of 848	4476	z2351527.exe	121
PID 4476 wrote to memory of 848	4476	z2351527.exe	121
PID 4500 wrote to memory of 2824	4500	explonde.exe	123
PID 4500 wrote to memory of 2824	4500	explonde.exe	123
PID 4500 wrote to memory of 2824	4500	explonde.exe	123
PID 848 wrote to memory of 3468	848	u5460036.exe	122
PID 848 wrote to memory of 3468	848	u5460036.exe	122
PID 848 wrote to memory of 3468	848	u5460036.exe	122
PID 1080 wrote to memory of 940	1080	17809bbdb6f008f151d6fd21fc3b0aba6620887a4e27eeefa0b90d680b2b9040.exe	124
PID 1080 wrote to memory of 940	1080	17809bbdb6f008f151d6fd21fc3b0aba6620887a4e27eeefa0b90d680b2b9040.exe	124

C:\Users\Admin\AppData\Local\Temp\17809bbdb6f008f151d6fd21fc3b0aba6620887a4e27eeefa0b90d680b2b9040.exe
"C:\Users\Admin\AppData\Local\Temp\17809bbdb6f008f151d6fd21fc3b0aba6620887a4e27eeefa0b90d680b2b9040.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2351527.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2351527.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7333414.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7333414.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2734407.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2734407.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8418228.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8418228.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7081784.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7081784.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:116
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4696
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 116 -s 552
        7⤵
        Program crash
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0696188.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0696188.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2644
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4912 -s 540
        8⤵
        Program crash
        
        PID:4148
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2644 -s 552
        7⤵
        Program crash
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1399983.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1399983.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3952
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2420
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 552
        6⤵
        Program crash
        
        PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0358332.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0358332.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4500
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:2824
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:736
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        7⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        7⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:3792
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:3904
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5460036.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5460036.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:848
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:3468
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2124
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:3228
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2164
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:1424
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:2160
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:4264
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3616
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:2460
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:3808
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3361767.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3361767.exe
  2⤵
  - Executes dropped EXE
  PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 116 -ip 116
1⤵
PID:1112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2644 -ip 2644
1⤵
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4912 -ip 4912
1⤵
PID:2280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3952 -ip 3952
1⤵
PID:4020

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:2124

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4660

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:1216

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3361767.exe

Filesize
19KB

MD5
c496c15ad2b1d845021ae32eaa04107a

SHA1
dd1639250465aef0ba9e24d7b30a01e938741201

SHA256
4697910c2351fd6056e0f0a3beb547b9e774f4f93d129852ffe717d2c96eb7e6

SHA512
bf5da753ac1a6c97964163c6b61f0b05476624119e2b74f2ec75c56415ead357f0b1bc63f80b40bc196aa97af9b9c40d6f88242f91602dc15ce5e7e21bb935c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3361767.exe

Filesize
19KB

MD5
c496c15ad2b1d845021ae32eaa04107a

SHA1
dd1639250465aef0ba9e24d7b30a01e938741201

SHA256
4697910c2351fd6056e0f0a3beb547b9e774f4f93d129852ffe717d2c96eb7e6

SHA512
bf5da753ac1a6c97964163c6b61f0b05476624119e2b74f2ec75c56415ead357f0b1bc63f80b40bc196aa97af9b9c40d6f88242f91602dc15ce5e7e21bb935c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2351527.exe

Filesize
967KB

MD5
19c2dbe226e2810ff499fad9da2cf4a4

SHA1
4fbb3953772e5c9e74535dbd57efcc142e7d3c00

SHA256
65b1f23be5de21a2bdb0c7cf30edd630a6491bc37c83ddde9c93bfc66666c3b5

SHA512
3a22b01f27d63d6c1a9d6126263edf75569f7759d88824f38f5db481bcdfd03419fe695730024dbf30deed26b57f697ad107942d073777ed6bb545f2d61085f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2351527.exe

Filesize
967KB

MD5
19c2dbe226e2810ff499fad9da2cf4a4

SHA1
4fbb3953772e5c9e74535dbd57efcc142e7d3c00

SHA256
65b1f23be5de21a2bdb0c7cf30edd630a6491bc37c83ddde9c93bfc66666c3b5

SHA512
3a22b01f27d63d6c1a9d6126263edf75569f7759d88824f38f5db481bcdfd03419fe695730024dbf30deed26b57f697ad107942d073777ed6bb545f2d61085f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5460036.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5460036.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7333414.exe

Filesize
785KB

MD5
1d15aebf1018e4d03fa1ee3951767c3a

SHA1
e2a06e26870bb475b9a9d43ba8d48556dfa916e4

SHA256
e7c72ca8860b0dd6fc35f8f277c28af4f7b0d0c75fb2c8c24254733a470e90cd

SHA512
76f63a89e1a53f1dada92383e6bc7fd90ab6ea481b62a2e31af5a6505f59ca1fad3be84d7190e95265afa188fc71d6781ec03bab94c2d319720523eb452e6e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7333414.exe

Filesize
785KB

MD5
1d15aebf1018e4d03fa1ee3951767c3a

SHA1
e2a06e26870bb475b9a9d43ba8d48556dfa916e4

SHA256
e7c72ca8860b0dd6fc35f8f277c28af4f7b0d0c75fb2c8c24254733a470e90cd

SHA512
76f63a89e1a53f1dada92383e6bc7fd90ab6ea481b62a2e31af5a6505f59ca1fad3be84d7190e95265afa188fc71d6781ec03bab94c2d319720523eb452e6e2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0358332.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0358332.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2734407.exe

Filesize
602KB

MD5
05094a775e35ce4384b6f5cdf57802f1

SHA1
66d0f37f4845e368e95fbf812d55a1d11ee92f32

SHA256
ad5750c17ffcf23f38d5e00672e5ba18c00921d2429f603a8b053316384d96fb

SHA512
69ed58e549ef792b2f71ce0eff68ae1ace1bce07fc8f152db8e69bdfdcc50380df4bc600e3d76e01bb2467233eabf86af4ca53b732f7f14255c44e2d4e070e43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2734407.exe

Filesize
602KB

MD5
05094a775e35ce4384b6f5cdf57802f1

SHA1
66d0f37f4845e368e95fbf812d55a1d11ee92f32

SHA256
ad5750c17ffcf23f38d5e00672e5ba18c00921d2429f603a8b053316384d96fb

SHA512
69ed58e549ef792b2f71ce0eff68ae1ace1bce07fc8f152db8e69bdfdcc50380df4bc600e3d76e01bb2467233eabf86af4ca53b732f7f14255c44e2d4e070e43

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1399983.exe

Filesize
383KB

MD5
fed5a33e80d56e24974d5d799a584744

SHA1
712db0898342a604e5612404ff0094d4f5c81b64

SHA256
396c928664a8ebe329c962c66811217c0f753989926a996aececc80131c2d4a0

SHA512
88146481506c75ed8c8d0fdd1611dfbf9536c680dcd112a6eaac352cbd0fce4cab24f7991b686b6fe78daa720bc62f9b30582ec4163720efa9e127511050c255

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1399983.exe

Filesize
383KB

MD5
fed5a33e80d56e24974d5d799a584744

SHA1
712db0898342a604e5612404ff0094d4f5c81b64

SHA256
396c928664a8ebe329c962c66811217c0f753989926a996aececc80131c2d4a0

SHA512
88146481506c75ed8c8d0fdd1611dfbf9536c680dcd112a6eaac352cbd0fce4cab24f7991b686b6fe78daa720bc62f9b30582ec4163720efa9e127511050c255

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8418228.exe

Filesize
344KB

MD5
514062abc92f21fa6c6130045c72d122

SHA1
8281679c31fbde24e80ed6a0aca6c9f55875bc53

SHA256
91cc7b51f3ad5d99690f45d70dd0f1a355463fd6c2dd89c8ca2b2c017824aa90

SHA512
f2974d3fec3c76bb9e2d14cdb30114a8f8681c97cbe6afa6d0c311dab288ffc440f30123b2fb702db687f4840ea1466f3d6badf81098de90c33dd9aa482bf0ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8418228.exe

Filesize
344KB

MD5
514062abc92f21fa6c6130045c72d122

SHA1
8281679c31fbde24e80ed6a0aca6c9f55875bc53

SHA256
91cc7b51f3ad5d99690f45d70dd0f1a355463fd6c2dd89c8ca2b2c017824aa90

SHA512
f2974d3fec3c76bb9e2d14cdb30114a8f8681c97cbe6afa6d0c311dab288ffc440f30123b2fb702db687f4840ea1466f3d6badf81098de90c33dd9aa482bf0ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7081784.exe

Filesize
220KB

MD5
b85ac5ff25fc83ba3895cf89da3f3807

SHA1
6ab267283ab00ab89da5c103f2ae3da61d8b10d3

SHA256
fbf1e3ec708f27b4153443fb0c02640871addcddcadbb2c6a0b3724a54786cad

SHA512
a85c76aece6ac77e0742e24d66643c28ac5d7d96c344ff136446b8587fb0176640551761b73fc0b456dd6ea5e8b21a5ca0fde73c11b1f18a6fc0c79f6e572521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7081784.exe

Filesize
220KB

MD5
b85ac5ff25fc83ba3895cf89da3f3807

SHA1
6ab267283ab00ab89da5c103f2ae3da61d8b10d3

SHA256
fbf1e3ec708f27b4153443fb0c02640871addcddcadbb2c6a0b3724a54786cad

SHA512
a85c76aece6ac77e0742e24d66643c28ac5d7d96c344ff136446b8587fb0176640551761b73fc0b456dd6ea5e8b21a5ca0fde73c11b1f18a6fc0c79f6e572521

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0696188.exe

Filesize
364KB

MD5
10e81fbb14b9e30714d13815bb9e4383

SHA1
6affac9b77c12d2315b5de05e3b4e6c20794502c

SHA256
2aa769a84e64c8cd5cd7dda90488f0979f9c07cae829131e5f422e7778fec384

SHA512
ace26103fce20990a5b7017b3e57559448bffe4d6c877d81c028e71b3ac1437193053f97e12eace92162d7ba608c9f18e191a84c6dd7985ec530923f83d295c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0696188.exe

Filesize
364KB

MD5
10e81fbb14b9e30714d13815bb9e4383

SHA1
6affac9b77c12d2315b5de05e3b4e6c20794502c

SHA256
2aa769a84e64c8cd5cd7dda90488f0979f9c07cae829131e5f422e7778fec384

SHA512
ace26103fce20990a5b7017b3e57559448bffe4d6c877d81c028e71b3ac1437193053f97e12eace92162d7ba608c9f18e191a84c6dd7985ec530923f83d295c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
0c459e65bcc6d38574f0c0d63a87088a

SHA1
41e53d5f2b3e7ca859b842a1c7b677e0847e6d65

SHA256
871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4

SHA512
be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/2420-85-0x00000000054E0000-0x000000000551C000-memory.dmp

Filesize
240KB

Download
memory/2420-52-0x0000000002CA0000-0x0000000002CA6000-memory.dmp

Filesize
24KB

Download
memory/2420-66-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/2420-65-0x0000000005540000-0x000000000564A000-memory.dmp

Filesize
1.0MB

Download
memory/2420-61-0x0000000005A30000-0x0000000006048000-memory.dmp

Filesize
6.1MB

Download
memory/2420-87-0x0000000005650000-0x000000000569C000-memory.dmp

Filesize
304KB

Download
memory/2420-88-0x0000000005300000-0x0000000005310000-memory.dmp

Filesize
64KB

Download
memory/2420-59-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/2420-48-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2420-67-0x0000000005480000-0x0000000005492000-memory.dmp

Filesize
72KB

Download
memory/2420-50-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4696-49-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4696-53-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4696-36-0x0000000074840000-0x0000000074FF0000-memory.dmp

Filesize
7.7MB

Download
memory/4696-35-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/4912-44-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4912-42-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4912-41-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/4912-40-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download