amadey | 5583305ea17fa64a60d7657b45765b567ab03c88062a79728141074eaf7d4af7

Analysis

max time kernel
136s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5583305ea17fa64a60d7657b45765b567ab03c88062a79728141074eaf7d4af7.exe
Size

1.1MB
MD5

2fc6e5ea37298a8870a5edc7870548ad
SHA1

6f89b12f67876d660e263cf6c56024642979cd68
SHA256

5583305ea17fa64a60d7657b45765b567ab03c88062a79728141074eaf7d4af7
SHA512

03d54e03f9e8362f00d9d020ab8a354996de28f636c3228e14d5a40ea778acfd6fc4b4c1ba4cf4631e0d107a2f007338482926f41d1172e127d248e21dacd22b
SSDEEP

24576:lyozqjeK2yqodTL/uSpynBZy2juNP8I4bY8hjHiVfuBPin776GQ/tSI:AoWjeK3DP/JynBZLjuNPtv1VYP4aGQ/Y

Score

10^/10

amadey healer redline trush dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

redline

Botnet

trush

77.91.124.82:19071

Attributes

auth_value
c13814867cde8193679cd0cad2d774be

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 3 IoCs

resource	yara_rule
behavioral2/files/0x00080000000231fd-33.dat	healer
behavioral2/files/0x00080000000231fd-34.dat	healer
behavioral2/memory/4512-35-0x0000000000470000-0x000000000047A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	q5906436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	q5906436.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	q5906436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	q5906436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	q5906436.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	q5906436.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	u0146767.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	legota.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	t8522720.exe

Executes dropped EXE 16 IoCs

pid	Process
1500	z1887866.exe
4996	z3737168.exe
4612	z4810677.exe
3320	z4040979.exe
4512	q5906436.exe
1668	r8325454.exe
2268	s1958584.exe
4472	t8522720.exe
1352	explonde.exe
1916	u0146767.exe
5076	legota.exe
2412	w5544535.exe
4668	legota.exe
4984	explonde.exe
4068	legota.exe
1992	explonde.exe

Loads dropped DLL 2 IoCs

pid	Process
3044	rundll32.exe
768	rundll32.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	q5906436.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	5583305ea17fa64a60d7657b45765b567ab03c88062a79728141074eaf7d4af7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z1887866.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z3737168.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z4810677.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z4040979.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1668 set thread context of 2240	1668	r8325454.exe	100
PID 2268 set thread context of 2360	2268	s1958584.exe	114

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3440	1668	WerFault.exe	93
3308	2240	WerFault.exe	100
3164	2268	WerFault.exe	107

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4524	schtasks.exe
3920	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4512	q5906436.exe
4512	q5906436.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	q5906436.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1500	4716	5583305ea17fa64a60d7657b45765b567ab03c88062a79728141074eaf7d4af7.exe	86
PID 4716 wrote to memory of 1500	4716	5583305ea17fa64a60d7657b45765b567ab03c88062a79728141074eaf7d4af7.exe	86
PID 4716 wrote to memory of 1500	4716	5583305ea17fa64a60d7657b45765b567ab03c88062a79728141074eaf7d4af7.exe	86
PID 1500 wrote to memory of 4996	1500	z1887866.exe	87
PID 1500 wrote to memory of 4996	1500	z1887866.exe	87
PID 1500 wrote to memory of 4996	1500	z1887866.exe	87
PID 4996 wrote to memory of 4612	4996	z3737168.exe	88
PID 4996 wrote to memory of 4612	4996	z3737168.exe	88
PID 4996 wrote to memory of 4612	4996	z3737168.exe	88
PID 4612 wrote to memory of 3320	4612	z4810677.exe	90
PID 4612 wrote to memory of 3320	4612	z4810677.exe	90
PID 4612 wrote to memory of 3320	4612	z4810677.exe	90
PID 3320 wrote to memory of 4512	3320	z4040979.exe	91
PID 3320 wrote to memory of 4512	3320	z4040979.exe	91
PID 3320 wrote to memory of 1668	3320	z4040979.exe	93
PID 3320 wrote to memory of 1668	3320	z4040979.exe	93
PID 3320 wrote to memory of 1668	3320	z4040979.exe	93
PID 1668 wrote to memory of 2624	1668	r8325454.exe	98
PID 1668 wrote to memory of 2624	1668	r8325454.exe	98
PID 1668 wrote to memory of 2624	1668	r8325454.exe	98
PID 1668 wrote to memory of 2740	1668	r8325454.exe	99
PID 1668 wrote to memory of 2740	1668	r8325454.exe	99
PID 1668 wrote to memory of 2740	1668	r8325454.exe	99
PID 1668 wrote to memory of 2240	1668	r8325454.exe	100
PID 1668 wrote to memory of 2240	1668	r8325454.exe	100
PID 1668 wrote to memory of 2240	1668	r8325454.exe	100
PID 1668 wrote to memory of 2240	1668	r8325454.exe	100
PID 1668 wrote to memory of 2240	1668	r8325454.exe	100
PID 1668 wrote to memory of 2240	1668	r8325454.exe	100
PID 1668 wrote to memory of 2240	1668	r8325454.exe	100
PID 1668 wrote to memory of 2240	1668	r8325454.exe	100
PID 1668 wrote to memory of 2240	1668	r8325454.exe	100
PID 1668 wrote to memory of 2240	1668	r8325454.exe	100
PID 4612 wrote to memory of 2268	4612	z4810677.exe	107
PID 4612 wrote to memory of 2268	4612	z4810677.exe	107
PID 4612 wrote to memory of 2268	4612	z4810677.exe	107
PID 2268 wrote to memory of 2356	2268	s1958584.exe	113
PID 2268 wrote to memory of 2356	2268	s1958584.exe	113
PID 2268 wrote to memory of 2356	2268	s1958584.exe	113
PID 2268 wrote to memory of 2360	2268	s1958584.exe	114
PID 2268 wrote to memory of 2360	2268	s1958584.exe	114
PID 2268 wrote to memory of 2360	2268	s1958584.exe	114
PID 2268 wrote to memory of 2360	2268	s1958584.exe	114
PID 2268 wrote to memory of 2360	2268	s1958584.exe	114
PID 2268 wrote to memory of 2360	2268	s1958584.exe	114
PID 2268 wrote to memory of 2360	2268	s1958584.exe	114
PID 2268 wrote to memory of 2360	2268	s1958584.exe	114
PID 4996 wrote to memory of 4472	4996	z3737168.exe	117
PID 4996 wrote to memory of 4472	4996	z3737168.exe	117
PID 4996 wrote to memory of 4472	4996	z3737168.exe	117
PID 4472 wrote to memory of 1352	4472	t8522720.exe	118
PID 4472 wrote to memory of 1352	4472	t8522720.exe	118
PID 4472 wrote to memory of 1352	4472	t8522720.exe	118
PID 1500 wrote to memory of 1916	1500	z1887866.exe	119
PID 1500 wrote to memory of 1916	1500	z1887866.exe	119
PID 1500 wrote to memory of 1916	1500	z1887866.exe	119
PID 1352 wrote to memory of 4524	1352	explonde.exe	120
PID 1352 wrote to memory of 4524	1352	explonde.exe	120
PID 1352 wrote to memory of 4524	1352	explonde.exe	120
PID 1352 wrote to memory of 3788	1352	explonde.exe	122
PID 1352 wrote to memory of 3788	1352	explonde.exe	122
PID 1352 wrote to memory of 3788	1352	explonde.exe	122
PID 1916 wrote to memory of 5076	1916	u0146767.exe	124
PID 1916 wrote to memory of 5076	1916	u0146767.exe	124

C:\Users\Admin\AppData\Local\Temp\5583305ea17fa64a60d7657b45765b567ab03c88062a79728141074eaf7d4af7.exe
"C:\Users\Admin\AppData\Local\Temp\5583305ea17fa64a60d7657b45765b567ab03c88062a79728141074eaf7d4af7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1887866.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1887866.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3737168.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3737168.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4810677.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4810677.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4040979.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4040979.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5906436.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5906436.exe
        6⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8325454.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8325454.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1668
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2624
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2740
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        7⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 540
        8⤵
        Program crash
        
        PID:3308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1668 -s 580
        7⤵
        Program crash
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1958584.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1958584.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2268
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2356
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        6⤵
        
        PID:2360
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 592
        6⤵
        Program crash
        
        PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8522720.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8522720.exe
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1352
      - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        6⤵
        Creates scheduled task(s)
        
        PID:4524
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        6⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        7⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        7⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        7⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        7⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        7⤵
        
        PID:2596
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        6⤵
        Loads dropped DLL
        
        PID:3044
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0146767.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0146767.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:5076
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3920
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:1092
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2820
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:1168
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:2896
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:1764
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:3132
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:3924
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:768
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5544535.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5544535.exe
  2⤵
  - Executes dropped EXE
  PID:2412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2240 -ip 2240
1⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1668 -ip 1668
1⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2268 -ip 2268
1⤵
PID:4228

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:4668

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4984

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:4068

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:1992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5544535.exe

Filesize
18KB

MD5
71e38ef44ee977d9ec149bee309e790d

SHA1
c62cf82a561ba60c884fddc3754159e66a40495f

SHA256
7bc780ae8128f286d693128d6fb5e339c946e8dd3f4318138c7a5cd848846444

SHA512
f7cabfbe244c3b689ddda3e45153a8f2ff2377d439596b1b5494fe45f71dc38ab86b3a3f94365f7a666d97eedad9ff81048b90c8a168d73327c855034e7e15f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5544535.exe

Filesize
18KB

MD5
71e38ef44ee977d9ec149bee309e790d

SHA1
c62cf82a561ba60c884fddc3754159e66a40495f

SHA256
7bc780ae8128f286d693128d6fb5e339c946e8dd3f4318138c7a5cd848846444

SHA512
f7cabfbe244c3b689ddda3e45153a8f2ff2377d439596b1b5494fe45f71dc38ab86b3a3f94365f7a666d97eedad9ff81048b90c8a168d73327c855034e7e15f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1887866.exe

Filesize
1.0MB

MD5
c059042b15af38a79a12452b847572f5

SHA1
2ee497e9ccb8c0349a7838591883c4d701f66825

SHA256
6cf86700d850887359d31b05474453c9f7982c686b8e5936dfd2c04010c04624

SHA512
73a203a56f6a1b3bbe127f05c7bfe2300703be0ccc699697f3143283efdaff79f8b085e15e1dd5e964a44996a03765c47abeb1ed6483b84756c363b4047ca285

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1887866.exe

Filesize
1.0MB

MD5
c059042b15af38a79a12452b847572f5

SHA1
2ee497e9ccb8c0349a7838591883c4d701f66825

SHA256
6cf86700d850887359d31b05474453c9f7982c686b8e5936dfd2c04010c04624

SHA512
73a203a56f6a1b3bbe127f05c7bfe2300703be0ccc699697f3143283efdaff79f8b085e15e1dd5e964a44996a03765c47abeb1ed6483b84756c363b4047ca285

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0146767.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0146767.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3737168.exe

Filesize
872KB

MD5
009f4466659ddc653272d933f18af74a

SHA1
337ab82acc6fe545c07e3c796aa099048bd4b6b3

SHA256
3e677a06f1f1a14d71b239bc1fd10b4e827bcb0fc1e14859cb909c13e82adaaa

SHA512
d58fc22b00fd1d5c95a9bbd496eeb516deed45905d2ced7acf96c9863ee18fb28567b54904b8c246a1d69cf824a99a3ecb10c62a3a52096a810c1dffad8d248d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3737168.exe

Filesize
872KB

MD5
009f4466659ddc653272d933f18af74a

SHA1
337ab82acc6fe545c07e3c796aa099048bd4b6b3

SHA256
3e677a06f1f1a14d71b239bc1fd10b4e827bcb0fc1e14859cb909c13e82adaaa

SHA512
d58fc22b00fd1d5c95a9bbd496eeb516deed45905d2ced7acf96c9863ee18fb28567b54904b8c246a1d69cf824a99a3ecb10c62a3a52096a810c1dffad8d248d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8522720.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8522720.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4810677.exe

Filesize
689KB

MD5
b2e5337108293cf1c6d3e62e581873c2

SHA1
1b56b11d23668f01d37247182c7a23e297daea2e

SHA256
cd21d50812089087664f0a72561acf030605270c10cded58403950d3442b1654

SHA512
f183e360fad33520c554ca9664baaf81b5a2a8c2b9216520fd71eb45254678c89ffd889d91d782daa0777384928d6615242e64ec8bcba871f0f0943496b70fda

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4810677.exe

Filesize
689KB

MD5
b2e5337108293cf1c6d3e62e581873c2

SHA1
1b56b11d23668f01d37247182c7a23e297daea2e

SHA256
cd21d50812089087664f0a72561acf030605270c10cded58403950d3442b1654

SHA512
f183e360fad33520c554ca9664baaf81b5a2a8c2b9216520fd71eb45254678c89ffd889d91d782daa0777384928d6615242e64ec8bcba871f0f0943496b70fda

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1958584.exe

Filesize
707KB

MD5
d29833ec00d0cb0804b881af94baa2e7

SHA1
e3df0ee984fd67fa536b51594d9f244ac7619fd8

SHA256
bbb876f41f22a6ad6f74fc9d38e2ad9e8044986871ba00f046a2e7ee9f80fa55

SHA512
d6c6a5931a3c64f7318b396cbc14072ce4ce1986a7c5dd337cf8e838e5cf8abbc9e33052a5629d47efc587bf57e24a85467c87785156f0c7f65645aa1b010317

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1958584.exe

Filesize
707KB

MD5
d29833ec00d0cb0804b881af94baa2e7

SHA1
e3df0ee984fd67fa536b51594d9f244ac7619fd8

SHA256
bbb876f41f22a6ad6f74fc9d38e2ad9e8044986871ba00f046a2e7ee9f80fa55

SHA512
d6c6a5931a3c64f7318b396cbc14072ce4ce1986a7c5dd337cf8e838e5cf8abbc9e33052a5629d47efc587bf57e24a85467c87785156f0c7f65645aa1b010317

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4040979.exe

Filesize
387KB

MD5
6d14c85f34c6b705e93933761e0f23ea

SHA1
0487d94ef562c0f72adf7622f73a273c164e1113

SHA256
464c0135e3b1a8a6048eda6f7e84c19ad8910135d0b7d23f956701c9c91ab53c

SHA512
7292438651d31f53e57f05b8a57395d26d9d2aac2f93fbb05f5a55b722d428f1988e13b356f6ac30a21577b213284b0f732049cf1493b0243ac2888219bcb16f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z4040979.exe

Filesize
387KB

MD5
6d14c85f34c6b705e93933761e0f23ea

SHA1
0487d94ef562c0f72adf7622f73a273c164e1113

SHA256
464c0135e3b1a8a6048eda6f7e84c19ad8910135d0b7d23f956701c9c91ab53c

SHA512
7292438651d31f53e57f05b8a57395d26d9d2aac2f93fbb05f5a55b722d428f1988e13b356f6ac30a21577b213284b0f732049cf1493b0243ac2888219bcb16f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5906436.exe

Filesize
11KB

MD5
1a5a99c5d328a17ff36f03caf33da532

SHA1
9b82d66fad74a8d80bce23a298cac2e59274bae5

SHA256
927c2525696a3e3a6afc317131733118f7d05c9f9a6e0ebbb2329f450ee2ed34

SHA512
ff5647df52581e50ba520c586a2e270d27a8e3760e1184e553f5e0879cf49887be182af064bacfb65802875e7e1c2559e505126ef00f576a5a0ded830b4ede8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5906436.exe

Filesize
11KB

MD5
1a5a99c5d328a17ff36f03caf33da532

SHA1
9b82d66fad74a8d80bce23a298cac2e59274bae5

SHA256
927c2525696a3e3a6afc317131733118f7d05c9f9a6e0ebbb2329f450ee2ed34

SHA512
ff5647df52581e50ba520c586a2e270d27a8e3760e1184e553f5e0879cf49887be182af064bacfb65802875e7e1c2559e505126ef00f576a5a0ded830b4ede8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8325454.exe

Filesize
700KB

MD5
f8dda9b20658310689a8f1d2728a6373

SHA1
b37edb61502fecd19f15f1c33b409784a7153d9c

SHA256
1148d2947de3f283d3203874c51226ced8d8246f233434433e2588dacba80792

SHA512
8ff24e1ac93094281d4f6ef831953f85796cf1da71b64228ba905a5fd80899a9c9672ffb55a3689105a4cf260705230eb2f18069f1d7fabf5fbf6203838fb1a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8325454.exe

Filesize
700KB

MD5
f8dda9b20658310689a8f1d2728a6373

SHA1
b37edb61502fecd19f15f1c33b409784a7153d9c

SHA256
1148d2947de3f283d3203874c51226ced8d8246f233434433e2588dacba80792

SHA512
8ff24e1ac93094281d4f6ef831953f85796cf1da71b64228ba905a5fd80899a9c9672ffb55a3689105a4cf260705230eb2f18069f1d7fabf5fbf6203838fb1a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
0c459e65bcc6d38574f0c0d63a87088a

SHA1
41e53d5f2b3e7ca859b842a1c7b677e0847e6d65

SHA256
871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4

SHA512
be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/2240-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2240-43-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2240-44-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2240-45-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2360-60-0x0000000005380000-0x000000000548A000-memory.dmp

Filesize
1.0MB

Download
memory/2360-71-0x00000000052F0000-0x000000000533C000-memory.dmp

Filesize
304KB

Download
memory/2360-51-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/2360-89-0x00000000738C0000-0x0000000074070000-memory.dmp

Filesize
7.7MB

Download
memory/2360-90-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/2360-52-0x00000000738C0000-0x0000000074070000-memory.dmp

Filesize
7.7MB

Download
memory/2360-53-0x0000000002C20000-0x0000000002C26000-memory.dmp

Filesize
24KB

Download
memory/2360-59-0x0000000005890000-0x0000000005EA8000-memory.dmp

Filesize
6.1MB

Download
memory/2360-67-0x00000000052B0000-0x00000000052EC000-memory.dmp

Filesize
240KB

Download
memory/2360-61-0x0000000005210000-0x0000000005222000-memory.dmp

Filesize
72KB

Download
memory/2360-62-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/4512-35-0x0000000000470000-0x000000000047A000-memory.dmp

Filesize
40KB

Download
memory/4512-39-0x00007FFA9D760000-0x00007FFA9E221000-memory.dmp

Filesize
10.8MB

Download
memory/4512-37-0x00007FFA9D760000-0x00007FFA9E221000-memory.dmp

Filesize
10.8MB

Download
memory/4512-36-0x00007FFA9D760000-0x00007FFA9E221000-memory.dmp

Filesize
10.8MB

Download