amadey | 40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7

Analysis

max time kernel
146s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 14:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe
Size

1.4MB
MD5

6e24e3a049e654de8c7f47df5de93cce
SHA1

59bfe17dfd0252b8fffecaf18951447742427391
SHA256

40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7
SHA512

2128dd6f0d307652f2fa0c6f83dc05c3d3897440350957658270e071cec5e679b299a353024d120659c34d80f9fb18bd85aca3749e503d7cf639b2a7c652447c
SSDEEP

24576:ilFu5KIjel9OUJY1wjiur7OvUpoyxJj9OeJC6gOk0ZSYfssQospWs:P57jel9OkNjl/nmyr9O6gO79fgpWs

Score

10^/10

amadey healer redline prets dropper evasion infostealer persistence trojan

Malware Config

Extracted

Family

amadey

Version

3.89

http://77.91.68.52/mac/index.php

http://77.91.68.78/help/index.php

Attributes

install_dir
fefffe8cea
install_file
explonde.exe
strings_key
916aae73606d7a9e02a1d3b47c199688

rc4.plain

Extracted

Family

redline

Botnet

prets

77.91.124.82:19071

Attributes

auth_value
44ee9617e145f5ca73d49c1a4a0c2e34

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detects Healer an antivirus disabler dropper 1 IoCs

resource	yara_rule
behavioral2/memory/3940-39-0x0000000000400000-0x000000000040A000-memory.dmp	healer

Healer
Healer an antivirus disabler dropper.
dropper healer

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	AppLaunch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	AppLaunch.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	t2000682.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	explonde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	w5123070.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	legota.exe

Executes dropped EXE 16 IoCs

pid	Process
2144	z0168990.exe
4912	z7213975.exe
1536	z6681071.exe
5024	z2407691.exe
4064	q4831979.exe
2220	r6203053.exe
4548	s6899684.exe
736	t2000682.exe
1712	explonde.exe
4316	u0287154.exe
3596	w5123070.exe
920	legota.exe
2788	explonde.exe
4128	legota.exe
4560	explonde.exe
4340	legota.exe

Loads dropped DLL 2 IoCs

pid	Process
2964	rundll32.exe
1460	rundll32.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	AppLaunch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	z0168990.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	z7213975.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	z6681071.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\""	z2407691.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2964 set thread context of 1632	2964	40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe	84
PID 4064 set thread context of 3940	4064	q4831979.exe	91
PID 2220 set thread context of 452	2220	r6203053.exe	94
PID 4316 set thread context of 3256	4316	u0287154.exe	116

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2092	452	WerFault.exe	94
2128	4548	WerFault.exe	95

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3584	schtasks.exe
3852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3940	AppLaunch.exe
3940	AppLaunch.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3940	AppLaunch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 1632	2964	40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe	84
PID 2964 wrote to memory of 1632	2964	40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe	84
PID 2964 wrote to memory of 1632	2964	40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe	84
PID 2964 wrote to memory of 1632	2964	40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe	84
PID 2964 wrote to memory of 1632	2964	40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe	84
PID 2964 wrote to memory of 1632	2964	40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe	84
PID 2964 wrote to memory of 1632	2964	40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe	84
PID 2964 wrote to memory of 1632	2964	40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe	84
PID 2964 wrote to memory of 1632	2964	40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe	84
PID 2964 wrote to memory of 1632	2964	40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe	84
PID 1632 wrote to memory of 2144	1632	AppLaunch.exe	85
PID 1632 wrote to memory of 2144	1632	AppLaunch.exe	85
PID 1632 wrote to memory of 2144	1632	AppLaunch.exe	85
PID 2144 wrote to memory of 4912	2144	z0168990.exe	86
PID 2144 wrote to memory of 4912	2144	z0168990.exe	86
PID 2144 wrote to memory of 4912	2144	z0168990.exe	86
PID 4912 wrote to memory of 1536	4912	z7213975.exe	87
PID 4912 wrote to memory of 1536	4912	z7213975.exe	87
PID 4912 wrote to memory of 1536	4912	z7213975.exe	87
PID 1536 wrote to memory of 5024	1536	z6681071.exe	88
PID 1536 wrote to memory of 5024	1536	z6681071.exe	88
PID 1536 wrote to memory of 5024	1536	z6681071.exe	88
PID 5024 wrote to memory of 4064	5024	z2407691.exe	89
PID 5024 wrote to memory of 4064	5024	z2407691.exe	89
PID 5024 wrote to memory of 4064	5024	z2407691.exe	89
PID 4064 wrote to memory of 3940	4064	q4831979.exe	91
PID 4064 wrote to memory of 3940	4064	q4831979.exe	91
PID 4064 wrote to memory of 3940	4064	q4831979.exe	91
PID 4064 wrote to memory of 3940	4064	q4831979.exe	91
PID 4064 wrote to memory of 3940	4064	q4831979.exe	91
PID 4064 wrote to memory of 3940	4064	q4831979.exe	91
PID 4064 wrote to memory of 3940	4064	q4831979.exe	91
PID 4064 wrote to memory of 3940	4064	q4831979.exe	91
PID 5024 wrote to memory of 2220	5024	z2407691.exe	92
PID 5024 wrote to memory of 2220	5024	z2407691.exe	92
PID 5024 wrote to memory of 2220	5024	z2407691.exe	92
PID 2220 wrote to memory of 452	2220	r6203053.exe	94
PID 2220 wrote to memory of 452	2220	r6203053.exe	94
PID 2220 wrote to memory of 452	2220	r6203053.exe	94
PID 2220 wrote to memory of 452	2220	r6203053.exe	94
PID 2220 wrote to memory of 452	2220	r6203053.exe	94
PID 2220 wrote to memory of 452	2220	r6203053.exe	94
PID 2220 wrote to memory of 452	2220	r6203053.exe	94
PID 2220 wrote to memory of 452	2220	r6203053.exe	94
PID 2220 wrote to memory of 452	2220	r6203053.exe	94
PID 2220 wrote to memory of 452	2220	r6203053.exe	94
PID 1536 wrote to memory of 4548	1536	z6681071.exe	95
PID 1536 wrote to memory of 4548	1536	z6681071.exe	95
PID 1536 wrote to memory of 4548	1536	z6681071.exe	95
PID 4912 wrote to memory of 736	4912	z7213975.exe	102
PID 4912 wrote to memory of 736	4912	z7213975.exe	102
PID 4912 wrote to memory of 736	4912	z7213975.exe	102
PID 736 wrote to memory of 1712	736	t2000682.exe	103
PID 736 wrote to memory of 1712	736	t2000682.exe	103
PID 736 wrote to memory of 1712	736	t2000682.exe	103
PID 2144 wrote to memory of 4316	2144	z0168990.exe	104
PID 2144 wrote to memory of 4316	2144	z0168990.exe	104
PID 2144 wrote to memory of 4316	2144	z0168990.exe	104
PID 1712 wrote to memory of 3584	1712	explonde.exe	106
PID 1712 wrote to memory of 3584	1712	explonde.exe	106
PID 1712 wrote to memory of 3584	1712	explonde.exe	106
PID 1712 wrote to memory of 392	1712	explonde.exe	108
PID 1712 wrote to memory of 392	1712	explonde.exe	108
PID 1712 wrote to memory of 392	1712	explonde.exe	108

C:\Users\Admin\AppData\Local\Temp\40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe
"C:\Users\Admin\AppData\Local\Temp\40e19666c393f1c97703635ee1c75282f304fa8392926361f70a26d6f29e29f7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0168990.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0168990.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7213975.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7213975.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6681071.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6681071.exe
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2407691.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2407691.exe
        6⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4831979.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4831979.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:4064
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        Modifies Windows Defender Real-time Protection settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6203053.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6203053.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2220
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        8⤵
        
        PID:452
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 452 -s 200
        9⤵
        Program crash
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6899684.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6899684.exe
        6⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 560
        7⤵
        Program crash
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2000682.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2000682.exe
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:736
      - C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1712
        
        C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F
        7⤵
        Creates scheduled task(s)
        
        PID:3584
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit
        7⤵
        
        PID:392
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:N"
        8⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "explonde.exe" /P "Admin:R" /E
        8⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        8⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:N"
        8⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\fefffe8cea" /P "Admin:R" /E
        8⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
        7⤵
        Loads dropped DLL
        
        PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0287154.exe
      C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0287154.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:4316
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        5⤵
        
        PID:3256
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5123070.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5123070.exe
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:3596
  - - C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
      "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:920
    - - C:\Windows\SysWOW64\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:3852
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit
        5⤵
        
        PID:4744
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:N"
        6⤵
        
        PID:1012
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:2280
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "legota.exe" /P "Admin:R" /E
        6⤵
        
        PID:3708
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:N"
        6⤵
        
        PID:4408
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        6⤵
        
        PID:3808
      - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb378487cf" /P "Admin:R" /E
        6⤵
        
        PID:1156
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
        5⤵
        Loads dropped DLL
        
        PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4548 -ip 4548
1⤵
PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 452 -ip 452
1⤵
PID:2592

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:2788

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:4128

C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe
1⤵
- Executes dropped EXE
PID:4560

C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe
1⤵
- Executes dropped EXE
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5123070.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w5123070.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0168990.exe

Filesize
1.0MB

MD5
335f782e7fc53a0de1d7db43be5fcc2d

SHA1
b6c5bd8121fb6dd9dc5e8822417afd2b1ac4ef2f

SHA256
156dc719f3ce4c01ab6a1820a09a565111ded1e25f4c3bd92bc0804e2642bfcb

SHA512
583d3384b8ba847ac8ea2ffe835941aba29b594efd66a480ea58fcae8a2529a7d58b9a41d68bf1345a8c4be8feb78af3b2ebdfa4412c8869bd2612d7c32a1172

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0168990.exe

Filesize
1.0MB

MD5
335f782e7fc53a0de1d7db43be5fcc2d

SHA1
b6c5bd8121fb6dd9dc5e8822417afd2b1ac4ef2f

SHA256
156dc719f3ce4c01ab6a1820a09a565111ded1e25f4c3bd92bc0804e2642bfcb

SHA512
583d3384b8ba847ac8ea2ffe835941aba29b594efd66a480ea58fcae8a2529a7d58b9a41d68bf1345a8c4be8feb78af3b2ebdfa4412c8869bd2612d7c32a1172

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0287154.exe

Filesize
399KB

MD5
60d37312457495eaa241b6646957eca2

SHA1
21143a97ff68901bfff100f87c5b240d538b80ab

SHA256
dbba7133719935565a652e8dfcbe882e46373925ba7159e19f0a01e7bf72c5a9

SHA512
8ab1f0bf4db4df3276f47befe0e3bdfb00f25afe17e06a308c9a932bdc1d17f4556c5d82305ce5d27c04b182a61201dbcc187784e5fef91a8e5d85c5a2d65ef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0287154.exe

Filesize
399KB

MD5
60d37312457495eaa241b6646957eca2

SHA1
21143a97ff68901bfff100f87c5b240d538b80ab

SHA256
dbba7133719935565a652e8dfcbe882e46373925ba7159e19f0a01e7bf72c5a9

SHA512
8ab1f0bf4db4df3276f47befe0e3bdfb00f25afe17e06a308c9a932bdc1d17f4556c5d82305ce5d27c04b182a61201dbcc187784e5fef91a8e5d85c5a2d65ef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7213975.exe

Filesize
786KB

MD5
0080e0a25447834894e60114e40a7fb8

SHA1
edeea98a723c04fe3445bb7b703b461975dc0a8a

SHA256
34d4ca73dfd165929252d112854cf7c770aa8e99137f5711df1ed713539bb2c1

SHA512
bbfb4a7383f34b85b0740b22d8bf9becfddf08ed4392e75df023389e93e8b104c09338260eb4d42228d068190cf50807dec60e2c9b366b614eaf09189de823b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7213975.exe

Filesize
786KB

MD5
0080e0a25447834894e60114e40a7fb8

SHA1
edeea98a723c04fe3445bb7b703b461975dc0a8a

SHA256
34d4ca73dfd165929252d112854cf7c770aa8e99137f5711df1ed713539bb2c1

SHA512
bbfb4a7383f34b85b0740b22d8bf9becfddf08ed4392e75df023389e93e8b104c09338260eb4d42228d068190cf50807dec60e2c9b366b614eaf09189de823b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2000682.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2000682.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6681071.exe

Filesize
603KB

MD5
fea6e6ff7894b67dfbda8a90bfa4085f

SHA1
d7d1de6e8d0a44b9e340c300d3ff7b5148bf2c4d

SHA256
1ce6403333741bb13e7038347c76c1aab2c486df88cbc954f3312e6dc482c3d7

SHA512
9e985751b8c8b01453406938412f51fc914813413aa55354bac7990e376af4c41148dbdabb2601fd96adba60884d580e57a241812a96bd3866262682c01faf01

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6681071.exe

Filesize
603KB

MD5
fea6e6ff7894b67dfbda8a90bfa4085f

SHA1
d7d1de6e8d0a44b9e340c300d3ff7b5148bf2c4d

SHA256
1ce6403333741bb13e7038347c76c1aab2c486df88cbc954f3312e6dc482c3d7

SHA512
9e985751b8c8b01453406938412f51fc914813413aa55354bac7990e376af4c41148dbdabb2601fd96adba60884d580e57a241812a96bd3866262682c01faf01

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6899684.exe

Filesize
255KB

MD5
3e8ed69bbdd806c08ef35d8e95d53e62

SHA1
be3429132cc891781588f77b828a7cccb47605e0

SHA256
04719bf8c554e65086944e1a104777b0769cb2ea8922e80bf6b7fe391df23fdf

SHA512
9f176f29aa1bd5d4d68bd9334ff87b6d967d811e08c9d177804809239361cb6bcf831179c16440901aeaf99bc54992da95e56e571c48f1c6a5f2638bc3605aec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6899684.exe

Filesize
255KB

MD5
3e8ed69bbdd806c08ef35d8e95d53e62

SHA1
be3429132cc891781588f77b828a7cccb47605e0

SHA256
04719bf8c554e65086944e1a104777b0769cb2ea8922e80bf6b7fe391df23fdf

SHA512
9f176f29aa1bd5d4d68bd9334ff87b6d967d811e08c9d177804809239361cb6bcf831179c16440901aeaf99bc54992da95e56e571c48f1c6a5f2638bc3605aec

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2407691.exe

Filesize
364KB

MD5
307398855b2c744bca8c2d4697b5a17f

SHA1
95040516aa7da8421bc160b73326b64a0eda463f

SHA256
746f1e09403c3bc78dbdee36ebdfc9b99dda2e1dd0354facf4233359a2e82a62

SHA512
8a8b992cbbbf77c7602ec376ce828d1f652bd9dbf362b84adeeae92648db0215df1d4063a009c1096412461a5ab4b90ad46de8ac059f9ac530652c63952c7c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2407691.exe

Filesize
364KB

MD5
307398855b2c744bca8c2d4697b5a17f

SHA1
95040516aa7da8421bc160b73326b64a0eda463f

SHA256
746f1e09403c3bc78dbdee36ebdfc9b99dda2e1dd0354facf4233359a2e82a62

SHA512
8a8b992cbbbf77c7602ec376ce828d1f652bd9dbf362b84adeeae92648db0215df1d4063a009c1096412461a5ab4b90ad46de8ac059f9ac530652c63952c7c3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4831979.exe

Filesize
236KB

MD5
b83ebaa03b7864f08bf58301ef6c6220

SHA1
fdae80dfa12cd685120fd8d7f01b318c8465ced9

SHA256
680eb351a495ce70a688fff21adb0fbeecc7652c8b33039e46d9161549901465

SHA512
b960121910eca52a4dc783117b4ed13562b1853036d33e132d0b60df8b7ed8dcfc5b2fdcc6a489092f3e17425adbf19c16dcfd280b4816765a1d8961b8341af5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4831979.exe

Filesize
236KB

MD5
b83ebaa03b7864f08bf58301ef6c6220

SHA1
fdae80dfa12cd685120fd8d7f01b318c8465ced9

SHA256
680eb351a495ce70a688fff21adb0fbeecc7652c8b33039e46d9161549901465

SHA512
b960121910eca52a4dc783117b4ed13562b1853036d33e132d0b60df8b7ed8dcfc5b2fdcc6a489092f3e17425adbf19c16dcfd280b4816765a1d8961b8341af5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6203053.exe

Filesize
393KB

MD5
65dca85c83c3baba541d2def53ad8b93

SHA1
45f0a60ef3990b926e03a54fd5855cebde7248da

SHA256
c3b40062f1ccd304820eb4194f69fd083b0204e07ea7e21e45bdd7ce4d000883

SHA512
a15bf08fd63365938853ebf7dbc2cf8d3cce0a1ef3ab5ebc9777183d082287eb4dadaadf48f455fea6833497407195cabbe8f870012441b841a500b43426e6d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6203053.exe

Filesize
393KB

MD5
65dca85c83c3baba541d2def53ad8b93

SHA1
45f0a60ef3990b926e03a54fd5855cebde7248da

SHA256
c3b40062f1ccd304820eb4194f69fd083b0204e07ea7e21e45bdd7ce4d000883

SHA512
a15bf08fd63365938853ebf7dbc2cf8d3cce0a1ef3ab5ebc9777183d082287eb4dadaadf48f455fea6833497407195cabbe8f870012441b841a500b43426e6d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe

Filesize
219KB

MD5
a427281ec99595c2a977a70e0009a30c

SHA1
c937c5d14127921f068a081bb3e8f450c9966852

SHA256
40ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3

SHA512
2a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe

Filesize
219KB

MD5
c256a814d3f9d02d73029580dfe882b3

SHA1
e11e9ea937183139753f3b0d5e71c8301d000896

SHA256
53f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c

SHA512
1f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
2ac6d3fcf6913b1a1ac100407e97fccb

SHA1
809f7d4ed348951b79745074487956255d1d0a9a

SHA256
30f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe

SHA512
79ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
273B

MD5
0c459e65bcc6d38574f0c0d63a87088a

SHA1
41e53d5f2b3e7ca859b842a1c7b677e0847e6d65

SHA256
871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4

SHA512
be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
ec41f740797d2253dc1902e71941bbdb

SHA1
407b75f07cb205fee94c4c6261641bd40c2c28e9

SHA256
47425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520

SHA512
e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
273B

MD5
6d5040418450624fef735b49ec6bffe9

SHA1
5fff6a1a620a5c4522aead8dbd0a5a52570e8773

SHA256
dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3

SHA512
bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0

Download Submit
memory/452-44-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/452-50-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/452-45-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/452-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1632-83-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/1632-1-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/1632-0-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/1632-3-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/1632-67-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/1632-2-0x0000000000400000-0x0000000000539000-memory.dmp

Filesize
1.2MB

Download
memory/3256-92-0x00000000056A0000-0x00000000056DC000-memory.dmp

Filesize
240KB

Download
memory/3256-90-0x00000000054F0000-0x0000000005500000-memory.dmp

Filesize
64KB

Download
memory/3256-94-0x00000000054F0000-0x0000000005500000-memory.dmp

Filesize
64KB

Download
memory/3256-88-0x0000000005C20000-0x0000000006238000-memory.dmp

Filesize
6.1MB

Download
memory/3256-89-0x0000000005710000-0x000000000581A000-memory.dmp

Filesize
1.0MB

Download
memory/3256-75-0x0000000002C90000-0x0000000002C96000-memory.dmp

Filesize
24KB

Download
memory/3256-87-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/3256-74-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/3256-91-0x0000000005640000-0x0000000005652000-memory.dmp

Filesize
72KB

Download
memory/3256-68-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/3256-93-0x0000000005820000-0x000000000586C000-memory.dmp

Filesize
304KB

Download
memory/3940-84-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/3940-39-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/3940-86-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download
memory/3940-43-0x0000000074830000-0x0000000074FE0000-memory.dmp

Filesize
7.7MB

Download