Malware Analysis Report

2025-08-10 13:17

Sample ID 241109-ejryxaxclj
Target 400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9
SHA256 400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9
Tags
amadey healer redline 88c8bb gotad discovery dropper evasion infostealer persistence trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9

Threat Level: Known bad

The file 400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9 was found to be: Known bad.

Malicious Activity Summary

amadey healer redline 88c8bb gotad discovery dropper evasion infostealer persistence trojan

Healer family

RedLine

RedLine payload

Amadey

Amadey family

Healer

Redline family

Modifies Windows Defender Real-time Protection settings

Detects Healer an antivirus disabler dropper

Executes dropped EXE

Checks computer location settings

Windows security modification

Adds Run key to start application

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-09 03:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-09 03:58

Reported

2024-11-09 04:01

Platform

win10v2004-20241007-en

Max time kernel

144s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9.exe"

Signatures

Amadey

trojan amadey

Amadey family

amadey

Detects Healer an antivirus disabler dropper

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Healer

dropper healer

Healer family

healer

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe N/A

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6650536.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6650536.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6056972.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6650536.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4128 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe
PID 4128 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe
PID 4128 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe
PID 3596 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe
PID 3596 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe
PID 3596 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe
PID 3012 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe
PID 3012 wrote to memory of 212 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe
PID 3012 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6650536.exe
PID 3012 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6650536.exe
PID 3012 wrote to memory of 864 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6650536.exe
PID 864 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6650536.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 864 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6650536.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 864 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6650536.exe C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
PID 3596 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6056972.exe
PID 3596 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6056972.exe
PID 3596 wrote to memory of 3956 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6056972.exe
PID 3876 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3876 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3876 wrote to memory of 3732 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\schtasks.exe
PID 3876 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3876 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 3876 wrote to memory of 4388 N/A C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe C:\Windows\SysWOW64\cmd.exe
PID 4388 wrote to memory of 4168 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4388 wrote to memory of 4168 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4388 wrote to memory of 4168 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4388 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4388 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4388 wrote to memory of 4192 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4388 wrote to memory of 4964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4388 wrote to memory of 4964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4388 wrote to memory of 4964 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4388 wrote to memory of 1076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4388 wrote to memory of 1076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4388 wrote to memory of 1076 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 4388 wrote to memory of 4348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4388 wrote to memory of 4348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4388 wrote to memory of 4348 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4388 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4388 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe
PID 4388 wrote to memory of 3528 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9.exe

"C:\Users\Admin\AppData\Local\Temp\400106768324fc754c6c7b6e06a84e7440076322895077396dc0a11bed5558c9.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6650536.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6650536.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6056972.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6056972.exe

C:\Windows\SysWOW64\schtasks.exe

"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "pdates.exe" /P "Admin:R" /E

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /S /D /c" echo Y"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:N"

C:\Windows\SysWOW64\cacls.exe

CACLS "..\925e7e99c5" /P "Admin:R" /E

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
FI 77.91.68.61:80 tcp
FI 77.91.124.84:19071 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
FI 77.91.124.84:19071 tcp
FI 77.91.124.84:19071 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y1890406.exe

MD5 88ef46dda070363911b003e6f4c1f893
SHA1 5783008626216a22b2e20cb42c387d4edc98a9ee
SHA256 3299ae1ceabe673a50723911897bd0c8758774af6b61e3aa4df8263e58a01ebd
SHA512 1bd413da67cd92c7fb52f9c02fe9fbd001e04d5a14f196fd562ffb1835f0c6be1171819a762e6711655ec40c31cdc1ca8712a9c59f37f7adbc76f8abab752102

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y8246755.exe

MD5 8f8acad043542e0b1d82b83e18fc81dc
SHA1 0e0a5f5ba80fae9768b9b0f12e3ad4a3164f3dab
SHA256 61eeb21319fcce433987f1ae4ae7a1d459d9c69a168523b97befa6930370fa49
SHA512 3660340b7fde00da508a2c3b410a939e9d559235a087f37aab5075a21b00961a8ca1b740ec0c2f88d99f38869c8ae1707e492c8026e1eec03abe28c564fa9caa

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k8726340.exe

MD5 7e93bacbbc33e6652e147e7fe07572a0
SHA1 421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512 250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

memory/212-21-0x00007FF92EEA3000-0x00007FF92EEA5000-memory.dmp

memory/212-22-0x0000000000B60000-0x0000000000B6A000-memory.dmp

memory/212-23-0x00007FF92EEA3000-0x00007FF92EEA5000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l6650536.exe

MD5 aea234064483f651010cf9d981f59fea
SHA1 002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6
SHA256 58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503
SHA512 eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\m6056972.exe

MD5 1821e415dfea725010604c65c9259b78
SHA1 ec885712788c798130446cfee5769c8059ac1c4f
SHA256 52d5722126a684dac8ece9da3c3067c8081727a59ae511af1c59c5a7ee9146dd
SHA512 2649423e207544956548e9e0cf4d729fa7385c40e3a1379c28a90a2bd36bdd640e9c7d04c2a3901f7cacd149b9b9cacab358384fe3e55632c81e3ce38e42ed75

memory/3956-41-0x0000000000B80000-0x0000000000BB0000-memory.dmp

memory/3956-42-0x0000000002FD0000-0x0000000002FD6000-memory.dmp

memory/3956-43-0x0000000005B00000-0x0000000006118000-memory.dmp

memory/3956-44-0x00000000055F0000-0x00000000056FA000-memory.dmp

memory/3956-45-0x0000000005510000-0x0000000005522000-memory.dmp

memory/3956-46-0x0000000005570000-0x00000000055AC000-memory.dmp

memory/3956-47-0x0000000005700000-0x000000000574C000-memory.dmp