amadey | 2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2

Analysis

max time kernel
119s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 21:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2.exe
Size

999KB
MD5

845598401fc3fa0c5e007d85db9cbdc7
SHA1

5627fe8281bba6375a5c056ff82b7b13c986aa80
SHA256

2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2
SHA512

3b050017c144beebf489d33f16307e03faa1e4100f5d25da282e79cfd33c1f3f0418137c501407ef8e6a7b611150b2dcfb6ccfe97ea8fb669a737b511ce83ba6
SSDEEP

24576:Hy3T63ZqFPTMxEVfEFywRRNpbd1lv+3Wqob2q56iwgB:S3TjYxWUX51lmGqA2m6iw

Score

10^/10

amadey redline lift rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

lift

176.113.115.145:4125

Attributes

auth_value
94f33c242a83de9dcc729e29ec435dfb

Extracted

Family

amadey

Version

3.69

193.233.20.36/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz8653.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz8653.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v2841Hx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v2841Hx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v2841Hx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v2841Hx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz8653.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz8653.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v2841Hx.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v2841Hx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz8653.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz8653.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 20 IoCs

resource	yara_rule
behavioral1/memory/3364-211-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-210-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-219-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-221-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-217-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-215-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-213-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-223-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-225-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-227-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-229-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-231-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-233-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-235-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-237-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-243-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-241-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-239-0x0000000006710000-0x000000000674F000-memory.dmp	family_redline
behavioral1/memory/3364-1127-0x0000000003B90000-0x0000000003BA0000-memory.dmp	family_redline
behavioral1/memory/3364-1128-0x0000000003B90000-0x0000000003BA0000-memory.dmp	family_redline

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	y89GN13.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 12 IoCs

pid	Process
4384	zap2721.exe
3352	zap7180.exe
1568	zap0939.exe
4360	tz8653.exe
3416	v2841Hx.exe
3364	w19nv51.exe
3164	xYmeY89.exe
2544	y89GN13.exe
880	oneetx.exe
4392	Crypted.exe
4476	buildghost.exe
4600	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
2352	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v2841Hx.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz8653.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v2841Hx.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap7180.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap0939.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap0939.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap2721.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap2721.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap7180.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
34	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3196	3416	WerFault.exe	89
4440	3364	WerFault.exe	93

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4360	tz8653.exe
4360	tz8653.exe
3416	v2841Hx.exe
3416	v2841Hx.exe
3364	w19nv51.exe
3364	w19nv51.exe
3164	xYmeY89.exe
3164	xYmeY89.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4360	tz8653.exe
Token: SeDebugPrivilege	3416	v2841Hx.exe
Token: SeDebugPrivilege	3364	w19nv51.exe
Token: SeDebugPrivilege	3164	xYmeY89.exe
Token: SeDebugPrivilege	4476	buildghost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	y89GN13.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1232 wrote to memory of 4384	1232	2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2.exe	85
PID 1232 wrote to memory of 4384	1232	2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2.exe	85
PID 1232 wrote to memory of 4384	1232	2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2.exe	85
PID 4384 wrote to memory of 3352	4384	zap2721.exe	86
PID 4384 wrote to memory of 3352	4384	zap2721.exe	86
PID 4384 wrote to memory of 3352	4384	zap2721.exe	86
PID 3352 wrote to memory of 1568	3352	zap7180.exe	87
PID 3352 wrote to memory of 1568	3352	zap7180.exe	87
PID 3352 wrote to memory of 1568	3352	zap7180.exe	87
PID 1568 wrote to memory of 4360	1568	zap0939.exe	88
PID 1568 wrote to memory of 4360	1568	zap0939.exe	88
PID 1568 wrote to memory of 3416	1568	zap0939.exe	89
PID 1568 wrote to memory of 3416	1568	zap0939.exe	89
PID 1568 wrote to memory of 3416	1568	zap0939.exe	89
PID 3352 wrote to memory of 3364	3352	zap7180.exe	93
PID 3352 wrote to memory of 3364	3352	zap7180.exe	93
PID 3352 wrote to memory of 3364	3352	zap7180.exe	93
PID 4384 wrote to memory of 3164	4384	zap2721.exe	96
PID 4384 wrote to memory of 3164	4384	zap2721.exe	96
PID 4384 wrote to memory of 3164	4384	zap2721.exe	96
PID 1232 wrote to memory of 2544	1232	2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2.exe	97
PID 1232 wrote to memory of 2544	1232	2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2.exe	97
PID 1232 wrote to memory of 2544	1232	2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2.exe	97
PID 2544 wrote to memory of 880	2544	y89GN13.exe	98
PID 2544 wrote to memory of 880	2544	y89GN13.exe	98
PID 2544 wrote to memory of 880	2544	y89GN13.exe	98
PID 880 wrote to memory of 3948	880	oneetx.exe	99
PID 880 wrote to memory of 3948	880	oneetx.exe	99
PID 880 wrote to memory of 3948	880	oneetx.exe	99
PID 880 wrote to memory of 3384	880	oneetx.exe	101
PID 880 wrote to memory of 3384	880	oneetx.exe	101
PID 880 wrote to memory of 3384	880	oneetx.exe	101
PID 3384 wrote to memory of 1764	3384	cmd.exe	103
PID 3384 wrote to memory of 1764	3384	cmd.exe	103
PID 3384 wrote to memory of 1764	3384	cmd.exe	103
PID 3384 wrote to memory of 4284	3384	cmd.exe	104
PID 3384 wrote to memory of 4284	3384	cmd.exe	104
PID 3384 wrote to memory of 4284	3384	cmd.exe	104
PID 3384 wrote to memory of 4256	3384	cmd.exe	105
PID 3384 wrote to memory of 4256	3384	cmd.exe	105
PID 3384 wrote to memory of 4256	3384	cmd.exe	105
PID 3384 wrote to memory of 1504	3384	cmd.exe	106
PID 3384 wrote to memory of 1504	3384	cmd.exe	106
PID 3384 wrote to memory of 1504	3384	cmd.exe	106
PID 3384 wrote to memory of 4592	3384	cmd.exe	107
PID 3384 wrote to memory of 4592	3384	cmd.exe	107
PID 3384 wrote to memory of 4592	3384	cmd.exe	107
PID 3384 wrote to memory of 428	3384	cmd.exe	108
PID 3384 wrote to memory of 428	3384	cmd.exe	108
PID 3384 wrote to memory of 428	3384	cmd.exe	108
PID 880 wrote to memory of 4392	880	oneetx.exe	109
PID 880 wrote to memory of 4392	880	oneetx.exe	109
PID 880 wrote to memory of 4392	880	oneetx.exe	109
PID 880 wrote to memory of 4476	880	oneetx.exe	110
PID 880 wrote to memory of 4476	880	oneetx.exe	110
PID 880 wrote to memory of 2352	880	oneetx.exe	111
PID 880 wrote to memory of 2352	880	oneetx.exe	111
PID 880 wrote to memory of 2352	880	oneetx.exe	111

C:\Users\Admin\AppData\Local\Temp\2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2.exe
"C:\Users\Admin\AppData\Local\Temp\2a1a039f4841e6958fcc9bca2d377dc9ab73bd0ef0f6b7ffe17815a5934768d2.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1232
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2721.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2721.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7180.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7180.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0939.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0939.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8653.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8653.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2841Hx.exe
        
        C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2841Hx.exe
        5⤵
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Windows security modification
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3416
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 1064
        6⤵
        Program crash
        
        PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19nv51.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19nv51.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 1896
        5⤵
        Program crash
        
        PID:4440
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYmeY89.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYmeY89.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3164
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89GN13.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89GN13.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:880
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3948
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\c5d2db5804" /P "Admin:N"&&CACLS "..\c5d2db5804" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3384
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:1764
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:4284
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:4256
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:1504
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c5d2db5804" /P "Admin:N"
        5⤵
        
        PID:4592
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\c5d2db5804" /P "Admin:R" /E
        5⤵
        
        PID:428
  - - C:\Users\Admin\AppData\Local\Temp\1000028001\Crypted.exe
      "C:\Users\Admin\AppData\Local\Temp\1000028001\Crypted.exe"
      4⤵
      Executes dropped EXE
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\1000029001\buildghost.exe
      "C:\Users\Admin\AppData\Local\Temp\1000029001\buildghost.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:4476
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:2352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3416 -ip 3416
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3364 -ip 3364
1⤵
PID:1964

C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe
1⤵
- Executes dropped EXE
PID:4600

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1000028001\Crypted.exe

Filesize
323KB

MD5
4b357990f0543c5d97897dec4419b2ea

SHA1
9a5e81ddceb7d98ecf36712a03834d9acd9ef48e

SHA256
78250e56eb74256bbff94794bb9e325fa053b3f2e37077fe4675c8c0ec8c59ba

SHA512
aa0f883fdb5c8a9c2b1ecdbb30f316d51b7fe95ac771e62b5089d040513ceb6887af2a2c2b4b5edd7d755b9287c30d4b78f02f47c7058e8eff49a2e57aadaaea

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000028001\Crypted.exe

Filesize
323KB

MD5
4b357990f0543c5d97897dec4419b2ea

SHA1
9a5e81ddceb7d98ecf36712a03834d9acd9ef48e

SHA256
78250e56eb74256bbff94794bb9e325fa053b3f2e37077fe4675c8c0ec8c59ba

SHA512
aa0f883fdb5c8a9c2b1ecdbb30f316d51b7fe95ac771e62b5089d040513ceb6887af2a2c2b4b5edd7d755b9287c30d4b78f02f47c7058e8eff49a2e57aadaaea

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000028001\Crypted.exe

Filesize
323KB

MD5
4b357990f0543c5d97897dec4419b2ea

SHA1
9a5e81ddceb7d98ecf36712a03834d9acd9ef48e

SHA256
78250e56eb74256bbff94794bb9e325fa053b3f2e37077fe4675c8c0ec8c59ba

SHA512
aa0f883fdb5c8a9c2b1ecdbb30f316d51b7fe95ac771e62b5089d040513ceb6887af2a2c2b4b5edd7d755b9287c30d4b78f02f47c7058e8eff49a2e57aadaaea

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000029001\buildghost.exe

Filesize
51KB

MD5
6dc5093b21da27e63cdee704e910f936

SHA1
5b90c867205a209bf69387a59ed97cc4aef3dc77

SHA256
86fd1820b532ba02bfc4c72c9a6486f2e3f55e3dd44f4ab6f53665b3765984c9

SHA512
f46dffe6ef752eb7801cedd1008156546cfae6e3730a395d64d123eb040bdfd116ee3e2ea42d69ee0f676f1d9577b2549de999711f3cde410e345f57fb249b8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000029001\buildghost.exe

Filesize
51KB

MD5
6dc5093b21da27e63cdee704e910f936

SHA1
5b90c867205a209bf69387a59ed97cc4aef3dc77

SHA256
86fd1820b532ba02bfc4c72c9a6486f2e3f55e3dd44f4ab6f53665b3765984c9

SHA512
f46dffe6ef752eb7801cedd1008156546cfae6e3730a395d64d123eb040bdfd116ee3e2ea42d69ee0f676f1d9577b2549de999711f3cde410e345f57fb249b8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000029001\buildghost.exe

Filesize
51KB

MD5
6dc5093b21da27e63cdee704e910f936

SHA1
5b90c867205a209bf69387a59ed97cc4aef3dc77

SHA256
86fd1820b532ba02bfc4c72c9a6486f2e3f55e3dd44f4ab6f53665b3765984c9

SHA512
f46dffe6ef752eb7801cedd1008156546cfae6e3730a395d64d123eb040bdfd116ee3e2ea42d69ee0f676f1d9577b2549de999711f3cde410e345f57fb249b8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89GN13.exe

Filesize
236KB

MD5
3546b37c6f32baafc41922581a8206e9

SHA1
1bdb7ec3103e458e4a124abd99d58700879fe8a1

SHA256
27c972a18a05f10618e96125962a16cabd72d8b7f69417fceb793fe98e373313

SHA512
d653f3b80c9a193d4a3ae84869e1aa2e40c447ba7e86f0d53883acab3d32771f3e07351ab8015601cd892514da067b06156a3872c4dd60a92d8dc68a15811e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y89GN13.exe

Filesize
236KB

MD5
3546b37c6f32baafc41922581a8206e9

SHA1
1bdb7ec3103e458e4a124abd99d58700879fe8a1

SHA256
27c972a18a05f10618e96125962a16cabd72d8b7f69417fceb793fe98e373313

SHA512
d653f3b80c9a193d4a3ae84869e1aa2e40c447ba7e86f0d53883acab3d32771f3e07351ab8015601cd892514da067b06156a3872c4dd60a92d8dc68a15811e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2721.exe

Filesize
815KB

MD5
787c5821b5204bbd9bbe3e56df8302c0

SHA1
a8074ab06a6f4991c4bbe2bc1f3d04f46a844ce1

SHA256
55bcac50bb2ef7ffad47442b6335b1a6103b38d948d9c5a2b33608da7bf405aa

SHA512
74049a2bcce050a2871333ab9513d6fe8e8ba4c487c865b652a98a8acaa0d72bf4a1267b7f201ef18119f2fbe9c6ae9e21e8f0a67baa22b90bc3405a67f939c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap2721.exe

Filesize
815KB

MD5
787c5821b5204bbd9bbe3e56df8302c0

SHA1
a8074ab06a6f4991c4bbe2bc1f3d04f46a844ce1

SHA256
55bcac50bb2ef7ffad47442b6335b1a6103b38d948d9c5a2b33608da7bf405aa

SHA512
74049a2bcce050a2871333ab9513d6fe8e8ba4c487c865b652a98a8acaa0d72bf4a1267b7f201ef18119f2fbe9c6ae9e21e8f0a67baa22b90bc3405a67f939c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYmeY89.exe

Filesize
175KB

MD5
b4a0628f24993a64cb7de818d04a6ea3

SHA1
da2353b9bb8529e8d3c3fb6ea6231d1182c735dd

SHA256
94066f636cdb479cec492a65a631ff30af767932009c97c8df0c1b8cfb118cd8

SHA512
55fdf541f5011af05dc8afee0bf831654ce2ff37c5f05eccb8e0899adb5f54168001fdeab4175cdb4d7f9b7744402774519bc5a2f31e9584a464dfadb77a4caf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xYmeY89.exe

Filesize
175KB

MD5
b4a0628f24993a64cb7de818d04a6ea3

SHA1
da2353b9bb8529e8d3c3fb6ea6231d1182c735dd

SHA256
94066f636cdb479cec492a65a631ff30af767932009c97c8df0c1b8cfb118cd8

SHA512
55fdf541f5011af05dc8afee0bf831654ce2ff37c5f05eccb8e0899adb5f54168001fdeab4175cdb4d7f9b7744402774519bc5a2f31e9584a464dfadb77a4caf

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7180.exe

Filesize
673KB

MD5
f8cf76632290d36b33fe2eee13f99abe

SHA1
27d22447693069f09732388e8481e807a2b4bad9

SHA256
fc81a1cfae34f610320230f778076956647a38ebda3982ebe317106d7056865a

SHA512
53ff375765102c803d0032ec933a28677c73d0cdf217eca746dd1d1cef26b44e9e392efea12e6b4d76530274240b42aace4597c833c803bae892b30292a7a665

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7180.exe

Filesize
673KB

MD5
f8cf76632290d36b33fe2eee13f99abe

SHA1
27d22447693069f09732388e8481e807a2b4bad9

SHA256
fc81a1cfae34f610320230f778076956647a38ebda3982ebe317106d7056865a

SHA512
53ff375765102c803d0032ec933a28677c73d0cdf217eca746dd1d1cef26b44e9e392efea12e6b4d76530274240b42aace4597c833c803bae892b30292a7a665

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19nv51.exe

Filesize
359KB

MD5
37d9abfb9ca384ae2ea34c48bd96e8d0

SHA1
2dca7a107500b72f4c6919ff90276bfdbb6d2514

SHA256
422139bfca006f808c24e0abdc7236192915b254698f36c2119791cf7d5c4ccf

SHA512
5548ab3196b78a6f71b231a04447067c383e101b9c5ff47201fe6866aeff51fe5b932446287b67ff513d6cb305f5c5eafd329cda70482c1060a1324c8a037a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19nv51.exe

Filesize
359KB

MD5
37d9abfb9ca384ae2ea34c48bd96e8d0

SHA1
2dca7a107500b72f4c6919ff90276bfdbb6d2514

SHA256
422139bfca006f808c24e0abdc7236192915b254698f36c2119791cf7d5c4ccf

SHA512
5548ab3196b78a6f71b231a04447067c383e101b9c5ff47201fe6866aeff51fe5b932446287b67ff513d6cb305f5c5eafd329cda70482c1060a1324c8a037a73

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0939.exe

Filesize
333KB

MD5
671b7f176e7732af2d1478eb3b0330f7

SHA1
94e3c5faaceecfb3f2d6610c037e86251d2f44a5

SHA256
6bae4ddfd6995742c9244e11b901402f02e3cca75c23674df93d51dc77975b65

SHA512
36c1f78dbb6f693f0c9669e76f57edb385ac241b1b093cb23ac4a670daaa48f64b1f5ddf3eaf9f4119ab9bb1f4eef357f82021ed0519b8912e59ea652ce88a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap0939.exe

Filesize
333KB

MD5
671b7f176e7732af2d1478eb3b0330f7

SHA1
94e3c5faaceecfb3f2d6610c037e86251d2f44a5

SHA256
6bae4ddfd6995742c9244e11b901402f02e3cca75c23674df93d51dc77975b65

SHA512
36c1f78dbb6f693f0c9669e76f57edb385ac241b1b093cb23ac4a670daaa48f64b1f5ddf3eaf9f4119ab9bb1f4eef357f82021ed0519b8912e59ea652ce88a9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8653.exe

Filesize
11KB

MD5
77c06d90742d8a47aaa9a0de251e354c

SHA1
7093e1dfd6707015b4d55e0cae3bd895de53ef97

SHA256
d26e443a261981f9b6d556f0ffa0afea82e397b727b99910706252cb1b3bd012

SHA512
3e10d699112f347f9e1706339222a3ae1776b8540480466f065d208be9283bd52492387c80e713ec2dca576093c24e889a63150683853798b46535dbd509268f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8653.exe

Filesize
11KB

MD5
77c06d90742d8a47aaa9a0de251e354c

SHA1
7093e1dfd6707015b4d55e0cae3bd895de53ef97

SHA256
d26e443a261981f9b6d556f0ffa0afea82e397b727b99910706252cb1b3bd012

SHA512
3e10d699112f347f9e1706339222a3ae1776b8540480466f065d208be9283bd52492387c80e713ec2dca576093c24e889a63150683853798b46535dbd509268f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2841Hx.exe

Filesize
301KB

MD5
ce9a40128008c11bc9bf9d5bf60d2fa5

SHA1
ac66cc0315c6363d100073e8bf837c47ee152bdd

SHA256
dcc5554b3785bd5342040ead43587f095e9c48c894d46774aa40b79ed0f1410c

SHA512
a4f362d7c5fb292ed37ecb35f086c37969a7e40d7e9f9cff8ccf4a1df40574e47a10699be05c5b42a1c50144f973d5c4ac0619f2e39f7518bb003d8d11e84ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2841Hx.exe

Filesize
301KB

MD5
ce9a40128008c11bc9bf9d5bf60d2fa5

SHA1
ac66cc0315c6363d100073e8bf837c47ee152bdd

SHA256
dcc5554b3785bd5342040ead43587f095e9c48c894d46774aa40b79ed0f1410c

SHA512
a4f362d7c5fb292ed37ecb35f086c37969a7e40d7e9f9cff8ccf4a1df40574e47a10699be05c5b42a1c50144f973d5c4ac0619f2e39f7518bb003d8d11e84ac1

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe

Filesize
236KB

MD5
3546b37c6f32baafc41922581a8206e9

SHA1
1bdb7ec3103e458e4a124abd99d58700879fe8a1

SHA256
27c972a18a05f10618e96125962a16cabd72d8b7f69417fceb793fe98e373313

SHA512
d653f3b80c9a193d4a3ae84869e1aa2e40c447ba7e86f0d53883acab3d32771f3e07351ab8015601cd892514da067b06156a3872c4dd60a92d8dc68a15811e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe

Filesize
236KB

MD5
3546b37c6f32baafc41922581a8206e9

SHA1
1bdb7ec3103e458e4a124abd99d58700879fe8a1

SHA256
27c972a18a05f10618e96125962a16cabd72d8b7f69417fceb793fe98e373313

SHA512
d653f3b80c9a193d4a3ae84869e1aa2e40c447ba7e86f0d53883acab3d32771f3e07351ab8015601cd892514da067b06156a3872c4dd60a92d8dc68a15811e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe

Filesize
236KB

MD5
3546b37c6f32baafc41922581a8206e9

SHA1
1bdb7ec3103e458e4a124abd99d58700879fe8a1

SHA256
27c972a18a05f10618e96125962a16cabd72d8b7f69417fceb793fe98e373313

SHA512
d653f3b80c9a193d4a3ae84869e1aa2e40c447ba7e86f0d53883acab3d32771f3e07351ab8015601cd892514da067b06156a3872c4dd60a92d8dc68a15811e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\c5d2db5804\oneetx.exe

Filesize
236KB

MD5
3546b37c6f32baafc41922581a8206e9

SHA1
1bdb7ec3103e458e4a124abd99d58700879fe8a1

SHA256
27c972a18a05f10618e96125962a16cabd72d8b7f69417fceb793fe98e373313

SHA512
d653f3b80c9a193d4a3ae84869e1aa2e40c447ba7e86f0d53883acab3d32771f3e07351ab8015601cd892514da067b06156a3872c4dd60a92d8dc68a15811e36

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll

Filesize
89KB

MD5
6a4c2f2b6e1bbce94b4d00e91e690d0d

SHA1
f61021fd82dabd2ccde8d1e46736b1a9f4e4ce57

SHA256
8b6af7cc4fc3bcb4172a2bf4a7727175ba48980bcc808e56ce7744d28af60a8f

SHA512
8c9154748e410b71942c5316b1bdcc5590f7f0da33c0139fb4c86087a78b8c16ab76f1fa724524169e0f3d1a3d1f138dfd60979ee3e4b6487a66532879371f01

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/3164-1141-0x0000000000D30000-0x0000000000D62000-memory.dmp

Filesize
200KB

Download
memory/3164-1142-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/3364-1133-0x0000000003B90000-0x0000000003BA0000-memory.dmp

Filesize
64KB

Download
memory/3364-1126-0x0000000003B90000-0x0000000003BA0000-memory.dmp

Filesize
64KB

Download
memory/3364-1135-0x0000000007DA0000-0x00000000082CC000-memory.dmp

Filesize
5.2MB

Download
memory/3364-1134-0x0000000007BD0000-0x0000000007D92000-memory.dmp

Filesize
1.8MB

Download
memory/3364-1132-0x0000000007A20000-0x0000000007A70000-memory.dmp

Filesize
320KB

Download
memory/3364-1131-0x0000000007990000-0x0000000007A06000-memory.dmp

Filesize
472KB

Download
memory/3364-211-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-210-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-219-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-221-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-217-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-215-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-213-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-223-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-225-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-227-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-229-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-231-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-233-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-235-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-237-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-243-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-241-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-239-0x0000000006710000-0x000000000674F000-memory.dmp

Filesize
252KB

Download
memory/3364-336-0x0000000001D90000-0x0000000001DDB000-memory.dmp

Filesize
300KB

Download
memory/3364-341-0x0000000003B90000-0x0000000003BA0000-memory.dmp

Filesize
64KB

Download
memory/3364-338-0x0000000003B90000-0x0000000003BA0000-memory.dmp

Filesize
64KB

Download
memory/3364-342-0x0000000003B90000-0x0000000003BA0000-memory.dmp

Filesize
64KB

Download
memory/3364-1120-0x0000000006750000-0x0000000006D68000-memory.dmp

Filesize
6.1MB

Download
memory/3364-1121-0x0000000006DB0000-0x0000000006EBA000-memory.dmp

Filesize
1.0MB

Download
memory/3364-1122-0x0000000006EE0000-0x0000000006EF2000-memory.dmp

Filesize
72KB

Download
memory/3364-1123-0x0000000006F00000-0x0000000006F3C000-memory.dmp

Filesize
240KB

Download
memory/3364-1124-0x0000000003B90000-0x0000000003BA0000-memory.dmp

Filesize
64KB

Download
memory/3364-1130-0x0000000007290000-0x00000000072F6000-memory.dmp

Filesize
408KB

Download
memory/3364-1127-0x0000000003B90000-0x0000000003BA0000-memory.dmp

Filesize
64KB

Download
memory/3364-1128-0x0000000003B90000-0x0000000003BA0000-memory.dmp

Filesize
64KB

Download
memory/3364-1129-0x00000000071F0000-0x0000000007282000-memory.dmp

Filesize
584KB

Download
memory/3416-182-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-205-0x0000000000400000-0x0000000001AE3000-memory.dmp

Filesize
22.9MB

Download
memory/3416-203-0x0000000003950000-0x0000000003960000-memory.dmp

Filesize
64KB

Download
memory/3416-186-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-184-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-204-0x0000000003950000-0x0000000003960000-memory.dmp

Filesize
64KB

Download
memory/3416-188-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-197-0x0000000003950000-0x0000000003960000-memory.dmp

Filesize
64KB

Download
memory/3416-199-0x0000000003950000-0x0000000003960000-memory.dmp

Filesize
64KB

Download
memory/3416-198-0x0000000003950000-0x0000000003960000-memory.dmp

Filesize
64KB

Download
memory/3416-192-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-180-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-194-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-190-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-202-0x0000000003950000-0x0000000003960000-memory.dmp

Filesize
64KB

Download
memory/3416-200-0x0000000000400000-0x0000000001AE3000-memory.dmp

Filesize
22.9MB

Download
memory/3416-196-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-178-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-176-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-172-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-174-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-167-0x0000000001BC0000-0x0000000001BED000-memory.dmp

Filesize
180KB

Download
memory/3416-168-0x00000000061D0000-0x0000000006774000-memory.dmp

Filesize
5.6MB

Download
memory/3416-169-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/3416-170-0x0000000003930000-0x0000000003942000-memory.dmp

Filesize
72KB

Download
memory/4360-161-0x0000000000A90000-0x0000000000A9A000-memory.dmp

Filesize
40KB

Download
memory/4476-1198-0x00000218FBDD0000-0x00000218FBDE0000-memory.dmp

Filesize
64KB

Download
memory/4476-1197-0x00000218F9DD0000-0x00000218F9E20000-memory.dmp

Filesize
320KB

Download
memory/4476-1196-0x00000218F81A0000-0x00000218F81B2000-memory.dmp

Filesize
72KB

Download