amadey | 802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7

Analysis

max time kernel
147s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2023 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exe
Size

784KB
MD5

f910c96a774511c70a402b08681951c3
SHA1

9c5ff65781624dd8eb8b35fad7a70d51fe6f1755
SHA256

802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7
SHA512

7fc2d740e44d619aa505f0892a5a343ae30554eeedd965374bed087dfcbc296c1dd071eb598f45352d506bf7b0596d32526487a1e12496251538a89adb4c1d1c
SSDEEP

24576:0yLjPBjtLRClZudSIK1J/4yZozkC5hmEJ5au:DFVUbIsJ3FC5LJ5a

Score

10^/10

amadey redline rosn spora discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

spora

176.113.115.145:4125

Attributes

auth_value
441b39ab37774b2ca9931c31e1bc6071

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

it435588.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it435588.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it435588.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it435588.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	it435588.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it435588.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it435588.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3836-165-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-166-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-168-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-170-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-172-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-174-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-176-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-178-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-180-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-182-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-184-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-186-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-188-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-190-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-192-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-194-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-196-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-198-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-200-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-202-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-204-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-206-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-208-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-210-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-212-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-214-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-216-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-218-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-220-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-222-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-224-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-226-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline
behavioral1/memory/3836-228-0x0000000004BB0000-0x0000000004BEF000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

lr029479.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	lr029479.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

Processes:

zixc0944.exeziuK5076.exeit435588.exejr580443.exekp885832.exelr029479.exeoneetx.exeoneetx.exeoneetx.exe

pid process

4676 zixc0944.exe
5100 ziuK5076.exe
4296 it435588.exe
3836 jr580443.exe
2156 kp885832.exe
4924 lr029479.exe
1396 oneetx.exe
3420 oneetx.exe
892 oneetx.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1940 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

it435588.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it435588.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4676	zixc0944.exe
5100	ziuK5076.exe
4296	it435588.exe
3836	jr580443.exe
2156	kp885832.exe
4924	lr029479.exe
1396	oneetx.exe
3420	oneetx.exe
892	oneetx.exe

pid	process
1940	rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it435588.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ziuK5076.exe802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exezixc0944.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziuK5076.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ziuK5076.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zixc0944.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zixc0944.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 28 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1724	3836	WerFault.exe	jr580443.exe
1208	4924	WerFault.exe	lr029479.exe
2320	4924	WerFault.exe	lr029479.exe
2196	4924	WerFault.exe	lr029479.exe
3400	4924	WerFault.exe	lr029479.exe
1432	4924	WerFault.exe	lr029479.exe
4516	4924	WerFault.exe	lr029479.exe
3780	4924	WerFault.exe	lr029479.exe
4216	4924	WerFault.exe	lr029479.exe
1952	4924	WerFault.exe	lr029479.exe
3352	4924	WerFault.exe	lr029479.exe
5072	1396	WerFault.exe	oneetx.exe
4484	1396	WerFault.exe	oneetx.exe
4376	1396	WerFault.exe	oneetx.exe
5112	1396	WerFault.exe	oneetx.exe
3720	1396	WerFault.exe	oneetx.exe
1844	1396	WerFault.exe	oneetx.exe
1232	1396	WerFault.exe	oneetx.exe
1100	1396	WerFault.exe	oneetx.exe
1228	1396	WerFault.exe	oneetx.exe
1748	1396	WerFault.exe	oneetx.exe
2084	1396	WerFault.exe	oneetx.exe
4208	3420	WerFault.exe	oneetx.exe
2540	1396	WerFault.exe	oneetx.exe
2964	1396	WerFault.exe	oneetx.exe
5064	1396	WerFault.exe	oneetx.exe
4708	1396	WerFault.exe	oneetx.exe
2528	892	WerFault.exe	oneetx.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4916 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

it435588.exejr580443.exekp885832.exe

pid process

4296 it435588.exe
4296 it435588.exe
3836 jr580443.exe
3836 jr580443.exe
2156 kp885832.exe
2156 kp885832.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

it435588.exejr580443.exekp885832.exe

description pid process

Token: SeDebugPrivilege 4296 it435588.exe
Token: SeDebugPrivilege 3836 jr580443.exe
Token: SeDebugPrivilege 2156 kp885832.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

lr029479.exe

pid process

4924 lr029479.exe

pid	process
4916	schtasks.exe

pid	process
4296	it435588.exe
4296	it435588.exe
3836	jr580443.exe
3836	jr580443.exe
2156	kp885832.exe
2156	kp885832.exe

description	pid	process
Token: SeDebugPrivilege	4296	it435588.exe
Token: SeDebugPrivilege	3836	jr580443.exe
Token: SeDebugPrivilege	2156	kp885832.exe

pid	process
4924	lr029479.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exezixc0944.exeziuK5076.exelr029479.exeoneetx.exe

description	pid	process	target process
PID 2560 wrote to memory of 4676	2560	802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exe	zixc0944.exe
PID 2560 wrote to memory of 4676	2560	802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exe	zixc0944.exe
PID 2560 wrote to memory of 4676	2560	802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exe	zixc0944.exe
PID 4676 wrote to memory of 5100	4676	zixc0944.exe	ziuK5076.exe
PID 4676 wrote to memory of 5100	4676	zixc0944.exe	ziuK5076.exe
PID 4676 wrote to memory of 5100	4676	zixc0944.exe	ziuK5076.exe
PID 5100 wrote to memory of 4296	5100	ziuK5076.exe	it435588.exe
PID 5100 wrote to memory of 4296	5100	ziuK5076.exe	it435588.exe
PID 5100 wrote to memory of 3836	5100	ziuK5076.exe	jr580443.exe
PID 5100 wrote to memory of 3836	5100	ziuK5076.exe	jr580443.exe
PID 5100 wrote to memory of 3836	5100	ziuK5076.exe	jr580443.exe
PID 4676 wrote to memory of 2156	4676	zixc0944.exe	kp885832.exe
PID 4676 wrote to memory of 2156	4676	zixc0944.exe	kp885832.exe
PID 4676 wrote to memory of 2156	4676	zixc0944.exe	kp885832.exe
PID 2560 wrote to memory of 4924	2560	802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exe	lr029479.exe
PID 2560 wrote to memory of 4924	2560	802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exe	lr029479.exe
PID 2560 wrote to memory of 4924	2560	802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exe	lr029479.exe
PID 4924 wrote to memory of 1396	4924	lr029479.exe	oneetx.exe
PID 4924 wrote to memory of 1396	4924	lr029479.exe	oneetx.exe
PID 4924 wrote to memory of 1396	4924	lr029479.exe	oneetx.exe
PID 1396 wrote to memory of 4916	1396	oneetx.exe	schtasks.exe
PID 1396 wrote to memory of 4916	1396	oneetx.exe	schtasks.exe
PID 1396 wrote to memory of 4916	1396	oneetx.exe	schtasks.exe
PID 1396 wrote to memory of 1940	1396	oneetx.exe	rundll32.exe
PID 1396 wrote to memory of 1940	1396	oneetx.exe	rundll32.exe
PID 1396 wrote to memory of 1940	1396	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exe
"C:\Users\Admin\AppData\Local\Temp\802735a9a2daa9502495842be8489173a67d0431826a930fea7921d2c18fd6f7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2560

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixc0944.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixc0944.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4676

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziuK5076.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziuK5076.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5100

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it435588.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it435588.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr580443.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr580443.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3836 -s 2060
5⤵
- Program crash
PID:1724

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp885832.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp885832.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr029479.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr029479.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 696
3⤵
- Program crash
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 776
3⤵
- Program crash
PID:2320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 796
3⤵
- Program crash
PID:2196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 960
3⤵
- Program crash
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 800
3⤵
- Program crash
PID:1432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 980
3⤵
- Program crash
PID:4516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 1220
3⤵
- Program crash
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 1208
3⤵
- Program crash
PID:4216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 1316
3⤵
- Program crash
PID:1952

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 692
4⤵
- Program crash
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 884
4⤵
- Program crash
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 948
4⤵
- Program crash
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 1080
4⤵
- Program crash
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 888
4⤵
- Program crash
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 888
4⤵
- Program crash
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 1080
4⤵
- Program crash
PID:1232

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
4⤵
- Creates scheduled task(s)
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 996
4⤵
- Program crash
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 1300
4⤵
- Program crash
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 692
4⤵
- Program crash
PID:1748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 788
4⤵
- Program crash
PID:2084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 1136
4⤵
- Program crash
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 1628
4⤵
- Program crash
PID:2964

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 1568
4⤵
- Program crash
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 1644
4⤵
- Program crash
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4924 -s 1360
3⤵
- Program crash
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3836 -ip 3836
1⤵
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4924 -ip 4924
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4924 -ip 4924
1⤵
PID:2840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4924 -ip 4924
1⤵
PID:3888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4924 -ip 4924
1⤵
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4924 -ip 4924
1⤵
PID:1824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4924 -ip 4924
1⤵
PID:1588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4924 -ip 4924
1⤵
PID:556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4924 -ip 4924
1⤵
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4924 -ip 4924
1⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4924 -ip 4924
1⤵
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1396 -ip 1396
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1396 -ip 1396
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1396 -ip 1396
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1396 -ip 1396
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1396 -ip 1396
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1396 -ip 1396
1⤵
PID:1876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1396 -ip 1396
1⤵
PID:1636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1396 -ip 1396
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 1396 -ip 1396
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1396 -ip 1396
1⤵
PID:2684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1396 -ip 1396
1⤵
PID:3672

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3420 -s 320
2⤵
- Program crash
PID:4208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3420 -ip 3420
1⤵
PID:2880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1396 -ip 1396
1⤵
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1396 -ip 1396
1⤵
PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1396 -ip 1396
1⤵
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1396 -ip 1396
1⤵
PID:1416

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 892 -s 312
2⤵
- Program crash
PID:2528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 892 -ip 892
1⤵
PID:2816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
Filesize
226KB

MD5
d8c3f20eef4f33bd865589859629bf41

SHA1
3590244f8774ff4ac4e3c54cdbb149363fd9dc7d

SHA256
2883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f

SHA512
52b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
Filesize
226KB

MD5
d8c3f20eef4f33bd865589859629bf41

SHA1
3590244f8774ff4ac4e3c54cdbb149363fd9dc7d

SHA256
2883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f

SHA512
52b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
Filesize
226KB

MD5
d8c3f20eef4f33bd865589859629bf41

SHA1
3590244f8774ff4ac4e3c54cdbb149363fd9dc7d

SHA256
2883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f

SHA512
52b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
Filesize
226KB

MD5
d8c3f20eef4f33bd865589859629bf41

SHA1
3590244f8774ff4ac4e3c54cdbb149363fd9dc7d

SHA256
2883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f

SHA512
52b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
Filesize
226KB

MD5
d8c3f20eef4f33bd865589859629bf41

SHA1
3590244f8774ff4ac4e3c54cdbb149363fd9dc7d

SHA256
2883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f

SHA512
52b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr029479.exe
Filesize
226KB

MD5
d8c3f20eef4f33bd865589859629bf41

SHA1
3590244f8774ff4ac4e3c54cdbb149363fd9dc7d

SHA256
2883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f

SHA512
52b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr029479.exe
Filesize
226KB

MD5
d8c3f20eef4f33bd865589859629bf41

SHA1
3590244f8774ff4ac4e3c54cdbb149363fd9dc7d

SHA256
2883beaaf38f654125933398a46d5bd8c9db9fd04793cb50b28eb2343b4dd36f

SHA512
52b84685dacaa20eac474ee035ff3302d95324a3bf9deeff447c05a0d8066cda8fa86592e48806c661de4510b83bbae4a76ec121594e4987b27c1f883bfc77cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixc0944.exe
Filesize
522KB

MD5
eeb67c730816bf98ffd29e9f2bea257b

SHA1
d0eb7f388f5e3d8f83aa9725dd2875860aee2adc

SHA256
be2c5fe2aad2f7b56548a8a228871912bba5643b07271873a15cb7a25a0903b0

SHA512
d91bbd977eeb995f823734747b1ed249136228fbbca033bb350a4e2b0ec2b954e1c1b2c8b1814fc944c886d143b2dbeceeaffbcb6388c3fea798f2620e5176b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zixc0944.exe
Filesize
522KB

MD5
eeb67c730816bf98ffd29e9f2bea257b

SHA1
d0eb7f388f5e3d8f83aa9725dd2875860aee2adc

SHA256
be2c5fe2aad2f7b56548a8a228871912bba5643b07271873a15cb7a25a0903b0

SHA512
d91bbd977eeb995f823734747b1ed249136228fbbca033bb350a4e2b0ec2b954e1c1b2c8b1814fc944c886d143b2dbeceeaffbcb6388c3fea798f2620e5176b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp885832.exe
Filesize
175KB

MD5
bb6d43fa4ebafe62b98ec4dea4ff49d9

SHA1
d8188e664ac977f59d3ec26589e3cf67b1fab23b

SHA256
1d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89

SHA512
679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp885832.exe
Filesize
175KB

MD5
bb6d43fa4ebafe62b98ec4dea4ff49d9

SHA1
d8188e664ac977f59d3ec26589e3cf67b1fab23b

SHA256
1d1cdf01afc38fc6784a41fe8aa2f308ec44606d2d16c4edd9445813af33fe89

SHA512
679a0e394c5751020c38ceaba6a1bd1a33c558b8c9142fc796fa3570baa0ac082d099891451fde50249e165625b9738ead7321dccf2b2da567f3f7e3d4ee4644

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziuK5076.exe
Filesize
379KB

MD5
155cd2f75b2ed07f754e799cccfc2823

SHA1
ad6038f2f4fffe2c6900551e9afc6d43b13623d0

SHA256
65ed4a0138f8399ab5a5b0b1dfdbdc0e3f6b4c283bb275c7a31bdd2ce5fd88f2

SHA512
0f25e08a6866ac5c06ef124fc34682746d61ff72cf9a0baae4851cb824a74aa7fea3e1e82db828df82d5c2d168e76ca85081746f5c24a505ef6d128ea990f508

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziuK5076.exe
Filesize
379KB

MD5
155cd2f75b2ed07f754e799cccfc2823

SHA1
ad6038f2f4fffe2c6900551e9afc6d43b13623d0

SHA256
65ed4a0138f8399ab5a5b0b1dfdbdc0e3f6b4c283bb275c7a31bdd2ce5fd88f2

SHA512
0f25e08a6866ac5c06ef124fc34682746d61ff72cf9a0baae4851cb824a74aa7fea3e1e82db828df82d5c2d168e76ca85081746f5c24a505ef6d128ea990f508

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it435588.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it435588.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr580443.exe
Filesize
292KB

MD5
0f720866cac9466e67925d003ba4de79

SHA1
5da5895873e53131e514ac6b10412a1552ad0870

SHA256
c652f2c2da4a523225f1b6c7210c98a581fd8eee75db962b41c8b5fb863663c7

SHA512
5b1c9aa86ce8744165ea8a46745a0073b5c78a0531f160cfc962df8a74dc0300c90e5efafd063634da178e3627a8f6a3a5170b3e587d9833bd4e0e62fd6e3e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr580443.exe
Filesize
292KB

MD5
0f720866cac9466e67925d003ba4de79

SHA1
5da5895873e53131e514ac6b10412a1552ad0870

SHA256
c652f2c2da4a523225f1b6c7210c98a581fd8eee75db962b41c8b5fb863663c7

SHA512
5b1c9aa86ce8744165ea8a46745a0073b5c78a0531f160cfc962df8a74dc0300c90e5efafd063634da178e3627a8f6a3a5170b3e587d9833bd4e0e62fd6e3e07

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/2156-1094-0x0000000005240000-0x0000000005250000-memory.dmp

Filesize
64KB

Download
memory/2156-1093-0x0000000000690000-0x00000000006C2000-memory.dmp

Filesize
200KB

Download
memory/3836-206-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-1071-0x0000000005200000-0x0000000005818000-memory.dmp

Filesize
6.1MB

Download
memory/3836-180-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-182-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-184-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-186-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-188-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-190-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-192-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-194-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-196-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-198-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-200-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-202-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-204-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-176-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-208-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-210-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-212-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-214-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-216-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-218-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-220-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-222-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-224-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-226-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-228-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-178-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-1072-0x00000000058A0000-0x00000000059AA000-memory.dmp

Filesize
1.0MB

Download
memory/3836-1073-0x00000000059E0000-0x00000000059F2000-memory.dmp

Filesize
72KB

Download
memory/3836-1074-0x0000000005A00000-0x0000000005A3C000-memory.dmp

Filesize
240KB

Download
memory/3836-1075-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/3836-1077-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/3836-1078-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/3836-1079-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/3836-1080-0x0000000005CF0000-0x0000000005D82000-memory.dmp

Filesize
584KB

Download
memory/3836-1081-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/3836-1082-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/3836-174-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-172-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-1083-0x00000000066F0000-0x00000000068B2000-memory.dmp

Filesize
1.8MB

Download
memory/3836-1084-0x00000000068D0000-0x0000000006DFC000-memory.dmp

Filesize
5.2MB

Download
memory/3836-1085-0x0000000007120000-0x0000000007196000-memory.dmp

Filesize
472KB

Download
memory/3836-1086-0x00000000071C0000-0x0000000007210000-memory.dmp

Filesize
320KB

Download
memory/3836-160-0x0000000000590000-0x00000000005DB000-memory.dmp

Filesize
300KB

Download
memory/3836-161-0x0000000004C30000-0x00000000051D4000-memory.dmp

Filesize
5.6MB

Download
memory/3836-170-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-168-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-166-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-165-0x0000000004BB0000-0x0000000004BEF000-memory.dmp

Filesize
252KB

Download
memory/3836-164-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/3836-163-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/3836-162-0x0000000004C20000-0x0000000004C30000-memory.dmp

Filesize
64KB

Download
memory/4296-154-0x0000000000DD0000-0x0000000000DDA000-memory.dmp

Filesize
40KB

Download
memory/4924-1100-0x00000000005A0000-0x00000000005DB000-memory.dmp

Filesize
236KB

Download