amadey | b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2023 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exe
Size

800KB
MD5

12ad365accf1820b6ed8364197d9b39e
SHA1

3edc9d918b5e70c25fc629853ca928cc36933536
SHA256

b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b
SHA512

d485e4033fce8ea8cb3f51441b019ce73fca9b49067fe0799d31d7f7a38f0a30fee170dd1dcd8c39891ffe64b32e49726e395d8d5d0086da765b5b9052a75cdf
SSDEEP

12288:NMrey90shQvIEBZi1oN9yLBWFCWMyApDX154BiJIkzdvN/YR9NkV:HyPa1HdN9O+nuXP4BiNdG9NkV

Score

10^/10

amadey redline rosn zima discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

zima

176.113.115.145:4125

Attributes

auth_value
2ef701d510c0d27e8a8e3270281678b1

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

it242120.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it242120.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it242120.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it242120.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it242120.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it242120.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	it242120.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4572-164-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-167-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-165-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-169-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-171-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-173-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-175-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-177-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-179-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-181-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-183-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-185-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-187-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-189-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-192-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-196-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-198-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-200-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-202-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-204-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-206-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-208-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-210-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-212-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-214-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-216-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-218-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-220-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-222-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-224-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-226-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-228-0x0000000004BA0000-0x0000000004BDF000-memory.dmp	family_redline
behavioral1/memory/4572-1083-0x0000000004C00000-0x0000000004C10000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

lr874549.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	lr874549.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

Processes:

ziKn2897.exezixC3028.exeit242120.exejr633298.exekp004292.exelr874549.exeoneetx.exeoneetx.exeoneetx.exe

pid process

1000 ziKn2897.exe
4240 zixC3028.exe
1512 it242120.exe
4572 jr633298.exe
2072 kp004292.exe
2188 lr874549.exe
4556 oneetx.exe
2552 oneetx.exe
4812 oneetx.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4156 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

it242120.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it242120.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1000	ziKn2897.exe
4240	zixC3028.exe
1512	it242120.exe
4572	jr633298.exe
2072	kp004292.exe
2188	lr874549.exe
4556	oneetx.exe
2552	oneetx.exe
4812	oneetx.exe

pid	process
4156	rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it242120.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exeziKn2897.exezixC3028.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziKn2897.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziKn2897.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zixC3028.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zixC3028.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

5016 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
5016	sc.exe

Program crash 35 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2552	4572	WerFault.exe	jr633298.exe
4452	2188	WerFault.exe	lr874549.exe
1312	2188	WerFault.exe	lr874549.exe
1368	2188	WerFault.exe	lr874549.exe
4804	2188	WerFault.exe	lr874549.exe
3140	2188	WerFault.exe	lr874549.exe
3960	2188	WerFault.exe	lr874549.exe
528	2188	WerFault.exe	lr874549.exe
3844	2188	WerFault.exe	lr874549.exe
2576	2188	WerFault.exe	lr874549.exe
3188	2188	WerFault.exe	lr874549.exe
432	4556	WerFault.exe	oneetx.exe
1564	4556	WerFault.exe	oneetx.exe
1424	4556	WerFault.exe	oneetx.exe
1432	4556	WerFault.exe	oneetx.exe
212	4556	WerFault.exe	oneetx.exe
2816	4556	WerFault.exe	oneetx.exe
2168	4556	WerFault.exe	oneetx.exe
4388	4556	WerFault.exe	oneetx.exe
4952	4556	WerFault.exe	oneetx.exe
4456	4556	WerFault.exe	oneetx.exe
1820	4556	WerFault.exe	oneetx.exe
32	4556	WerFault.exe	oneetx.exe
4076	2552	WerFault.exe	oneetx.exe
4712	2552	WerFault.exe	oneetx.exe
3972	2552	WerFault.exe	oneetx.exe
4792	2552	WerFault.exe	oneetx.exe
3572	4556	WerFault.exe	oneetx.exe
2208	4556	WerFault.exe	oneetx.exe
2200	4556	WerFault.exe	oneetx.exe
4400	4812	WerFault.exe	oneetx.exe
4260	4812	WerFault.exe	oneetx.exe
4936	4812	WerFault.exe	oneetx.exe
4236	4812	WerFault.exe	oneetx.exe
1016	4556	WerFault.exe	oneetx.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3748 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

it242120.exejr633298.exekp004292.exe

pid process

1512 it242120.exe
1512 it242120.exe
4572 jr633298.exe
4572 jr633298.exe
2072 kp004292.exe
2072 kp004292.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

it242120.exejr633298.exekp004292.exe

description pid process

Token: SeDebugPrivilege 1512 it242120.exe
Token: SeDebugPrivilege 4572 jr633298.exe
Token: SeDebugPrivilege 2072 kp004292.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

lr874549.exe

pid process

2188 lr874549.exe

pid	process
3748	schtasks.exe

pid	process
1512	it242120.exe
1512	it242120.exe
4572	jr633298.exe
4572	jr633298.exe
2072	kp004292.exe
2072	kp004292.exe

description	pid	process
Token: SeDebugPrivilege	1512	it242120.exe
Token: SeDebugPrivilege	4572	jr633298.exe
Token: SeDebugPrivilege	2072	kp004292.exe

pid	process
2188	lr874549.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exeziKn2897.exezixC3028.exelr874549.exeoneetx.exe

description	pid	process	target process
PID 3384 wrote to memory of 1000	3384	b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exe	ziKn2897.exe
PID 3384 wrote to memory of 1000	3384	b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exe	ziKn2897.exe
PID 3384 wrote to memory of 1000	3384	b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exe	ziKn2897.exe
PID 1000 wrote to memory of 4240	1000	ziKn2897.exe	zixC3028.exe
PID 1000 wrote to memory of 4240	1000	ziKn2897.exe	zixC3028.exe
PID 1000 wrote to memory of 4240	1000	ziKn2897.exe	zixC3028.exe
PID 4240 wrote to memory of 1512	4240	zixC3028.exe	it242120.exe
PID 4240 wrote to memory of 1512	4240	zixC3028.exe	it242120.exe
PID 4240 wrote to memory of 4572	4240	zixC3028.exe	jr633298.exe
PID 4240 wrote to memory of 4572	4240	zixC3028.exe	jr633298.exe
PID 4240 wrote to memory of 4572	4240	zixC3028.exe	jr633298.exe
PID 1000 wrote to memory of 2072	1000	ziKn2897.exe	kp004292.exe
PID 1000 wrote to memory of 2072	1000	ziKn2897.exe	kp004292.exe
PID 1000 wrote to memory of 2072	1000	ziKn2897.exe	kp004292.exe
PID 3384 wrote to memory of 2188	3384	b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exe	lr874549.exe
PID 3384 wrote to memory of 2188	3384	b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exe	lr874549.exe
PID 3384 wrote to memory of 2188	3384	b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exe	lr874549.exe
PID 2188 wrote to memory of 4556	2188	lr874549.exe	oneetx.exe
PID 2188 wrote to memory of 4556	2188	lr874549.exe	oneetx.exe
PID 2188 wrote to memory of 4556	2188	lr874549.exe	oneetx.exe
PID 4556 wrote to memory of 3748	4556	oneetx.exe	schtasks.exe
PID 4556 wrote to memory of 3748	4556	oneetx.exe	schtasks.exe
PID 4556 wrote to memory of 3748	4556	oneetx.exe	schtasks.exe
PID 4556 wrote to memory of 4156	4556	oneetx.exe	rundll32.exe
PID 4556 wrote to memory of 4156	4556	oneetx.exe	rundll32.exe
PID 4556 wrote to memory of 4156	4556	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exe
"C:\Users\Admin\AppData\Local\Temp\b79086e31bbb1198a12aa80805fcb477300ed93200bfbfb802b62e92abebb82b.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKn2897.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKn2897.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1000
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zixC3028.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zixC3028.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it242120.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it242120.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr633298.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr633298.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4572
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 1360
        5⤵
        Program crash
        
        PID:2552
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp004292.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp004292.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2072
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr874549.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr874549.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 696
    3⤵
    - Program crash
    PID:4452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 796
    3⤵
    - Program crash
    PID:1312
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 856
    3⤵
    - Program crash
    PID:1368
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 952
    3⤵
    - Program crash
    PID:4804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 972
    3⤵
    - Program crash
    PID:3140
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 984
    3⤵
    - Program crash
    PID:3960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 1220
    3⤵
    - Program crash
    PID:528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 1236
    3⤵
    - Program crash
    PID:3844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 1328
    3⤵
    - Program crash
    PID:2576
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 692
      4⤵
      Program crash
      PID:432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 836
      4⤵
      Program crash
      PID:1564
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 908
      4⤵
      Program crash
      PID:1424
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1052
      4⤵
      Program crash
      PID:1432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1072
      4⤵
      Program crash
      PID:212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1072
      4⤵
      Program crash
      PID:2816
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1096
      4⤵
      Program crash
      PID:2168
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 992
      4⤵
      Program crash
      PID:4388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1264
      4⤵
      Program crash
      PID:4952
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 744
      4⤵
      Program crash
      PID:4456
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 692
      4⤵
      Program crash
      PID:1820
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1476
      4⤵
      Program crash
      PID:32
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1144
      4⤵
      Program crash
      PID:3572
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1668
      4⤵
      Program crash
      PID:2208
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:4156
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1108
      4⤵
      Program crash
      PID:2200
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 1648
      4⤵
      Program crash
      PID:1016
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2188 -s 1716
    3⤵
    - Program crash
    PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4572 -ip 4572
1⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2188 -ip 2188
1⤵
PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2188 -ip 2188
1⤵
PID:3572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2188 -ip 2188
1⤵
PID:4684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2188 -ip 2188
1⤵
PID:1088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2188 -ip 2188
1⤵
PID:4368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2188 -ip 2188
1⤵
PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2188 -ip 2188
1⤵
PID:4840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2188 -ip 2188
1⤵
PID:1980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2188 -ip 2188
1⤵
PID:3052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2188 -ip 2188
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 4556 -ip 4556
1⤵
PID:1104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4556 -ip 4556
1⤵
PID:3004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4556 -ip 4556
1⤵
PID:2644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 4556 -ip 4556
1⤵
PID:4220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 4556 -ip 4556
1⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4556 -ip 4556
1⤵
PID:3756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4556 -ip 4556
1⤵
PID:2556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 4556 -ip 4556
1⤵
PID:4864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4556 -ip 4556
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4556 -ip 4556
1⤵
PID:936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4556 -ip 4556
1⤵
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 4556 -ip 4556
1⤵
PID:3344

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:2552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 396
  2⤵
  - Program crash
  PID:4076
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 504
  2⤵
  - Program crash
  PID:4712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 608
  2⤵
  - Program crash
  PID:3972
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 648
  2⤵
  - Program crash
  PID:4792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2552 -ip 2552
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 2552 -ip 2552
1⤵
PID:2612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 708 -p 2552 -ip 2552
1⤵
PID:1724

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 2552 -ip 2552
1⤵
PID:2072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 4556 -ip 4556
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4556 -ip 4556
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4556 -ip 4556
1⤵
PID:3148

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:4812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 392
  2⤵
  - Program crash
  PID:4400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 504
  2⤵
  - Program crash
  PID:4260
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 608
  2⤵
  - Program crash
  PID:4936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 652
  2⤵
  - Program crash
  PID:4236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 4812 -ip 4812
1⤵
PID:3868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 4812 -ip 4812
1⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4812 -ip 4812
1⤵
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4812 -ip 4812
1⤵
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 4556 -ip 4556
1⤵
PID:1540

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:5016

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr874549.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr874549.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKn2897.exe

Filesize
536KB

MD5
33e3b90df114c924d8d5b54c128b65e7

SHA1
7be52211f57015d4e805304e4e5f7f566b74073b

SHA256
890c9927b8e55373df89482939edad76dd47173bd7ab2e5e1ac47fde59cb2b81

SHA512
b1f15e37c4dbf4179382286dbb48cf006902e4fe9329709c095fcfde6c2518b39099b986902394efb0dce64712054097dda1c4bcac6248eaea8ccc5c5f26f35c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziKn2897.exe

Filesize
536KB

MD5
33e3b90df114c924d8d5b54c128b65e7

SHA1
7be52211f57015d4e805304e4e5f7f566b74073b

SHA256
890c9927b8e55373df89482939edad76dd47173bd7ab2e5e1ac47fde59cb2b81

SHA512
b1f15e37c4dbf4179382286dbb48cf006902e4fe9329709c095fcfde6c2518b39099b986902394efb0dce64712054097dda1c4bcac6248eaea8ccc5c5f26f35c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp004292.exe

Filesize
168KB

MD5
69ad19f1c67bae5df41d7db22dda8702

SHA1
f6bfca8856db65102ac01aa8fcb743b811f0333f

SHA256
142fe7b5cc89696515ef82de14c2787c642a28846e85854da234b786035eb9bf

SHA512
73f73132ceb93bdb90461078a3b19c1f9082e9873c82d92748d6195da69fb861e7abe9a5880c1ac87f9d50303c7ca1d50b4e8dd8628bad076988b0da9a8f1d72

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp004292.exe

Filesize
168KB

MD5
69ad19f1c67bae5df41d7db22dda8702

SHA1
f6bfca8856db65102ac01aa8fcb743b811f0333f

SHA256
142fe7b5cc89696515ef82de14c2787c642a28846e85854da234b786035eb9bf

SHA512
73f73132ceb93bdb90461078a3b19c1f9082e9873c82d92748d6195da69fb861e7abe9a5880c1ac87f9d50303c7ca1d50b4e8dd8628bad076988b0da9a8f1d72

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zixC3028.exe

Filesize
382KB

MD5
69eeb6a391c5029e379d087eaac053fc

SHA1
db552684daec72f6d61be84621a1c5de3ab4fff3

SHA256
ee347a635ff33c7c6c96f2e859ba3ea5e11028f5543edd6aba3f38b57c93ee7b

SHA512
12e9883b861e3862f337be0123bd3832d7d37475be18553a4fbc336312a789cf96b5939eaa65dd05da7b0eab07bb2864dd69fcd2d60075700717490237274c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zixC3028.exe

Filesize
382KB

MD5
69eeb6a391c5029e379d087eaac053fc

SHA1
db552684daec72f6d61be84621a1c5de3ab4fff3

SHA256
ee347a635ff33c7c6c96f2e859ba3ea5e11028f5543edd6aba3f38b57c93ee7b

SHA512
12e9883b861e3862f337be0123bd3832d7d37475be18553a4fbc336312a789cf96b5939eaa65dd05da7b0eab07bb2864dd69fcd2d60075700717490237274c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it242120.exe

Filesize
11KB

MD5
adb4b9bc6d0130b8dd135320e29c9f0b

SHA1
9aa3cb6759afa11b8f9571df9e5036b57a478e8e

SHA256
282c0c0824fafdc922447523a01e33798b6d36d53980905caf18371aec18fd21

SHA512
a0e771ea5b4ac7fddd471711090cfc27a694de9e7c11f1c85be4f120c70231653cd2a87bf446600be5d25e6c575403c51e64aa9a5477005fb93585eaa43b4b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it242120.exe

Filesize
11KB

MD5
adb4b9bc6d0130b8dd135320e29c9f0b

SHA1
9aa3cb6759afa11b8f9571df9e5036b57a478e8e

SHA256
282c0c0824fafdc922447523a01e33798b6d36d53980905caf18371aec18fd21

SHA512
a0e771ea5b4ac7fddd471711090cfc27a694de9e7c11f1c85be4f120c70231653cd2a87bf446600be5d25e6c575403c51e64aa9a5477005fb93585eaa43b4b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr633298.exe

Filesize
298KB

MD5
c506c30c125fa3d10120d30d7be97471

SHA1
8c0a9a932c1838b33bf23ec9d973e505500b9812

SHA256
f213a74f3613669b2f41ff51c804e18d86e99a3158b36ed040869a306c868d46

SHA512
a665a24de2c044d28dfedb9093a4c292ec9184a7e7b8acf99f244bd2bfa72c55519764b1a1447c902cbff5f8a89e3ccf81fb95a51e27545fc5c9d1144e5b8fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr633298.exe

Filesize
298KB

MD5
c506c30c125fa3d10120d30d7be97471

SHA1
8c0a9a932c1838b33bf23ec9d973e505500b9812

SHA256
f213a74f3613669b2f41ff51c804e18d86e99a3158b36ed040869a306c868d46

SHA512
a665a24de2c044d28dfedb9093a4c292ec9184a7e7b8acf99f244bd2bfa72c55519764b1a1447c902cbff5f8a89e3ccf81fb95a51e27545fc5c9d1144e5b8fe6

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1512-154-0x0000000000C10000-0x0000000000C1A000-memory.dmp

Filesize
40KB

Download
memory/1512-155-0x000000001CD80000-0x000000001CECE000-memory.dmp

Filesize
1.3MB

Download
memory/1512-157-0x000000001CD80000-0x000000001CECE000-memory.dmp

Filesize
1.3MB

Download
memory/2072-1095-0x0000000004E50000-0x0000000004E60000-memory.dmp

Filesize
64KB

Download
memory/2072-1094-0x0000000000550000-0x0000000000580000-memory.dmp

Filesize
192KB

Download
memory/2188-1101-0x00000000005E0000-0x000000000061B000-memory.dmp

Filesize
236KB

Download
memory/4572-206-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-1075-0x00000000059E0000-0x00000000059F2000-memory.dmp

Filesize
72KB

Download
memory/4572-191-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4572-192-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-193-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4572-195-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4572-196-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-198-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-200-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-202-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-204-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-187-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-208-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-210-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-212-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-214-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-216-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-218-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-220-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-222-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-224-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-226-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-228-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-1073-0x0000000005200000-0x0000000005818000-memory.dmp

Filesize
6.1MB

Download
memory/4572-1074-0x00000000058A0000-0x00000000059AA000-memory.dmp

Filesize
1.0MB

Download
memory/4572-189-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-1076-0x0000000005A00000-0x0000000005A3C000-memory.dmp

Filesize
240KB

Download
memory/4572-1077-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4572-1079-0x0000000005CF0000-0x0000000005D82000-memory.dmp

Filesize
584KB

Download
memory/4572-1080-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/4572-1081-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4572-1082-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4572-1083-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4572-1084-0x0000000006700000-0x0000000006776000-memory.dmp

Filesize
472KB

Download
memory/4572-1085-0x0000000006780000-0x00000000067D0000-memory.dmp

Filesize
320KB

Download
memory/4572-1086-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/4572-185-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-183-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-181-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-179-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-177-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-175-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-173-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-171-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-169-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-165-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-167-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-164-0x0000000004BA0000-0x0000000004BDF000-memory.dmp

Filesize
252KB

Download
memory/4572-163-0x0000000004C10000-0x00000000051B4000-memory.dmp

Filesize
5.6MB

Download
memory/4572-162-0x00000000004D0000-0x000000000051B000-memory.dmp

Filesize
300KB

Download
memory/4572-1087-0x00000000067F0000-0x00000000069B2000-memory.dmp

Filesize
1.8MB

Download
memory/4572-1088-0x00000000069C0000-0x0000000006EEC000-memory.dmp

Filesize
5.2MB

Download