amadey | 0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94

Analysis

max time kernel
146s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2023 18:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exe
Size

801KB
MD5

b0b237c424e30afac8796c70ab3f7d86
SHA1

2b81dafb1112035880cce1e6ed42815bb1a60b00
SHA256

0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94
SHA512

b2f3a476758012a99cbf2d04e5190113442e2cae3a330f3eb78ba0b4273c90b655ab5a8f720b36e15fb62bb090e14906387cfda192e5730f05c4ba96f2d37347
SSDEEP

12288:AMrGy90nhP7m72Jwu5Ayrj7D3QoHqyhWMRsCG+S2dzMZ3fD5P5uNPYcIn:WyChTJwuXH5qysnCP2PMNPYcw

Score

10^/10

amadey redline rosn zima discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

zima

176.113.115.145:4125

Attributes

auth_value
2ef701d510c0d27e8a8e3270281678b1

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

it515536.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it515536.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it515536.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it515536.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it515536.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it515536.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	it515536.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 34 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4360-162-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-163-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-165-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-167-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-169-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-171-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-174-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-176-0x00000000022A0000-0x00000000022B0000-memory.dmp	family_redline
behavioral1/memory/4360-178-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-180-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-182-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-184-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-186-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-188-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-190-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-192-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-194-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-196-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-198-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-200-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-202-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-204-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-206-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-208-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-210-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-212-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-214-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-216-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-218-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-220-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-222-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-224-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-226-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline
behavioral1/memory/4360-228-0x0000000005160000-0x000000000519F000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

lr437774.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	lr437774.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

Processes:

ziAy8989.exeziGC6039.exeit515536.exejr052907.exekp572630.exelr437774.exeoneetx.exeoneetx.exeoneetx.exe

pid process

1800 ziAy8989.exe
4424 ziGC6039.exe
4248 it515536.exe
4360 jr052907.exe
2868 kp572630.exe
4072 lr437774.exe
3632 oneetx.exe
3320 oneetx.exe
3864 oneetx.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2084 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

it515536.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it515536.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1800	ziAy8989.exe
4424	ziGC6039.exe
4248	it515536.exe
4360	jr052907.exe
2868	kp572630.exe
4072	lr437774.exe
3632	oneetx.exe
3320	oneetx.exe
3864	oneetx.exe

pid	process
2084	rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it515536.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ziGC6039.exe0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exeziAy8989.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ziGC6039.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziAy8989.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziAy8989.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziGC6039.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 35 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3048	4360	WerFault.exe	jr052907.exe
4952	4072	WerFault.exe	lr437774.exe
4412	4072	WerFault.exe	lr437774.exe
2880	4072	WerFault.exe	lr437774.exe
1168	4072	WerFault.exe	lr437774.exe
744	4072	WerFault.exe	lr437774.exe
1884	4072	WerFault.exe	lr437774.exe
2160	4072	WerFault.exe	lr437774.exe
3748	4072	WerFault.exe	lr437774.exe
4804	4072	WerFault.exe	lr437774.exe
4624	4072	WerFault.exe	lr437774.exe
1872	3632	WerFault.exe	oneetx.exe
708	3632	WerFault.exe	oneetx.exe
1328	3632	WerFault.exe	oneetx.exe
4844	3632	WerFault.exe	oneetx.exe
2024	3632	WerFault.exe	oneetx.exe
2464	3632	WerFault.exe	oneetx.exe
448	3632	WerFault.exe	oneetx.exe
388	3632	WerFault.exe	oneetx.exe
4736	3632	WerFault.exe	oneetx.exe
5108	3632	WerFault.exe	oneetx.exe
3640	3632	WerFault.exe	oneetx.exe
5028	3632	WerFault.exe	oneetx.exe
1600	3320	WerFault.exe	oneetx.exe
452	3320	WerFault.exe	oneetx.exe
4240	3320	WerFault.exe	oneetx.exe
2008	3320	WerFault.exe	oneetx.exe
3548	3632	WerFault.exe	oneetx.exe
3520	3632	WerFault.exe	oneetx.exe
624	3632	WerFault.exe	oneetx.exe
4752	3864	WerFault.exe	oneetx.exe
4280	3864	WerFault.exe	oneetx.exe
4384	3864	WerFault.exe	oneetx.exe
1768	3864	WerFault.exe	oneetx.exe
4588	3632	WerFault.exe	oneetx.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3288 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

it515536.exejr052907.exekp572630.exe

pid process

4248 it515536.exe
4248 it515536.exe
4360 jr052907.exe
4360 jr052907.exe
2868 kp572630.exe
2868 kp572630.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

it515536.exejr052907.exekp572630.exe

description pid process

Token: SeDebugPrivilege 4248 it515536.exe
Token: SeDebugPrivilege 4360 jr052907.exe
Token: SeDebugPrivilege 2868 kp572630.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

lr437774.exe

pid process

4072 lr437774.exe

pid	process
3288	schtasks.exe

pid	process
4248	it515536.exe
4248	it515536.exe
4360	jr052907.exe
4360	jr052907.exe
2868	kp572630.exe
2868	kp572630.exe

description	pid	process
Token: SeDebugPrivilege	4248	it515536.exe
Token: SeDebugPrivilege	4360	jr052907.exe
Token: SeDebugPrivilege	2868	kp572630.exe

pid	process
4072	lr437774.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exeziAy8989.exeziGC6039.exelr437774.exeoneetx.exe

description	pid	process	target process
PID 1444 wrote to memory of 1800	1444	0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exe	ziAy8989.exe
PID 1444 wrote to memory of 1800	1444	0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exe	ziAy8989.exe
PID 1444 wrote to memory of 1800	1444	0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exe	ziAy8989.exe
PID 1800 wrote to memory of 4424	1800	ziAy8989.exe	ziGC6039.exe
PID 1800 wrote to memory of 4424	1800	ziAy8989.exe	ziGC6039.exe
PID 1800 wrote to memory of 4424	1800	ziAy8989.exe	ziGC6039.exe
PID 4424 wrote to memory of 4248	4424	ziGC6039.exe	it515536.exe
PID 4424 wrote to memory of 4248	4424	ziGC6039.exe	it515536.exe
PID 4424 wrote to memory of 4360	4424	ziGC6039.exe	jr052907.exe
PID 4424 wrote to memory of 4360	4424	ziGC6039.exe	jr052907.exe
PID 4424 wrote to memory of 4360	4424	ziGC6039.exe	jr052907.exe
PID 1800 wrote to memory of 2868	1800	ziAy8989.exe	kp572630.exe
PID 1800 wrote to memory of 2868	1800	ziAy8989.exe	kp572630.exe
PID 1800 wrote to memory of 2868	1800	ziAy8989.exe	kp572630.exe
PID 1444 wrote to memory of 4072	1444	0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exe	lr437774.exe
PID 1444 wrote to memory of 4072	1444	0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exe	lr437774.exe
PID 1444 wrote to memory of 4072	1444	0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exe	lr437774.exe
PID 4072 wrote to memory of 3632	4072	lr437774.exe	oneetx.exe
PID 4072 wrote to memory of 3632	4072	lr437774.exe	oneetx.exe
PID 4072 wrote to memory of 3632	4072	lr437774.exe	oneetx.exe
PID 3632 wrote to memory of 3288	3632	oneetx.exe	schtasks.exe
PID 3632 wrote to memory of 3288	3632	oneetx.exe	schtasks.exe
PID 3632 wrote to memory of 3288	3632	oneetx.exe	schtasks.exe
PID 3632 wrote to memory of 2084	3632	oneetx.exe	rundll32.exe
PID 3632 wrote to memory of 2084	3632	oneetx.exe	rundll32.exe
PID 3632 wrote to memory of 2084	3632	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exe
"C:\Users\Admin\AppData\Local\Temp\0192d5686ed0511d3e8f9e933275b21eeb4e98d9cdf9dc4d7626399830fa6a94.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAy8989.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAy8989.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziGC6039.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziGC6039.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it515536.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it515536.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr052907.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr052907.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4360
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 1072
        5⤵
        Program crash
        
        PID:3048
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp572630.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp572630.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2868
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr437774.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr437774.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 696
    3⤵
    - Program crash
    PID:4952
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 780
    3⤵
    - Program crash
    PID:4412
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 856
    3⤵
    - Program crash
    PID:2880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 952
    3⤵
    - Program crash
    PID:1168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 956
    3⤵
    - Program crash
    PID:744
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 984
    3⤵
    - Program crash
    PID:1884
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1216
    3⤵
    - Program crash
    PID:2160
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1232
    3⤵
    - Program crash
    PID:3748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1316
    3⤵
    - Program crash
    PID:4804
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3632
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 692
      4⤵
      Program crash
      PID:1872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 836
      4⤵
      Program crash
      PID:708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 892
      4⤵
      Program crash
      PID:1328
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1052
      4⤵
      Program crash
      PID:4844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1072
      4⤵
      Program crash
      PID:2024
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1072
      4⤵
      Program crash
      PID:2464
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1092
      4⤵
      Program crash
      PID:448
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:3288
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 992
      4⤵
      Program crash
      PID:388
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1256
      4⤵
      Program crash
      PID:4736
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1276
      4⤵
      Program crash
      PID:5108
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 988
      4⤵
      Program crash
      PID:3640
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1528
      4⤵
      Program crash
      PID:5028
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1088
      4⤵
      Program crash
      PID:3548
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1572
      4⤵
      Program crash
      PID:3520
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:2084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1596
      4⤵
      Program crash
      PID:624
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 1580
      4⤵
      Program crash
      PID:4588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 1712
    3⤵
    - Program crash
    PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4360 -ip 4360
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4072 -ip 4072
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4072 -ip 4072
1⤵
PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4072 -ip 4072
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4072 -ip 4072
1⤵
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4072 -ip 4072
1⤵
PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4072 -ip 4072
1⤵
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4072 -ip 4072
1⤵
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4072 -ip 4072
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4072 -ip 4072
1⤵
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4072 -ip 4072
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3632 -ip 3632
1⤵
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3632 -ip 3632
1⤵
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3632 -ip 3632
1⤵
PID:1900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3632 -ip 3632
1⤵
PID:1252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3632 -ip 3632
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3632 -ip 3632
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3632 -ip 3632
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3632 -ip 3632
1⤵
PID:2500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3632 -ip 3632
1⤵
PID:4940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3632 -ip 3632
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3632 -ip 3632
1⤵
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3632 -ip 3632
1⤵
PID:1312

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:3320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 392
  2⤵
  - Program crash
  PID:1600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 504
  2⤵
  - Program crash
  PID:452
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 608
  2⤵
  - Program crash
  PID:4240
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 628
  2⤵
  - Program crash
  PID:2008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3320 -ip 3320
1⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3320 -ip 3320
1⤵
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3320 -ip 3320
1⤵
PID:3232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3320 -ip 3320
1⤵
PID:968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3632 -ip 3632
1⤵
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3632 -ip 3632
1⤵
PID:1592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3632 -ip 3632
1⤵
PID:376

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:3864
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 392
  2⤵
  - Program crash
  PID:4752
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 504
  2⤵
  - Program crash
  PID:4280
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 608
  2⤵
  - Program crash
  PID:4384
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 652
  2⤵
  - Program crash
  PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3864 -ip 3864
1⤵
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3864 -ip 3864
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3864 -ip 3864
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3864 -ip 3864
1⤵
PID:1228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3632 -ip 3632
1⤵
PID:2128

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr437774.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr437774.exe

Filesize
230KB

MD5
7d4cd4a44c1a62d13f282a450b4340aa

SHA1
02e032f246424d04d853fac9064b6958f94730f5

SHA256
96ef83cedeb8ba8eea7d700ac91410298f28cb3aa022a48d189f677981c59448

SHA512
f70e40e9a90912013f6ef36afe343c536d4918f718fa33decd12e03ed1abfcaf149c26b0b0b84964bd01939505ab1cb87d8121c340b2afd583a0d56855eba288

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAy8989.exe

Filesize
536KB

MD5
d879376190544a7c670a30b14ab30469

SHA1
1102f3b95b04577e78b696fb0d4db5fd8fedf9bc

SHA256
21e3f9d01188eb4001b4f0467f6e925123614df5607edc1a57bc2bde4dc8ab58

SHA512
7f989e5d2fecda14f9d0f9f7690f7f69b14b35a3fcd40f07cb8dc8f92e933c52a2c26115dc0b3d86df2b225be907f89ec4914811b0bdcd895e7945d6a3e75ae3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziAy8989.exe

Filesize
536KB

MD5
d879376190544a7c670a30b14ab30469

SHA1
1102f3b95b04577e78b696fb0d4db5fd8fedf9bc

SHA256
21e3f9d01188eb4001b4f0467f6e925123614df5607edc1a57bc2bde4dc8ab58

SHA512
7f989e5d2fecda14f9d0f9f7690f7f69b14b35a3fcd40f07cb8dc8f92e933c52a2c26115dc0b3d86df2b225be907f89ec4914811b0bdcd895e7945d6a3e75ae3

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp572630.exe

Filesize
168KB

MD5
5bf987dcff3c62ba608b35b3f5549d61

SHA1
1c610c61c9590bbbcb2c1c49e31432a8e088825f

SHA256
cc5dddcccaa0b1984bc99534158b8ea13682686c991b8bfd128fb478a9504916

SHA512
bc260fd7c1b488f934a8da73bd281a0a94793bd7a6d034d6ab384389d8013bbd30a22d4fc063bc60cf47fb412dcf68405ddc22f0725cf8b966639ca84247c009

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp572630.exe

Filesize
168KB

MD5
5bf987dcff3c62ba608b35b3f5549d61

SHA1
1c610c61c9590bbbcb2c1c49e31432a8e088825f

SHA256
cc5dddcccaa0b1984bc99534158b8ea13682686c991b8bfd128fb478a9504916

SHA512
bc260fd7c1b488f934a8da73bd281a0a94793bd7a6d034d6ab384389d8013bbd30a22d4fc063bc60cf47fb412dcf68405ddc22f0725cf8b966639ca84247c009

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziGC6039.exe

Filesize
382KB

MD5
2787484ce39b508027b342ba6f0807d3

SHA1
ce9a257bb8355ed2765824607f7e60cb2dec475b

SHA256
0192b5fa3e5bdb26d64440622881a295e7040e8a975352cee0d9405e48ea972d

SHA512
e4c7e185b976ad6f40a8f36c66b03f10a26b648ec864494183e1398c47b7ba1a762dd271e9190d9b2192869b4b45a216fd6b634455d14471408c152fb12bb1da

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziGC6039.exe

Filesize
382KB

MD5
2787484ce39b508027b342ba6f0807d3

SHA1
ce9a257bb8355ed2765824607f7e60cb2dec475b

SHA256
0192b5fa3e5bdb26d64440622881a295e7040e8a975352cee0d9405e48ea972d

SHA512
e4c7e185b976ad6f40a8f36c66b03f10a26b648ec864494183e1398c47b7ba1a762dd271e9190d9b2192869b4b45a216fd6b634455d14471408c152fb12bb1da

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it515536.exe

Filesize
11KB

MD5
5351d5b837b1c194f04c00cdd4af2e8d

SHA1
d82acdc0184300435e358c1733b01701f72fd732

SHA256
4de455193d3dbaf0b0262b2cd3d553da7cd1c314d27e8abb1619447d5cfd0301

SHA512
859b193f058d77f4922fcd8a539fb72146e70e48e0582ce927b5cac95dfd190236ffa92ea35db23bd35a3a6100308fb1a86963a906b420a4c8a303017a5caa3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it515536.exe

Filesize
11KB

MD5
5351d5b837b1c194f04c00cdd4af2e8d

SHA1
d82acdc0184300435e358c1733b01701f72fd732

SHA256
4de455193d3dbaf0b0262b2cd3d553da7cd1c314d27e8abb1619447d5cfd0301

SHA512
859b193f058d77f4922fcd8a539fb72146e70e48e0582ce927b5cac95dfd190236ffa92ea35db23bd35a3a6100308fb1a86963a906b420a4c8a303017a5caa3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr052907.exe

Filesize
298KB

MD5
2d4bde664c7848bc584c81a46e1a4c64

SHA1
0a843026092bf468ec922f45bb6d9095934c994b

SHA256
b53483569292021ba711748dd20e73849a64e037377aa9a7a3ca1d0e7886222d

SHA512
0072074ba7713be455eed7e922a55e7f1ad0bf5387039de96b2ffdfb307d6cc3bf8df10e1c2aec010f66c940b422379c348826ef6ba38ce5cb220f70d636d390

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr052907.exe

Filesize
298KB

MD5
2d4bde664c7848bc584c81a46e1a4c64

SHA1
0a843026092bf468ec922f45bb6d9095934c994b

SHA256
b53483569292021ba711748dd20e73849a64e037377aa9a7a3ca1d0e7886222d

SHA512
0072074ba7713be455eed7e922a55e7f1ad0bf5387039de96b2ffdfb307d6cc3bf8df10e1c2aec010f66c940b422379c348826ef6ba38ce5cb220f70d636d390

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/2868-1094-0x0000000005560000-0x0000000005570000-memory.dmp

Filesize
64KB

Download
memory/2868-1093-0x0000000000C90000-0x0000000000CC0000-memory.dmp

Filesize
192KB

Download
memory/4072-1100-0x00000000006A0000-0x00000000006DB000-memory.dmp

Filesize
236KB

Download
memory/4248-154-0x0000000000860000-0x000000000086A000-memory.dmp

Filesize
40KB

Download
memory/4360-204-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-1072-0x00000000058A0000-0x00000000059AA000-memory.dmp

Filesize
1.0MB

Download
memory/4360-182-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-184-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-186-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-188-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-190-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-192-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-194-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-196-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-198-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-200-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-202-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-177-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/4360-206-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-208-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-210-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-212-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-214-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-216-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-218-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-220-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-222-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-224-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-226-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-228-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-1071-0x0000000005200000-0x0000000005818000-memory.dmp

Filesize
6.1MB

Download
memory/4360-180-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-1073-0x00000000059E0000-0x00000000059F2000-memory.dmp

Filesize
72KB

Download
memory/4360-1074-0x0000000005B00000-0x0000000005B3C000-memory.dmp

Filesize
240KB

Download
memory/4360-1075-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/4360-1077-0x0000000000590000-0x00000000005DB000-memory.dmp

Filesize
300KB

Download
memory/4360-1078-0x0000000005CF0000-0x0000000005D82000-memory.dmp

Filesize
584KB

Download
memory/4360-1079-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/4360-1080-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/4360-1081-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/4360-1082-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/4360-1083-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/4360-178-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-176-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/4360-173-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download
memory/4360-174-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-171-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-169-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-167-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-165-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-163-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-162-0x0000000005160000-0x000000000519F000-memory.dmp

Filesize
252KB

Download
memory/4360-161-0x0000000004B90000-0x0000000005134000-memory.dmp

Filesize
5.6MB

Download
memory/4360-160-0x0000000000590000-0x00000000005DB000-memory.dmp

Filesize
300KB

Download
memory/4360-1084-0x00000000065B0000-0x0000000006626000-memory.dmp

Filesize
472KB

Download
memory/4360-1085-0x0000000006650000-0x00000000066A0000-memory.dmp

Filesize
320KB

Download
memory/4360-1086-0x0000000006810000-0x00000000069D2000-memory.dmp

Filesize
1.8MB

Download
memory/4360-1087-0x00000000069E0000-0x0000000006F0C000-memory.dmp

Filesize
5.2MB

Download