amadey | 75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249

Analysis

max time kernel
148s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2023 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exe
Size

936KB
MD5

7a8744ec39a11f0a2d1877e34dc5e415
SHA1

a58b0cd534f70d44ff3f4aad75a1c08d3eb1a604
SHA256

75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249
SHA512

708d42f9b052818d30b733907925e605252cb8f323c2486db3620fbecb266a9b27c601ee19fe76b4cadb4f2d35aabc9ddab32401241d0448e469b716d132a18a
SSDEEP

24576:4yj7uf1A/QicE98gv+c4VN1aeKif5dNqiBlg:/j7u7E98g2cQaeKif5GiT

Score

10^/10

amadey redline rosn zima discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

zima

176.113.115.145:4125

Attributes

auth_value
2ef701d510c0d27e8a8e3270281678b1

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

pr839185.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr839185.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr839185.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr839185.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr839185.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr839185.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr839185.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1324-197-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-198-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-200-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-202-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-204-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-206-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-208-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-210-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-212-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-215-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-219-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-222-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-224-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-226-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-230-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-228-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-232-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline
behavioral1/memory/1324-234-0x0000000005060000-0x000000000509F000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

si633717.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	si633717.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

Processes:

un580162.exeun102672.exepr839185.exequ086113.exerk229261.exesi633717.exeoneetx.exeoneetx.exeoneetx.exe

pid process

2364 un580162.exe
4652 un102672.exe
3820 pr839185.exe
1324 qu086113.exe
2156 rk229261.exe
2688 si633717.exe
4452 oneetx.exe
2088 oneetx.exe
1512 oneetx.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

180 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
2364	un580162.exe
4652	un102672.exe
3820	pr839185.exe
1324	qu086113.exe
2156	rk229261.exe
2688	si633717.exe
4452	oneetx.exe
2088	oneetx.exe
1512	oneetx.exe

pid	process
180	rundll32.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

pr839185.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr839185.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr839185.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exeun580162.exeun102672.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un580162.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un580162.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un102672.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un102672.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 36 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3408	3820	WerFault.exe	pr839185.exe
4424	1324	WerFault.exe	qu086113.exe
2460	2688	WerFault.exe	si633717.exe
1428	2688	WerFault.exe	si633717.exe
1792	2688	WerFault.exe	si633717.exe
1664	2688	WerFault.exe	si633717.exe
1728	2688	WerFault.exe	si633717.exe
3372	2688	WerFault.exe	si633717.exe
3332	2688	WerFault.exe	si633717.exe
1512	2688	WerFault.exe	si633717.exe
4724	2688	WerFault.exe	si633717.exe
1920	2688	WerFault.exe	si633717.exe
2404	4452	WerFault.exe	oneetx.exe
3212	4452	WerFault.exe	oneetx.exe
4064	4452	WerFault.exe	oneetx.exe
752	4452	WerFault.exe	oneetx.exe
4940	4452	WerFault.exe	oneetx.exe
4396	4452	WerFault.exe	oneetx.exe
4704	4452	WerFault.exe	oneetx.exe
4804	4452	WerFault.exe	oneetx.exe
2044	4452	WerFault.exe	oneetx.exe
3312	4452	WerFault.exe	oneetx.exe
1504	4452	WerFault.exe	oneetx.exe
4304	4452	WerFault.exe	oneetx.exe
1316	4452	WerFault.exe	oneetx.exe
4172	2088	WerFault.exe	oneetx.exe
2500	2088	WerFault.exe	oneetx.exe
3056	2088	WerFault.exe	oneetx.exe
3360	2088	WerFault.exe	oneetx.exe
312	4452	WerFault.exe	oneetx.exe
3872	4452	WerFault.exe	oneetx.exe
3332	4452	WerFault.exe	oneetx.exe
4440	1512	WerFault.exe	oneetx.exe
4376	1512	WerFault.exe	oneetx.exe
5084	1512	WerFault.exe	oneetx.exe
1628	1512	WerFault.exe	oneetx.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1064 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

pr839185.exequ086113.exerk229261.exe

pid process

3820 pr839185.exe
3820 pr839185.exe
1324 qu086113.exe
1324 qu086113.exe
2156 rk229261.exe
2156 rk229261.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

pr839185.exequ086113.exerk229261.exe

description pid process

Token: SeDebugPrivilege 3820 pr839185.exe
Token: SeDebugPrivilege 1324 qu086113.exe
Token: SeDebugPrivilege 2156 rk229261.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

si633717.exe

pid process

2688 si633717.exe

pid	process
1064	schtasks.exe

pid	process
3820	pr839185.exe
3820	pr839185.exe
1324	qu086113.exe
1324	qu086113.exe
2156	rk229261.exe
2156	rk229261.exe

description	pid	process
Token: SeDebugPrivilege	3820	pr839185.exe
Token: SeDebugPrivilege	1324	qu086113.exe
Token: SeDebugPrivilege	2156	rk229261.exe

pid	process
2688	si633717.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exeun580162.exeun102672.exesi633717.exeoneetx.exe

description	pid	process	target process
PID 4516 wrote to memory of 2364	4516	75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exe	un580162.exe
PID 4516 wrote to memory of 2364	4516	75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exe	un580162.exe
PID 4516 wrote to memory of 2364	4516	75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exe	un580162.exe
PID 2364 wrote to memory of 4652	2364	un580162.exe	un102672.exe
PID 2364 wrote to memory of 4652	2364	un580162.exe	un102672.exe
PID 2364 wrote to memory of 4652	2364	un580162.exe	un102672.exe
PID 4652 wrote to memory of 3820	4652	un102672.exe	pr839185.exe
PID 4652 wrote to memory of 3820	4652	un102672.exe	pr839185.exe
PID 4652 wrote to memory of 3820	4652	un102672.exe	pr839185.exe
PID 4652 wrote to memory of 1324	4652	un102672.exe	qu086113.exe
PID 4652 wrote to memory of 1324	4652	un102672.exe	qu086113.exe
PID 4652 wrote to memory of 1324	4652	un102672.exe	qu086113.exe
PID 2364 wrote to memory of 2156	2364	un580162.exe	rk229261.exe
PID 2364 wrote to memory of 2156	2364	un580162.exe	rk229261.exe
PID 2364 wrote to memory of 2156	2364	un580162.exe	rk229261.exe
PID 4516 wrote to memory of 2688	4516	75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exe	si633717.exe
PID 4516 wrote to memory of 2688	4516	75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exe	si633717.exe
PID 4516 wrote to memory of 2688	4516	75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exe	si633717.exe
PID 2688 wrote to memory of 4452	2688	si633717.exe	oneetx.exe
PID 2688 wrote to memory of 4452	2688	si633717.exe	oneetx.exe
PID 2688 wrote to memory of 4452	2688	si633717.exe	oneetx.exe
PID 4452 wrote to memory of 1064	4452	oneetx.exe	schtasks.exe
PID 4452 wrote to memory of 1064	4452	oneetx.exe	schtasks.exe
PID 4452 wrote to memory of 1064	4452	oneetx.exe	schtasks.exe
PID 4452 wrote to memory of 180	4452	oneetx.exe	rundll32.exe
PID 4452 wrote to memory of 180	4452	oneetx.exe	rundll32.exe
PID 4452 wrote to memory of 180	4452	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exe
"C:\Users\Admin\AppData\Local\Temp\75bee23579beb7a4289f21e263df61153536789f477718fac3d7c5481798f249.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un580162.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un580162.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un102672.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un102672.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr839185.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr839185.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3820
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3820 -s 1080
        5⤵
        Program crash
        
        PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu086113.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu086113.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1324
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1324 -s 1468
        5⤵
        Program crash
        
        PID:4424
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk229261.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk229261.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2156
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si633717.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si633717.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 696
    3⤵
    - Program crash
    PID:2460
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 772
    3⤵
    - Program crash
    PID:1428
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 812
    3⤵
    - Program crash
    PID:1792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 952
    3⤵
    - Program crash
    PID:1664
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 968
    3⤵
    - Program crash
    PID:1728
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 984
    3⤵
    - Program crash
    PID:3372
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1220
    3⤵
    - Program crash
    PID:3332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1232
    3⤵
    - Program crash
    PID:1512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1316
    3⤵
    - Program crash
    PID:4724
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 692
      4⤵
      Program crash
      PID:2404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 876
      4⤵
      Program crash
      PID:3212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 932
      4⤵
      Program crash
      PID:4064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1052
      4⤵
      Program crash
      PID:752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1060
      4⤵
      Program crash
      PID:4940
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1060
      4⤵
      Program crash
      PID:4396
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1096
      4⤵
      Program crash
      PID:4704
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 936
      4⤵
      Program crash
      PID:4804
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 676
      4⤵
      Program crash
      PID:2044
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 780
      4⤵
      Program crash
      PID:3312
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1248
      4⤵
      Program crash
      PID:1504
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1492
      4⤵
      Program crash
      PID:4304
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1136
      4⤵
      Program crash
      PID:1316
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1644
      4⤵
      Program crash
      PID:312
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:180
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1496
      4⤵
      Program crash
      PID:3872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4452 -s 1652
      4⤵
      Program crash
      PID:3332
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 1392
    3⤵
    - Program crash
    PID:1920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3820 -ip 3820
1⤵
PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1324 -ip 1324
1⤵
PID:3312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2688 -ip 2688
1⤵
PID:2264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2688 -ip 2688
1⤵
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2688 -ip 2688
1⤵
PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2688 -ip 2688
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2688 -ip 2688
1⤵
PID:180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2688 -ip 2688
1⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2688 -ip 2688
1⤵
PID:3504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2688 -ip 2688
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2688 -ip 2688
1⤵
PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2688 -ip 2688
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4452 -ip 4452
1⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4452 -ip 4452
1⤵
PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4452 -ip 4452
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4452 -ip 4452
1⤵
PID:4488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4452 -ip 4452
1⤵
PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4452 -ip 4452
1⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4452 -ip 4452
1⤵
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4452 -ip 4452
1⤵
PID:1176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4452 -ip 4452
1⤵
PID:3616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4452 -ip 4452
1⤵
PID:2808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 4452 -ip 4452
1⤵
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4452 -ip 4452
1⤵
PID:2296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4452 -ip 4452
1⤵
PID:4060

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:2088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 392
  2⤵
  - Program crash
  PID:4172
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 504
  2⤵
  - Program crash
  PID:2500
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 608
  2⤵
  - Program crash
  PID:3056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2088 -s 628
  2⤵
  - Program crash
  PID:3360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 2088 -ip 2088
1⤵
PID:4872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2088 -ip 2088
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2088 -ip 2088
1⤵
PID:4568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2088 -ip 2088
1⤵
PID:3608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4452 -ip 4452
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 640 -p 4452 -ip 4452
1⤵
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4452 -ip 4452
1⤵
PID:3700

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:1512
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 400
  2⤵
  - Program crash
  PID:4440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 504
  2⤵
  - Program crash
  PID:4376
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 608
  2⤵
  - Program crash
  PID:5084
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1512 -s 652
  2⤵
  - Program crash
  PID:1628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 1512 -ip 1512
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1512 -ip 1512
1⤵
PID:3044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 1512 -ip 1512
1⤵
PID:116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1512 -ip 1512
1⤵
PID:1920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
af7fca55ea436503f0fb684c1c158383

SHA1
c6e2a00e5a4854b2c103748d47ae18356e7efa0d

SHA256
cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60

SHA512
f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
af7fca55ea436503f0fb684c1c158383

SHA1
c6e2a00e5a4854b2c103748d47ae18356e7efa0d

SHA256
cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60

SHA512
f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
af7fca55ea436503f0fb684c1c158383

SHA1
c6e2a00e5a4854b2c103748d47ae18356e7efa0d

SHA256
cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60

SHA512
f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
af7fca55ea436503f0fb684c1c158383

SHA1
c6e2a00e5a4854b2c103748d47ae18356e7efa0d

SHA256
cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60

SHA512
f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
af7fca55ea436503f0fb684c1c158383

SHA1
c6e2a00e5a4854b2c103748d47ae18356e7efa0d

SHA256
cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60

SHA512
f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si633717.exe

Filesize
231KB

MD5
af7fca55ea436503f0fb684c1c158383

SHA1
c6e2a00e5a4854b2c103748d47ae18356e7efa0d

SHA256
cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60

SHA512
f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si633717.exe

Filesize
231KB

MD5
af7fca55ea436503f0fb684c1c158383

SHA1
c6e2a00e5a4854b2c103748d47ae18356e7efa0d

SHA256
cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60

SHA512
f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un580162.exe

Filesize
671KB

MD5
9c471536021229b8da007d7919c70b78

SHA1
c480da662f1f53ad02a8112712da638aba3d3f97

SHA256
56056a4241a04be3cca8d33cdbd11b287800081fb5149c9da97a12306dc53316

SHA512
8c8911d89ebf3d8c2b56604cbb13d7e7fa09d5cdd913548d8354bef619048da9e0ee39e2525c4163e76a4af67429fc0e15dab5e74ad9b6a9633eac75a069774f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un580162.exe

Filesize
671KB

MD5
9c471536021229b8da007d7919c70b78

SHA1
c480da662f1f53ad02a8112712da638aba3d3f97

SHA256
56056a4241a04be3cca8d33cdbd11b287800081fb5149c9da97a12306dc53316

SHA512
8c8911d89ebf3d8c2b56604cbb13d7e7fa09d5cdd913548d8354bef619048da9e0ee39e2525c4163e76a4af67429fc0e15dab5e74ad9b6a9633eac75a069774f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk229261.exe

Filesize
168KB

MD5
ac69201228a20dd09d857228a1dfde81

SHA1
255412a68e295e3113f8fbda6c145997b96c7e55

SHA256
0d1cd62628806c35a2e76b01d0f6a62ccf5673b0c5dafaf33d24029b72dde676

SHA512
521045ae1d41fcfad45af8882d3c91a0effa349668346b4f9624a8e293c2266edc96ffe2832eb7f30c0c5ad984d7b17d8287cd11dd272c3e348f339bb70155c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk229261.exe

Filesize
168KB

MD5
ac69201228a20dd09d857228a1dfde81

SHA1
255412a68e295e3113f8fbda6c145997b96c7e55

SHA256
0d1cd62628806c35a2e76b01d0f6a62ccf5673b0c5dafaf33d24029b72dde676

SHA512
521045ae1d41fcfad45af8882d3c91a0effa349668346b4f9624a8e293c2266edc96ffe2832eb7f30c0c5ad984d7b17d8287cd11dd272c3e348f339bb70155c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un102672.exe

Filesize
518KB

MD5
af21c3254bbb166d88e69c16da8ef1b6

SHA1
aa64c491dbf14473fe729b398d62923a975f9b7c

SHA256
8e1e700c12d9700157cfd4943e414b9b68ee0f1dcacbfcb96cda5b345540f1a1

SHA512
a501621ee1c09dc1bf518fd499bcef3fc39202b677106eff2cf6b095f50954c14341ef0a464b6f953a226fcb6357ad2bf234816bb7d932e228b7a73ab1d5756c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un102672.exe

Filesize
518KB

MD5
af21c3254bbb166d88e69c16da8ef1b6

SHA1
aa64c491dbf14473fe729b398d62923a975f9b7c

SHA256
8e1e700c12d9700157cfd4943e414b9b68ee0f1dcacbfcb96cda5b345540f1a1

SHA512
a501621ee1c09dc1bf518fd499bcef3fc39202b677106eff2cf6b095f50954c14341ef0a464b6f953a226fcb6357ad2bf234816bb7d932e228b7a73ab1d5756c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr839185.exe

Filesize
239KB

MD5
9d86048b189be31564743719b3dcc85d

SHA1
fd9649aa284b6e4840a927ba89c9daa718c98d8a

SHA256
3d1924b07707fc015dd156017e1894cfb831a169cad47fd9aa3a482c8cf369c6

SHA512
a67b272590432c9dcee78ff9a127beea1358e1f7c7c644c6bfbbe18f8ed33e1062f3667879ee5033e5566724f7e3d72b428db5102298875adc3d9bede2b7b477

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr839185.exe

Filesize
239KB

MD5
9d86048b189be31564743719b3dcc85d

SHA1
fd9649aa284b6e4840a927ba89c9daa718c98d8a

SHA256
3d1924b07707fc015dd156017e1894cfb831a169cad47fd9aa3a482c8cf369c6

SHA512
a67b272590432c9dcee78ff9a127beea1358e1f7c7c644c6bfbbe18f8ed33e1062f3667879ee5033e5566724f7e3d72b428db5102298875adc3d9bede2b7b477

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu086113.exe

Filesize
297KB

MD5
58e8d1e52f0ce1073cfa8932ac07513f

SHA1
10baabb127a0634c85d0727b91ed1a47d150ba29

SHA256
5db0803ed3c62b444e135101874b54f8cd92df00b03a1f8d1acf002f79e695e3

SHA512
93783b37fa17fbdc62c88df01fe409abb07c9bfb05301859be0e30fe9732ccc979474d3a2a241ac7f4e03d8c2c4e513274546f78ed3d30b1f28db16ffc2f1fba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu086113.exe

Filesize
297KB

MD5
58e8d1e52f0ce1073cfa8932ac07513f

SHA1
10baabb127a0634c85d0727b91ed1a47d150ba29

SHA256
5db0803ed3c62b444e135101874b54f8cd92df00b03a1f8d1acf002f79e695e3

SHA512
93783b37fa17fbdc62c88df01fe409abb07c9bfb05301859be0e30fe9732ccc979474d3a2a241ac7f4e03d8c2c4e513274546f78ed3d30b1f28db16ffc2f1fba

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1324-1117-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/1324-232-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-1122-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/1324-1121-0x00000000069D0000-0x0000000006EFC000-memory.dmp

Filesize
5.2MB

Download
memory/1324-1120-0x0000000006800000-0x00000000069C2000-memory.dmp

Filesize
1.8MB

Download
memory/1324-1119-0x0000000006780000-0x00000000067D0000-memory.dmp

Filesize
320KB

Download
memory/1324-1118-0x0000000006700000-0x0000000006776000-memory.dmp

Filesize
472KB

Download
memory/1324-1116-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/1324-1115-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/1324-1113-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/1324-1112-0x0000000005CF0000-0x0000000005D82000-memory.dmp

Filesize
584KB

Download
memory/1324-197-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-198-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-200-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-202-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-204-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-206-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-208-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-210-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-212-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-216-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/1324-215-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-214-0x00000000004C0000-0x000000000050B000-memory.dmp

Filesize
300KB

Download
memory/1324-219-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-218-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/1324-222-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-224-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-226-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-220-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/1324-230-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-228-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-1111-0x0000000004AA0000-0x0000000004AB0000-memory.dmp

Filesize
64KB

Download
memory/1324-234-0x0000000005060000-0x000000000509F000-memory.dmp

Filesize
252KB

Download
memory/1324-1107-0x0000000005200000-0x0000000005818000-memory.dmp

Filesize
6.1MB

Download
memory/1324-1108-0x00000000058A0000-0x00000000059AA000-memory.dmp

Filesize
1.0MB

Download
memory/1324-1109-0x00000000059E0000-0x00000000059F2000-memory.dmp

Filesize
72KB

Download
memory/1324-1110-0x0000000005A00000-0x0000000005A3C000-memory.dmp

Filesize
240KB

Download
memory/2156-1128-0x0000000000360000-0x0000000000390000-memory.dmp

Filesize
192KB

Download
memory/2156-1129-0x0000000004D80000-0x0000000004D90000-memory.dmp

Filesize
64KB

Download
memory/2688-1135-0x0000000000580000-0x00000000005BB000-memory.dmp

Filesize
236KB

Download
memory/3820-177-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/3820-178-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-173-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-190-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/3820-188-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3820-187-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-185-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-183-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-175-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/3820-181-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-192-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3820-191-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/3820-174-0x0000000000580000-0x00000000005AD000-memory.dmp

Filesize
180KB

Download
memory/3820-171-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-179-0x0000000004C00000-0x0000000004C10000-memory.dmp

Filesize
64KB

Download
memory/3820-169-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-167-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-165-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-163-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-161-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-156-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-159-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-157-0x0000000004A20000-0x0000000004A32000-memory.dmp

Filesize
72KB

Download
memory/3820-155-0x0000000004C10000-0x00000000051B4000-memory.dmp

Filesize
5.6MB

Download