amadey | 89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2023 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exe
Size

939KB
MD5

bbc37c9b5bfbc69ac32d5399682e4152
SHA1

b17bf01afd5ac566d75f3b481cd8a2457549cf78
SHA256

89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980
SHA512

769a4685a6fe043e84bf7edcc119ec3fece802e8c8f86571000c7f6ad0369650c72ebbd3c38de137d394658b74bf14cd57c06e87d0a42a3c48b8b2d6dfa73ea0
SSDEEP

24576:VyUSa8P7aNPX3s3DapD7IWlRF6OsZFOC616ad:wUSaiwPX83DaNhtCla

Score

10^/10

amadey redline rosn zima discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

zima

176.113.115.145:4125

Attributes

auth_value
2ef701d510c0d27e8a8e3270281678b1

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

pr921137.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr921137.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr921137.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr921137.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr921137.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr921137.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr921137.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4752-202-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-203-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-205-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-207-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-209-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-211-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-213-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-215-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-217-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-219-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-221-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-223-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-225-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-227-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-229-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-231-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-233-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline
behavioral1/memory/4752-235-0x00000000050B0000-0x00000000050EF000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

si459952.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	si459952.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

Processes:

un978349.exeun213117.exepr921137.exequ339162.exerk669189.exesi459952.exeoneetx.exeoneetx.exeoneetx.exe

pid process

4440 un978349.exe
4700 un213117.exe
4312 pr921137.exe
4752 qu339162.exe
2248 rk669189.exe
3292 si459952.exe
3868 oneetx.exe
2980 oneetx.exe
3088 oneetx.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4924 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4440	un978349.exe
4700	un213117.exe
4312	pr921137.exe
4752	qu339162.exe
2248	rk669189.exe
3292	si459952.exe
3868	oneetx.exe
2980	oneetx.exe
3088	oneetx.exe

pid	process
4924	rundll32.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

pr921137.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr921137.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr921137.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

un978349.exeun213117.exe89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un978349.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un978349.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un213117.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un213117.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 30 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3088	4312	WerFault.exe	pr921137.exe
1096	4752	WerFault.exe	qu339162.exe
4912	3292	WerFault.exe	si459952.exe
980	3292	WerFault.exe	si459952.exe
4080	3292	WerFault.exe	si459952.exe
3088	3292	WerFault.exe	si459952.exe
856	3292	WerFault.exe	si459952.exe
3020	3292	WerFault.exe	si459952.exe
3432	3292	WerFault.exe	si459952.exe
4880	3292	WerFault.exe	si459952.exe
2664	3292	WerFault.exe	si459952.exe
3516	3292	WerFault.exe	si459952.exe
2580	3868	WerFault.exe	oneetx.exe
904	3868	WerFault.exe	oneetx.exe
748	3868	WerFault.exe	oneetx.exe
4768	3868	WerFault.exe	oneetx.exe
3708	3868	WerFault.exe	oneetx.exe
1636	3868	WerFault.exe	oneetx.exe
1432	3868	WerFault.exe	oneetx.exe
688	3868	WerFault.exe	oneetx.exe
2864	3868	WerFault.exe	oneetx.exe
4308	3868	WerFault.exe	oneetx.exe
3192	3868	WerFault.exe	oneetx.exe
1236	3868	WerFault.exe	oneetx.exe
1556	2980	WerFault.exe	oneetx.exe
4724	3868	WerFault.exe	oneetx.exe
1824	3868	WerFault.exe	oneetx.exe
4708	3868	WerFault.exe	oneetx.exe
856	3088	WerFault.exe	oneetx.exe
4012	3868	WerFault.exe	oneetx.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4704 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

pr921137.exequ339162.exerk669189.exe

pid process

4312 pr921137.exe
4312 pr921137.exe
4752 qu339162.exe
4752 qu339162.exe
2248 rk669189.exe
2248 rk669189.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

pr921137.exequ339162.exerk669189.exe

description pid process

Token: SeDebugPrivilege 4312 pr921137.exe
Token: SeDebugPrivilege 4752 qu339162.exe
Token: SeDebugPrivilege 2248 rk669189.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

si459952.exe

pid process

3292 si459952.exe

pid	process
4704	schtasks.exe

pid	process
4312	pr921137.exe
4312	pr921137.exe
4752	qu339162.exe
4752	qu339162.exe
2248	rk669189.exe
2248	rk669189.exe

description	pid	process
Token: SeDebugPrivilege	4312	pr921137.exe
Token: SeDebugPrivilege	4752	qu339162.exe
Token: SeDebugPrivilege	2248	rk669189.exe

pid	process
3292	si459952.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exeun978349.exeun213117.exesi459952.exeoneetx.exe

description	pid	process	target process
PID 4604 wrote to memory of 4440	4604	89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exe	un978349.exe
PID 4604 wrote to memory of 4440	4604	89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exe	un978349.exe
PID 4604 wrote to memory of 4440	4604	89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exe	un978349.exe
PID 4440 wrote to memory of 4700	4440	un978349.exe	un213117.exe
PID 4440 wrote to memory of 4700	4440	un978349.exe	un213117.exe
PID 4440 wrote to memory of 4700	4440	un978349.exe	un213117.exe
PID 4700 wrote to memory of 4312	4700	un213117.exe	pr921137.exe
PID 4700 wrote to memory of 4312	4700	un213117.exe	pr921137.exe
PID 4700 wrote to memory of 4312	4700	un213117.exe	pr921137.exe
PID 4700 wrote to memory of 4752	4700	un213117.exe	qu339162.exe
PID 4700 wrote to memory of 4752	4700	un213117.exe	qu339162.exe
PID 4700 wrote to memory of 4752	4700	un213117.exe	qu339162.exe
PID 4440 wrote to memory of 2248	4440	un978349.exe	rk669189.exe
PID 4440 wrote to memory of 2248	4440	un978349.exe	rk669189.exe
PID 4440 wrote to memory of 2248	4440	un978349.exe	rk669189.exe
PID 4604 wrote to memory of 3292	4604	89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exe	si459952.exe
PID 4604 wrote to memory of 3292	4604	89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exe	si459952.exe
PID 4604 wrote to memory of 3292	4604	89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exe	si459952.exe
PID 3292 wrote to memory of 3868	3292	si459952.exe	oneetx.exe
PID 3292 wrote to memory of 3868	3292	si459952.exe	oneetx.exe
PID 3292 wrote to memory of 3868	3292	si459952.exe	oneetx.exe
PID 3868 wrote to memory of 4704	3868	oneetx.exe	schtasks.exe
PID 3868 wrote to memory of 4704	3868	oneetx.exe	schtasks.exe
PID 3868 wrote to memory of 4704	3868	oneetx.exe	schtasks.exe
PID 3868 wrote to memory of 4924	3868	oneetx.exe	rundll32.exe
PID 3868 wrote to memory of 4924	3868	oneetx.exe	rundll32.exe
PID 3868 wrote to memory of 4924	3868	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exe
"C:\Users\Admin\AppData\Local\Temp\89e07d51e7d84fcd2290c40eb19aa64f7ab2f74623bfee3e2f5de4550357a980.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un978349.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un978349.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un213117.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un213117.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr921137.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr921137.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4312
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 1080
        5⤵
        Program crash
        
        PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu339162.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu339162.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4752
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4752 -s 1160
        5⤵
        Program crash
        
        PID:1096
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk669189.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk669189.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2248
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si459952.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si459952.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 696
    3⤵
    - Program crash
    PID:4912
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 776
    3⤵
    - Program crash
    PID:980
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 860
    3⤵
    - Program crash
    PID:4080
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 972
    3⤵
    - Program crash
    PID:3088
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 968
    3⤵
    - Program crash
    PID:856
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 956
    3⤵
    - Program crash
    PID:3020
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 1220
    3⤵
    - Program crash
    PID:3432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 1244
    3⤵
    - Program crash
    PID:4880
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 1320
    3⤵
    - Program crash
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 692
      4⤵
      Program crash
      PID:2580
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 844
      4⤵
      Program crash
      PID:904
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 908
      4⤵
      Program crash
      PID:748
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 856
      4⤵
      Program crash
      PID:4768
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1052
      4⤵
      Program crash
      PID:3708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1072
      4⤵
      Program crash
      PID:1636
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1072
      4⤵
      Program crash
      PID:1432
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1108
      4⤵
      Program crash
      PID:688
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4704
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 992
      4⤵
      Program crash
      PID:2864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1268
      4⤵
      Program crash
      PID:4308
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 700
      4⤵
      Program crash
      PID:3192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 988
      4⤵
      Program crash
      PID:1236
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1140
      4⤵
      Program crash
      PID:4724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1616
      4⤵
      Program crash
      PID:1824
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:4924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1576
      4⤵
      Program crash
      PID:4708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 1632
      4⤵
      Program crash
      PID:4012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 1360
    3⤵
    - Program crash
    PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4312 -ip 4312
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4752 -ip 4752
1⤵
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3292 -ip 3292
1⤵
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3292 -ip 3292
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3292 -ip 3292
1⤵
PID:4924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3292 -ip 3292
1⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3292 -ip 3292
1⤵
PID:1256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3292 -ip 3292
1⤵
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3292 -ip 3292
1⤵
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3292 -ip 3292
1⤵
PID:3540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3292 -ip 3292
1⤵
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3292 -ip 3292
1⤵
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3868 -ip 3868
1⤵
PID:4484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3868 -ip 3868
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3868 -ip 3868
1⤵
PID:4168

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3868 -ip 3868
1⤵
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3868 -ip 3868
1⤵
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3868 -ip 3868
1⤵
PID:3416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3868 -ip 3868
1⤵
PID:3808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 3868 -ip 3868
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3868 -ip 3868
1⤵
PID:260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 3868 -ip 3868
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3868 -ip 3868
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3868 -ip 3868
1⤵
PID:2084

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:2980
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 320
  2⤵
  - Program crash
  PID:1556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2980 -ip 2980
1⤵
PID:2088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 3868 -ip 3868
1⤵
PID:4364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3868 -ip 3868
1⤵
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3868 -ip 3868
1⤵
PID:2764

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:3088
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3088 -s 316
  2⤵
  - Program crash
  PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3088 -ip 3088
1⤵
PID:3280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3868 -ip 3868
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si459952.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si459952.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un978349.exe

Filesize
674KB

MD5
cc086e4edf7bb501b73602796a957c50

SHA1
8d6de1f406e295faad4bdab60723d78c58670efc

SHA256
a5a03345b43b564fcbbb7936e5ba7206e737659209bf428b748843144c31715d

SHA512
1d7166c9d13edadb3a11978a26acb67573b03e32f401095e36e54e98e3fb28c670ecab92a4a0955f9aa50b42c16b95e2aaa9a7a523d51c9c63334a18afb1a959

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un978349.exe

Filesize
674KB

MD5
cc086e4edf7bb501b73602796a957c50

SHA1
8d6de1f406e295faad4bdab60723d78c58670efc

SHA256
a5a03345b43b564fcbbb7936e5ba7206e737659209bf428b748843144c31715d

SHA512
1d7166c9d13edadb3a11978a26acb67573b03e32f401095e36e54e98e3fb28c670ecab92a4a0955f9aa50b42c16b95e2aaa9a7a523d51c9c63334a18afb1a959

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk669189.exe

Filesize
169KB

MD5
4b0247a427c86fbe2cf944fc742206b0

SHA1
ed1e99d2507747fdba662f315ab43f24818b1f1e

SHA256
0318a21edcb03b1e26d916867203ee1900a831772c6afcec4f01df9346c9a4c3

SHA512
682e3701af05ba2d7585d984fe031e9d5f7b8b40157c5d53da8ba1ddd170ec2d10c7845d847ce7aec7c03802b841e4525846c1c54a9b413b65b9b65ed9864d44

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk669189.exe

Filesize
169KB

MD5
4b0247a427c86fbe2cf944fc742206b0

SHA1
ed1e99d2507747fdba662f315ab43f24818b1f1e

SHA256
0318a21edcb03b1e26d916867203ee1900a831772c6afcec4f01df9346c9a4c3

SHA512
682e3701af05ba2d7585d984fe031e9d5f7b8b40157c5d53da8ba1ddd170ec2d10c7845d847ce7aec7c03802b841e4525846c1c54a9b413b65b9b65ed9864d44

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un213117.exe

Filesize
521KB

MD5
cf95ea8c478a3708cb4c7a6f3b693a5a

SHA1
8f7d6bfecc3e90b3b9ad6ec0a84dda092d9d363e

SHA256
623febafa0bfd133c5430dae2b5ac8c13d6268a165981b72b549024e2eeb30bf

SHA512
441809e292953844d226cd80e3a46d20d1783b63d7b752f69e22b20c36f29b384fd36c8fb60afbae5d28942c1a3ffa34180c81d2b3e56ba7f0c82713ad8f903b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un213117.exe

Filesize
521KB

MD5
cf95ea8c478a3708cb4c7a6f3b693a5a

SHA1
8f7d6bfecc3e90b3b9ad6ec0a84dda092d9d363e

SHA256
623febafa0bfd133c5430dae2b5ac8c13d6268a165981b72b549024e2eeb30bf

SHA512
441809e292953844d226cd80e3a46d20d1783b63d7b752f69e22b20c36f29b384fd36c8fb60afbae5d28942c1a3ffa34180c81d2b3e56ba7f0c82713ad8f903b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr921137.exe

Filesize
239KB

MD5
c5c2f56d2e78426c2270f338b3d97d48

SHA1
3d5e44c6e7c9b5544ac62fe1f0e4cb3de4f9db6e

SHA256
b45a750c962c948b0fbe26986ba73fdf9f029b032c2e2bb779788a8dec48a432

SHA512
4e11740cc854d909c7169ae5c9ed8a0898a8b831133c570a3f1ec86f374be28326b3658ad6e317502d4309fa181f8a45f0dd7e258091672c74c49e167f4edb86

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr921137.exe

Filesize
239KB

MD5
c5c2f56d2e78426c2270f338b3d97d48

SHA1
3d5e44c6e7c9b5544ac62fe1f0e4cb3de4f9db6e

SHA256
b45a750c962c948b0fbe26986ba73fdf9f029b032c2e2bb779788a8dec48a432

SHA512
4e11740cc854d909c7169ae5c9ed8a0898a8b831133c570a3f1ec86f374be28326b3658ad6e317502d4309fa181f8a45f0dd7e258091672c74c49e167f4edb86

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu339162.exe

Filesize
297KB

MD5
2a8ea551429d98ab1e24a15571fd8be8

SHA1
b988adb266a9c489d1c14e92e9094946650e2afc

SHA256
2af1228c2b825bfbb340cc0b9fc96f28923550f930dd2e702c1e5f708e4d5ff2

SHA512
ac51832bcc17656b3487456d23a882e12028f21f01c2c4a1dd54763ff2bfd399c0f97646b10afd86626c939f2cf947db7c18e381117b4afc86ef15d1ebf98772

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu339162.exe

Filesize
297KB

MD5
2a8ea551429d98ab1e24a15571fd8be8

SHA1
b988adb266a9c489d1c14e92e9094946650e2afc

SHA256
2af1228c2b825bfbb340cc0b9fc96f28923550f930dd2e702c1e5f708e4d5ff2

SHA512
ac51832bcc17656b3487456d23a882e12028f21f01c2c4a1dd54763ff2bfd399c0f97646b10afd86626c939f2cf947db7c18e381117b4afc86ef15d1ebf98772

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/2248-1130-0x0000000005230000-0x0000000005240000-memory.dmp

Filesize
64KB

Download
memory/2248-1129-0x00000000008C0000-0x00000000008F0000-memory.dmp

Filesize
192KB

Download
memory/3292-1136-0x00000000006C0000-0x00000000006FB000-memory.dmp

Filesize
236KB

Download
memory/4312-156-0x0000000004CF0000-0x0000000005294000-memory.dmp

Filesize
5.6MB

Download
memory/4312-176-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-182-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-184-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-185-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/4312-186-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/4312-187-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/4312-188-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4312-189-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/4312-190-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/4312-191-0x0000000004CE0000-0x0000000004CF0000-memory.dmp

Filesize
64KB

Download
memory/4312-193-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/4312-178-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-180-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-174-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-172-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-170-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-168-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-166-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-162-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-164-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-160-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-158-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-157-0x0000000002100000-0x0000000002112000-memory.dmp

Filesize
72KB

Download
memory/4312-155-0x00000000004B0000-0x00000000004DD000-memory.dmp

Filesize
180KB

Download
memory/4752-205-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-221-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-223-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-225-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-227-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-229-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-231-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-233-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-235-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-1108-0x00000000050F0000-0x0000000005708000-memory.dmp

Filesize
6.1MB

Download
memory/4752-1109-0x0000000005760000-0x000000000586A000-memory.dmp

Filesize
1.0MB

Download
memory/4752-1110-0x00000000058A0000-0x00000000058B2000-memory.dmp

Filesize
72KB

Download
memory/4752-1111-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/4752-1112-0x00000000058C0000-0x00000000058FC000-memory.dmp

Filesize
240KB

Download
memory/4752-1113-0x0000000005BB0000-0x0000000005C42000-memory.dmp

Filesize
584KB

Download
memory/4752-1114-0x0000000005C50000-0x0000000005CB6000-memory.dmp

Filesize
408KB

Download
memory/4752-1115-0x0000000006470000-0x0000000006632000-memory.dmp

Filesize
1.8MB

Download
memory/4752-1116-0x0000000006650000-0x0000000006B7C000-memory.dmp

Filesize
5.2MB

Download
memory/4752-1119-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/4752-1118-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/4752-1120-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/4752-219-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-217-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-215-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-213-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-211-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-209-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-207-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-203-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-202-0x00000000050B0000-0x00000000050EF000-memory.dmp

Filesize
252KB

Download
memory/4752-201-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/4752-199-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/4752-200-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download
memory/4752-198-0x0000000000590000-0x00000000005DB000-memory.dmp

Filesize
300KB

Download
memory/4752-1121-0x0000000006E10000-0x0000000006E86000-memory.dmp

Filesize
472KB

Download
memory/4752-1122-0x0000000006E90000-0x0000000006EE0000-memory.dmp

Filesize
320KB

Download
memory/4752-1123-0x0000000002400000-0x0000000002410000-memory.dmp

Filesize
64KB

Download