amadey | 14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc

Analysis

max time kernel
148s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2023 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exe
Size

939KB
MD5

1e32066034d56a4c00acde1f922148de
SHA1

b73d53882757d8663453fdc5b16a9890b99c84e1
SHA256

14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc
SHA512

9d3b23e4d84c63c8176b084d865ac690d405900ae82e653aebc8f3458c677dd7604239ddeaf98e5c0b2f2148ff6a1be7c4e238ccd45ed21d5d9d0e7f73261109
SSDEEP

24576:5y3FP3SO/yslmLb6YIfIDL3t9iKIxHTGsS1FVd:s3FPig/mLb6Va0ZTNS1F

Score

10^/10

amadey redline rosn zima discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

zima

176.113.115.145:4125

Attributes

auth_value
2ef701d510c0d27e8a8e3270281678b1

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

pr826616.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr826616.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr826616.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr826616.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr826616.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr826616.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr826616.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 19 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1092-199-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-198-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-201-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-203-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-205-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-207-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-209-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-211-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-213-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-215-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-217-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-219-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-221-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-223-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-225-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-227-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-229-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-231-0x0000000005070000-0x00000000050AF000-memory.dmp	family_redline
behavioral1/memory/1092-237-0x0000000004AB0000-0x0000000004AC0000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

oneetx.exesi669393.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	si669393.exe

Executes dropped EXE 9 IoCs

Processes:

un285895.exeun797788.exepr826616.exequ673454.exerk671780.exesi669393.exeoneetx.exeoneetx.exeoneetx.exe

pid process

3272 un285895.exe
3948 un797788.exe
5080 pr826616.exe
1092 qu673454.exe
1852 rk671780.exe
4668 si669393.exe
416 oneetx.exe
388 oneetx.exe
5040 oneetx.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2356 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3272	un285895.exe
3948	un797788.exe
5080	pr826616.exe
1092	qu673454.exe
1852	rk671780.exe
4668	si669393.exe
416	oneetx.exe
388	oneetx.exe
5040	oneetx.exe

pid	process
2356	rundll32.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

pr826616.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr826616.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr826616.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exeun285895.exeun797788.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un285895.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un285895.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un797788.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un797788.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 29 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2020	5080	WerFault.exe	pr826616.exe
4684	1092	WerFault.exe	qu673454.exe
1600	4668	WerFault.exe	si669393.exe
3304	4668	WerFault.exe	si669393.exe
2120	4668	WerFault.exe	si669393.exe
3424	4668	WerFault.exe	si669393.exe
1232	4668	WerFault.exe	si669393.exe
3548	4668	WerFault.exe	si669393.exe
5056	4668	WerFault.exe	si669393.exe
2916	4668	WerFault.exe	si669393.exe
4664	4668	WerFault.exe	si669393.exe
1888	4668	WerFault.exe	si669393.exe
3776	416	WerFault.exe	oneetx.exe
3344	416	WerFault.exe	oneetx.exe
4872	416	WerFault.exe	oneetx.exe
3828	416	WerFault.exe	oneetx.exe
2924	416	WerFault.exe	oneetx.exe
720	416	WerFault.exe	oneetx.exe
4544	416	WerFault.exe	oneetx.exe
664	416	WerFault.exe	oneetx.exe
4008	416	WerFault.exe	oneetx.exe
1780	416	WerFault.exe	oneetx.exe
2568	416	WerFault.exe	oneetx.exe
3704	388	WerFault.exe	oneetx.exe
1600	416	WerFault.exe	oneetx.exe
1456	416	WerFault.exe	oneetx.exe
844	416	WerFault.exe	oneetx.exe
3956	416	WerFault.exe	oneetx.exe
5052	5040	WerFault.exe	oneetx.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4796 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

pr826616.exequ673454.exerk671780.exe

pid process

5080 pr826616.exe
5080 pr826616.exe
1092 qu673454.exe
1092 qu673454.exe
1852 rk671780.exe
1852 rk671780.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

pr826616.exequ673454.exerk671780.exe

description pid process

Token: SeDebugPrivilege 5080 pr826616.exe
Token: SeDebugPrivilege 1092 qu673454.exe
Token: SeDebugPrivilege 1852 rk671780.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

si669393.exe

pid process

4668 si669393.exe

pid	process
4796	schtasks.exe

pid	process
5080	pr826616.exe
5080	pr826616.exe
1092	qu673454.exe
1092	qu673454.exe
1852	rk671780.exe
1852	rk671780.exe

description	pid	process
Token: SeDebugPrivilege	5080	pr826616.exe
Token: SeDebugPrivilege	1092	qu673454.exe
Token: SeDebugPrivilege	1852	rk671780.exe

pid	process
4668	si669393.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exeun285895.exeun797788.exesi669393.exeoneetx.exe

description	pid	process	target process
PID 2640 wrote to memory of 3272	2640	14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exe	un285895.exe
PID 2640 wrote to memory of 3272	2640	14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exe	un285895.exe
PID 2640 wrote to memory of 3272	2640	14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exe	un285895.exe
PID 3272 wrote to memory of 3948	3272	un285895.exe	un797788.exe
PID 3272 wrote to memory of 3948	3272	un285895.exe	un797788.exe
PID 3272 wrote to memory of 3948	3272	un285895.exe	un797788.exe
PID 3948 wrote to memory of 5080	3948	un797788.exe	pr826616.exe
PID 3948 wrote to memory of 5080	3948	un797788.exe	pr826616.exe
PID 3948 wrote to memory of 5080	3948	un797788.exe	pr826616.exe
PID 3948 wrote to memory of 1092	3948	un797788.exe	qu673454.exe
PID 3948 wrote to memory of 1092	3948	un797788.exe	qu673454.exe
PID 3948 wrote to memory of 1092	3948	un797788.exe	qu673454.exe
PID 3272 wrote to memory of 1852	3272	un285895.exe	rk671780.exe
PID 3272 wrote to memory of 1852	3272	un285895.exe	rk671780.exe
PID 3272 wrote to memory of 1852	3272	un285895.exe	rk671780.exe
PID 2640 wrote to memory of 4668	2640	14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exe	si669393.exe
PID 2640 wrote to memory of 4668	2640	14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exe	si669393.exe
PID 2640 wrote to memory of 4668	2640	14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exe	si669393.exe
PID 4668 wrote to memory of 416	4668	si669393.exe	oneetx.exe
PID 4668 wrote to memory of 416	4668	si669393.exe	oneetx.exe
PID 4668 wrote to memory of 416	4668	si669393.exe	oneetx.exe
PID 416 wrote to memory of 4796	416	oneetx.exe	schtasks.exe
PID 416 wrote to memory of 4796	416	oneetx.exe	schtasks.exe
PID 416 wrote to memory of 4796	416	oneetx.exe	schtasks.exe
PID 416 wrote to memory of 2356	416	oneetx.exe	rundll32.exe
PID 416 wrote to memory of 2356	416	oneetx.exe	rundll32.exe
PID 416 wrote to memory of 2356	416	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exe
"C:\Users\Admin\AppData\Local\Temp\14aa9d7478eda5688be3be05e92f307ef641d06f363e0374399c1b60725e72dc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un285895.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un285895.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un797788.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un797788.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr826616.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr826616.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5080
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5080 -s 1084
        5⤵
        Program crash
        
        PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu673454.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu673454.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1092
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 1808
        5⤵
        Program crash
        
        PID:4684
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk671780.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk671780.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1852
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si669393.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si669393.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 696
    3⤵
    - Program crash
    PID:1600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 772
    3⤵
    - Program crash
    PID:3304
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 796
    3⤵
    - Program crash
    PID:2120
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 804
    3⤵
    - Program crash
    PID:3424
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 976
    3⤵
    - Program crash
    PID:1232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 976
    3⤵
    - Program crash
    PID:3548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1216
    3⤵
    - Program crash
    PID:5056
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1232
    3⤵
    - Program crash
    PID:2916
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1316
    3⤵
    - Program crash
    PID:4664
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:416
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 692
      4⤵
      Program crash
      PID:3776
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 836
      4⤵
      Program crash
      PID:3344
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 888
      4⤵
      Program crash
      PID:4872
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1052
      4⤵
      Program crash
      PID:3828
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1096
      4⤵
      Program crash
      PID:2924
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1096
      4⤵
      Program crash
      PID:720
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1120
      4⤵
      Program crash
      PID:4544
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:4796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 848
      4⤵
      Program crash
      PID:664
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 776
      4⤵
      Program crash
      PID:4008
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 780
      4⤵
      Program crash
      PID:1780
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 772
      4⤵
      Program crash
      PID:2568
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1064
      4⤵
      Program crash
      PID:1600
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1648
      4⤵
      Program crash
      PID:1456
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:2356
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1088
      4⤵
      Program crash
      PID:844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 1656
      4⤵
      Program crash
      PID:3956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 1372
    3⤵
    - Program crash
    PID:1888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 5080 -ip 5080
1⤵
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1092 -ip 1092
1⤵
PID:1988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4668 -ip 4668
1⤵
PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4668 -ip 4668
1⤵
PID:4880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4668 -ip 4668
1⤵
PID:1796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4668 -ip 4668
1⤵
PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4668 -ip 4668
1⤵
PID:2604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4668 -ip 4668
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4668 -ip 4668
1⤵
PID:1040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4668 -ip 4668
1⤵
PID:1428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4668 -ip 4668
1⤵
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4668 -ip 4668
1⤵
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 416 -ip 416
1⤵
PID:3780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 416 -ip 416
1⤵
PID:2688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 416 -ip 416
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 416 -ip 416
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 416 -ip 416
1⤵
PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 416 -ip 416
1⤵
PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 416 -ip 416
1⤵
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 416 -ip 416
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 416 -ip 416
1⤵
PID:1396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 416 -ip 416
1⤵
PID:3872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 416 -ip 416
1⤵
PID:1200

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:388
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 388 -s 320
  2⤵
  - Program crash
  PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 388 -ip 388
1⤵
PID:3224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 416 -ip 416
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 416 -ip 416
1⤵
PID:3648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 416 -ip 416
1⤵
PID:4100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 416 -ip 416
1⤵
PID:3444

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:5040
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 320
  2⤵
  - Program crash
  PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5040 -ip 5040
1⤵
PID:1432

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si669393.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si669393.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un285895.exe

Filesize
674KB

MD5
fa5f76a0dcc697d9ba7613c5c4b57392

SHA1
542153cddb88f12953e3e0ebb7e27775682dae64

SHA256
17f604e99a6fca0ead0848489975f158e3c2198da4643f3ecc59fc630b929159

SHA512
4d5c17a6187b77a1df791d161fd9f57d9023d10e3748f1a8b1be1d76fc5a02e8e76a5ce2fc32f895a06a38a92213f199257620777371ec102bd71460b9862332

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un285895.exe

Filesize
674KB

MD5
fa5f76a0dcc697d9ba7613c5c4b57392

SHA1
542153cddb88f12953e3e0ebb7e27775682dae64

SHA256
17f604e99a6fca0ead0848489975f158e3c2198da4643f3ecc59fc630b929159

SHA512
4d5c17a6187b77a1df791d161fd9f57d9023d10e3748f1a8b1be1d76fc5a02e8e76a5ce2fc32f895a06a38a92213f199257620777371ec102bd71460b9862332

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk671780.exe

Filesize
169KB

MD5
1e55cb40c8e5189de4246a20dcc9aa19

SHA1
38944253e369788c822cf1b147ad8d241eda20ad

SHA256
eeceddf7ad45f1d6da22d1f1f4856f9cee82e4a52bf6eff8d60f8913f3b2d215

SHA512
85a7ccb707589e80a6c52a556a925128cf1f8811928406f0fe52356f92c64454b8e836075a53da70da220bb1783d93a196327a1d28c3fb4d07f3a4483f49f203

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk671780.exe

Filesize
169KB

MD5
1e55cb40c8e5189de4246a20dcc9aa19

SHA1
38944253e369788c822cf1b147ad8d241eda20ad

SHA256
eeceddf7ad45f1d6da22d1f1f4856f9cee82e4a52bf6eff8d60f8913f3b2d215

SHA512
85a7ccb707589e80a6c52a556a925128cf1f8811928406f0fe52356f92c64454b8e836075a53da70da220bb1783d93a196327a1d28c3fb4d07f3a4483f49f203

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un797788.exe

Filesize
520KB

MD5
cb3b6301facded7567eb6564a20f6d38

SHA1
7c8da4aad889f2f5e65cb57230198ecbeeca48ff

SHA256
d1199ac5e1f80a49bb3d98baf5bacf854496017d776ff8f2fed3d9818d808199

SHA512
aca0771b26b963e11b51c5fd1406eae172d9c033b45deadca4c634c95d402277a279288432ee7b624197cf85fbe7fa5df26470d54efad4d763fb8ae0e2cad022

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un797788.exe

Filesize
520KB

MD5
cb3b6301facded7567eb6564a20f6d38

SHA1
7c8da4aad889f2f5e65cb57230198ecbeeca48ff

SHA256
d1199ac5e1f80a49bb3d98baf5bacf854496017d776ff8f2fed3d9818d808199

SHA512
aca0771b26b963e11b51c5fd1406eae172d9c033b45deadca4c634c95d402277a279288432ee7b624197cf85fbe7fa5df26470d54efad4d763fb8ae0e2cad022

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr826616.exe

Filesize
239KB

MD5
b2bba4740ab274e0531f1560acd6d041

SHA1
70c6d232e3ccb8d25da415bcda72917463df460f

SHA256
84ac0b1e42b48bd9a9a6c9bddb257fd9b2f316512eaa8ef1a76d774c668766b8

SHA512
6f65e3422e352e04b2f4918781b2a731534e981412479c8ab753db5e401d9485b9901e25c1ab9d515c3fc6159a4a0d44c92e0e9261ac34dff53c1ac25ad20d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr826616.exe

Filesize
239KB

MD5
b2bba4740ab274e0531f1560acd6d041

SHA1
70c6d232e3ccb8d25da415bcda72917463df460f

SHA256
84ac0b1e42b48bd9a9a6c9bddb257fd9b2f316512eaa8ef1a76d774c668766b8

SHA512
6f65e3422e352e04b2f4918781b2a731534e981412479c8ab753db5e401d9485b9901e25c1ab9d515c3fc6159a4a0d44c92e0e9261ac34dff53c1ac25ad20d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu673454.exe

Filesize
297KB

MD5
7649b7e7867082a562775f4152210f57

SHA1
d044393047b60c1c593878112a525c7de78a9572

SHA256
4ffc7a637b897fa69b0e4cd976e3a1eb2f2c7a854fd5a2199ec97fb45594e290

SHA512
26e9bdb8b5549231e62bcabe240aed70050ff80a5c9f5fc5c57c7ec34efec1c6dd8ee14f47fbb8ba6050fe52c2549b0d46aa7b6614bf7b7463204d3ae1989eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu673454.exe

Filesize
297KB

MD5
7649b7e7867082a562775f4152210f57

SHA1
d044393047b60c1c593878112a525c7de78a9572

SHA256
4ffc7a637b897fa69b0e4cd976e3a1eb2f2c7a854fd5a2199ec97fb45594e290

SHA512
26e9bdb8b5549231e62bcabe240aed70050ff80a5c9f5fc5c57c7ec34efec1c6dd8ee14f47fbb8ba6050fe52c2549b0d46aa7b6614bf7b7463204d3ae1989eaa

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/1092-1117-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1092-234-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1092-1123-0x0000000007AB0000-0x0000000007FDC000-memory.dmp

Filesize
5.2MB

Download
memory/1092-1122-0x00000000078E0000-0x0000000007AA2000-memory.dmp

Filesize
1.8MB

Download
memory/1092-1121-0x0000000007760000-0x00000000077B0000-memory.dmp

Filesize
320KB

Download
memory/1092-1120-0x00000000021C0000-0x0000000002236000-memory.dmp

Filesize
472KB

Download
memory/1092-1119-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1092-1118-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1092-1116-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1092-1115-0x00000000063C0000-0x0000000006452000-memory.dmp

Filesize
584KB

Download
memory/1092-1114-0x0000000005CF0000-0x0000000005D56000-memory.dmp

Filesize
408KB

Download
memory/1092-1112-0x0000000005A00000-0x0000000005A3C000-memory.dmp

Filesize
240KB

Download
memory/1092-199-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-198-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-201-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-203-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-205-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-207-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-209-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-211-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-213-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-215-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-217-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-219-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-221-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-223-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-225-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-227-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-229-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-231-0x0000000005070000-0x00000000050AF000-memory.dmp

Filesize
252KB

Download
memory/1092-232-0x0000000000590000-0x00000000005DB000-memory.dmp

Filesize
300KB

Download
memory/1092-235-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1092-237-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1092-1111-0x0000000004AB0000-0x0000000004AC0000-memory.dmp

Filesize
64KB

Download
memory/1092-1108-0x0000000005200000-0x0000000005818000-memory.dmp

Filesize
6.1MB

Download
memory/1092-1109-0x00000000058A0000-0x00000000059AA000-memory.dmp

Filesize
1.0MB

Download
memory/1092-1110-0x00000000059E0000-0x00000000059F2000-memory.dmp

Filesize
72KB

Download
memory/1852-1129-0x0000000000170000-0x00000000001A0000-memory.dmp

Filesize
192KB

Download
memory/1852-1131-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/1852-1130-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/4668-1137-0x00000000004B0000-0x00000000004EB000-memory.dmp

Filesize
236KB

Download
memory/5080-189-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/5080-169-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-190-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/5080-181-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-188-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/5080-187-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-185-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-183-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-173-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-171-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-191-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/5080-193-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/5080-179-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-175-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-167-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-177-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-165-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-163-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-161-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-160-0x00000000025B0000-0x00000000025C2000-memory.dmp

Filesize
72KB

Download
memory/5080-159-0x0000000004B20000-0x00000000050C4000-memory.dmp

Filesize
5.6MB

Download
memory/5080-158-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/5080-157-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/5080-156-0x0000000004B10000-0x0000000004B20000-memory.dmp

Filesize
64KB

Download
memory/5080-155-0x00000000005A0000-0x00000000005CD000-memory.dmp

Filesize
180KB

Download