amadey | 80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794

Analysis

max time kernel
148s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2023 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exe
Size

800KB
MD5

c1cd46f9af0a04d390e4df3981eb80f5
SHA1

2478e651908a021f1fa257677703a5af798cb88e
SHA256

80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794
SHA512

96b314c2ec4ab9db48c703c249815013aca6984485a86c90bf32ab03da80318b77af07a76f08421cc0cd9a62771831d78ae5502ed952e117d9ea727c3eac963b
SSDEEP

12288:kMrEy90iNLrldxm3ur1AAfvhQB1DGxNU7EpJxK7CDgH2Ex1QF+4Wj29vdeDS:gy5w3OrGBFGxaYvxfEHL1IujQVe2

Score

10^/10

amadey redline rosn zima discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

zima

176.113.115.145:4125

Attributes

auth_value
2ef701d510c0d27e8a8e3270281678b1

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

it662045.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	it662045.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	it662045.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	it662045.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	it662045.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	it662045.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	it662045.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 33 IoCs

Processes:

resource	yara_rule
behavioral1/memory/348-163-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-164-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-166-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-168-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-170-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-172-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-174-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-176-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-178-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-180-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-182-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-184-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-186-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-188-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-190-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-192-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-194-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-196-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-200-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-198-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-202-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-204-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-208-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-210-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-212-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-214-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-216-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-218-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-220-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-222-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-224-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-226-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline
behavioral1/memory/348-228-0x0000000004AB0000-0x0000000004AEF000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

oneetx.exelr566816.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	oneetx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	lr566816.exe

Executes dropped EXE 9 IoCs

Processes:

ziDb2870.exeziKA2337.exeit662045.exejr800080.exekp403184.exelr566816.exeoneetx.exeoneetx.exeoneetx.exe

pid process

772 ziDb2870.exe
2156 ziKA2337.exe
2384 it662045.exe
348 jr800080.exe
4532 kp403184.exe
4168 lr566816.exe
5060 oneetx.exe
4800 oneetx.exe
1928 oneetx.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4084 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Windows security modification 2 TTPs 1 IoCs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

it662045.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" it662045.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
772	ziDb2870.exe
2156	ziKA2337.exe
2384	it662045.exe
348	jr800080.exe
4532	kp403184.exe
4168	lr566816.exe
5060	oneetx.exe
4800	oneetx.exe
1928	oneetx.exe

pid	process
4084	rundll32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	it662045.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

ziDb2870.exeziKA2337.exe80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	ziDb2870.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziKA2337.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	ziKA2337.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ziDb2870.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

400 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
400	sc.exe

Program crash 29 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3652	348	WerFault.exe	jr800080.exe
4236	4168	WerFault.exe	lr566816.exe
1680	4168	WerFault.exe	lr566816.exe
1708	4168	WerFault.exe	lr566816.exe
3592	4168	WerFault.exe	lr566816.exe
4128	4168	WerFault.exe	lr566816.exe
2892	4168	WerFault.exe	lr566816.exe
908	4168	WerFault.exe	lr566816.exe
3808	4168	WerFault.exe	lr566816.exe
4156	4168	WerFault.exe	lr566816.exe
2148	4168	WerFault.exe	lr566816.exe
4860	5060	WerFault.exe	oneetx.exe
1124	5060	WerFault.exe	oneetx.exe
4656	5060	WerFault.exe	oneetx.exe
5068	5060	WerFault.exe	oneetx.exe
5012	5060	WerFault.exe	oneetx.exe
1280	5060	WerFault.exe	oneetx.exe
4312	5060	WerFault.exe	oneetx.exe
4460	5060	WerFault.exe	oneetx.exe
2072	5060	WerFault.exe	oneetx.exe
4948	5060	WerFault.exe	oneetx.exe
3212	5060	WerFault.exe	oneetx.exe
3864	5060	WerFault.exe	oneetx.exe
4548	4800	WerFault.exe	oneetx.exe
3052	5060	WerFault.exe	oneetx.exe
4720	5060	WerFault.exe	oneetx.exe
3384	5060	WerFault.exe	oneetx.exe
4824	5060	WerFault.exe	oneetx.exe
1972	1928	WerFault.exe	oneetx.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1224 schtasks.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

it662045.exejr800080.exekp403184.exe

pid process

2384 it662045.exe
2384 it662045.exe
348 jr800080.exe
348 jr800080.exe
4532 kp403184.exe
4532 kp403184.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

it662045.exejr800080.exekp403184.exe

description pid process

Token: SeDebugPrivilege 2384 it662045.exe
Token: SeDebugPrivilege 348 jr800080.exe
Token: SeDebugPrivilege 4532 kp403184.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

lr566816.exe

pid process

4168 lr566816.exe

pid	process
1224	schtasks.exe

pid	process
2384	it662045.exe
2384	it662045.exe
348	jr800080.exe
348	jr800080.exe
4532	kp403184.exe
4532	kp403184.exe

description	pid	process
Token: SeDebugPrivilege	2384	it662045.exe
Token: SeDebugPrivilege	348	jr800080.exe
Token: SeDebugPrivilege	4532	kp403184.exe

pid	process
4168	lr566816.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exeziDb2870.exeziKA2337.exelr566816.exeoneetx.exe

description	pid	process	target process
PID 2100 wrote to memory of 772	2100	80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exe	ziDb2870.exe
PID 2100 wrote to memory of 772	2100	80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exe	ziDb2870.exe
PID 2100 wrote to memory of 772	2100	80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exe	ziDb2870.exe
PID 772 wrote to memory of 2156	772	ziDb2870.exe	ziKA2337.exe
PID 772 wrote to memory of 2156	772	ziDb2870.exe	ziKA2337.exe
PID 772 wrote to memory of 2156	772	ziDb2870.exe	ziKA2337.exe
PID 2156 wrote to memory of 2384	2156	ziKA2337.exe	it662045.exe
PID 2156 wrote to memory of 2384	2156	ziKA2337.exe	it662045.exe
PID 2156 wrote to memory of 348	2156	ziKA2337.exe	jr800080.exe
PID 2156 wrote to memory of 348	2156	ziKA2337.exe	jr800080.exe
PID 2156 wrote to memory of 348	2156	ziKA2337.exe	jr800080.exe
PID 772 wrote to memory of 4532	772	ziDb2870.exe	kp403184.exe
PID 772 wrote to memory of 4532	772	ziDb2870.exe	kp403184.exe
PID 772 wrote to memory of 4532	772	ziDb2870.exe	kp403184.exe
PID 2100 wrote to memory of 4168	2100	80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exe	lr566816.exe
PID 2100 wrote to memory of 4168	2100	80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exe	lr566816.exe
PID 2100 wrote to memory of 4168	2100	80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exe	lr566816.exe
PID 4168 wrote to memory of 5060	4168	lr566816.exe	oneetx.exe
PID 4168 wrote to memory of 5060	4168	lr566816.exe	oneetx.exe
PID 4168 wrote to memory of 5060	4168	lr566816.exe	oneetx.exe
PID 5060 wrote to memory of 1224	5060	oneetx.exe	schtasks.exe
PID 5060 wrote to memory of 1224	5060	oneetx.exe	schtasks.exe
PID 5060 wrote to memory of 1224	5060	oneetx.exe	schtasks.exe
PID 5060 wrote to memory of 4084	5060	oneetx.exe	rundll32.exe
PID 5060 wrote to memory of 4084	5060	oneetx.exe	rundll32.exe
PID 5060 wrote to memory of 4084	5060	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exe
"C:\Users\Admin\AppData\Local\Temp\80f9b96f8e31ded47c0da929c8afe76a7e651d811a87b4ff036033b66d1ed794.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDb2870.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDb2870.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziKA2337.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziKA2337.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it662045.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it662045.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr800080.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr800080.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:348
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 348 -s 1336
        5⤵
        Program crash
        
        PID:3652
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp403184.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp403184.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4532
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr566816.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr566816.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 696
    3⤵
    - Program crash
    PID:4236
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 748
    3⤵
    - Program crash
    PID:1680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 856
    3⤵
    - Program crash
    PID:1708
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 972
    3⤵
    - Program crash
    PID:3592
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 1000
    3⤵
    - Program crash
    PID:4128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 968
    3⤵
    - Program crash
    PID:2892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 1220
    3⤵
    - Program crash
    PID:908
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 1172
    3⤵
    - Program crash
    PID:3808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 1320
    3⤵
    - Program crash
    PID:4156
- - C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 692
      4⤵
      Program crash
      PID:4860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 836
      4⤵
      Program crash
      PID:1124
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 892
      4⤵
      Program crash
      PID:4656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1060
      4⤵
      Program crash
      PID:5068
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1072
      4⤵
      Program crash
      PID:5012
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1072
      4⤵
      Program crash
      PID:1280
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1136
      4⤵
      Program crash
      PID:4312
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:1224
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 992
      4⤵
      Program crash
      PID:4460
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 744
      4⤵
      Program crash
      PID:2072
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 992
      4⤵
      Program crash
      PID:4948
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 868
      4⤵
      Program crash
      PID:3212
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1528
      4⤵
      Program crash
      PID:3864
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1180
      4⤵
      Program crash
      PID:3052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1628
      4⤵
      Program crash
      PID:4720
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:4084
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1148
      4⤵
      Program crash
      PID:3384
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 1644
      4⤵
      Program crash
      PID:4824
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4168 -s 1756
    3⤵
    - Program crash
    PID:2148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 348 -ip 348
1⤵
PID:2184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4168 -ip 4168
1⤵
PID:2544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4168 -ip 4168
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4168 -ip 4168
1⤵
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4168 -ip 4168
1⤵
PID:4852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4168 -ip 4168
1⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4168 -ip 4168
1⤵
PID:5028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 4168 -ip 4168
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4168 -ip 4168
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4168 -ip 4168
1⤵
PID:2916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4168 -ip 4168
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 5060 -ip 5060
1⤵
PID:3580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5060 -ip 5060
1⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5060 -ip 5060
1⤵
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5060 -ip 5060
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5060 -ip 5060
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5060 -ip 5060
1⤵
PID:3852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5060 -ip 5060
1⤵
PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5060 -ip 5060
1⤵
PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5060 -ip 5060
1⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5060 -ip 5060
1⤵
PID:1304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5060 -ip 5060
1⤵
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5060 -ip 5060
1⤵
PID:4188

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:4800
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 320
  2⤵
  - Program crash
  PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4800 -ip 4800
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5060 -ip 5060
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 5060 -ip 5060
1⤵
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5060 -ip 5060
1⤵
PID:3416

C:\Windows\system32\sc.exe
C:\Windows\system32\sc.exe start wuauserv
1⤵
- Launches sc.exe
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5060 -ip 5060
1⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1928 -s 316
  2⤵
  - Program crash
  PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1928 -ip 1928
1⤵
PID:4184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr566816.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\lr566816.exe

Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDb2870.exe

Filesize
536KB

MD5
d82f6a631f39c464644f3cf698761e27

SHA1
8971c3f90fad1aa3f31a1d0aa4b8fd8ae6db6aeb

SHA256
09411c425e63523679bfad298a4815705bceca462658803c4da29d49f17bb6ca

SHA512
de64d9564387174e5b0ebb0f86544522e8713eb9aebccd4e9084d8e6b9318f91332f2c58466677ebf4ba04faf9f8438ea5d50477fcc4623088b20d62a7de33ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\ziDb2870.exe

Filesize
536KB

MD5
d82f6a631f39c464644f3cf698761e27

SHA1
8971c3f90fad1aa3f31a1d0aa4b8fd8ae6db6aeb

SHA256
09411c425e63523679bfad298a4815705bceca462658803c4da29d49f17bb6ca

SHA512
de64d9564387174e5b0ebb0f86544522e8713eb9aebccd4e9084d8e6b9318f91332f2c58466677ebf4ba04faf9f8438ea5d50477fcc4623088b20d62a7de33ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp403184.exe

Filesize
169KB

MD5
c9f134e26ec5615ae796b3acc769f269

SHA1
e2caaf612f1f2c0cc419692487e8b5776e4ee7ce

SHA256
952f8e6141a8b141a9f8bd478a3ee32c1160dc4137432cc517daba0d18226dcd

SHA512
9ad236b2d5c1c757aa584e78bf2291926e580946d90d3ef92dddb8a01ec40a09ee79e18d028ac48a2cedfb0727d65daf47250f625f98ec73a325563cf56f1c02

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kp403184.exe

Filesize
169KB

MD5
c9f134e26ec5615ae796b3acc769f269

SHA1
e2caaf612f1f2c0cc419692487e8b5776e4ee7ce

SHA256
952f8e6141a8b141a9f8bd478a3ee32c1160dc4137432cc517daba0d18226dcd

SHA512
9ad236b2d5c1c757aa584e78bf2291926e580946d90d3ef92dddb8a01ec40a09ee79e18d028ac48a2cedfb0727d65daf47250f625f98ec73a325563cf56f1c02

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziKA2337.exe

Filesize
382KB

MD5
a000a3aeac0c63846298ad81bb49fa8a

SHA1
3d9e907fe4d2e2fe9aa1000f48552dc4f347f657

SHA256
628bc7b7ee433466b5fb7b9d8da58edc1ccc352b965c9ddeed15f11f315a9600

SHA512
df0ebfd2c2293a96f681890efde02939324e4e8eaa1fdab30744301a54d7e7799d1faa9f099c414d83b7fc9fe56df60ec4ceddcbbd380b494ff63b5af36e8a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\ziKA2337.exe

Filesize
382KB

MD5
a000a3aeac0c63846298ad81bb49fa8a

SHA1
3d9e907fe4d2e2fe9aa1000f48552dc4f347f657

SHA256
628bc7b7ee433466b5fb7b9d8da58edc1ccc352b965c9ddeed15f11f315a9600

SHA512
df0ebfd2c2293a96f681890efde02939324e4e8eaa1fdab30744301a54d7e7799d1faa9f099c414d83b7fc9fe56df60ec4ceddcbbd380b494ff63b5af36e8a3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it662045.exe

Filesize
11KB

MD5
8b59b609a0bd8a2cfb13198649775d15

SHA1
7871b03695b68c7aad01f980fcef9cec56d0be7a

SHA256
9b26204b4ac04b30a3a8f74b62e7d1a7315a2fad93b7a8a8dbff063e02d73bd6

SHA512
d79201c7c4b2ac6400f9c32652eafd28f1ca863b5edf7e5b7b2d3bb0c6f690464c7076357b7a67bb800e500e7e1d2a6eba651a1f39356ebaffcb5b5fcdd53649

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\it662045.exe

Filesize
11KB

MD5
8b59b609a0bd8a2cfb13198649775d15

SHA1
7871b03695b68c7aad01f980fcef9cec56d0be7a

SHA256
9b26204b4ac04b30a3a8f74b62e7d1a7315a2fad93b7a8a8dbff063e02d73bd6

SHA512
d79201c7c4b2ac6400f9c32652eafd28f1ca863b5edf7e5b7b2d3bb0c6f690464c7076357b7a67bb800e500e7e1d2a6eba651a1f39356ebaffcb5b5fcdd53649

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr800080.exe

Filesize
297KB

MD5
881a0d62903feb2780f10752c7e3161f

SHA1
a6344c2decd515c79f4f9463fdf4e758fdcc978d

SHA256
76bbba91f64061570364803ba815254d46500dccb9bfccf60bb9032934153740

SHA512
8840bd915d047af0e05cd67dcd51c06cf3b655b9108e24cb8ce8adfe481c32bb963a08ba91f76e958d3ab213a5865e5fe3f1d7ee2a971ba83c188d47c00b39bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\jr800080.exe

Filesize
297KB

MD5
881a0d62903feb2780f10752c7e3161f

SHA1
a6344c2decd515c79f4f9463fdf4e758fdcc978d

SHA256
76bbba91f64061570364803ba815254d46500dccb9bfccf60bb9032934153740

SHA512
8840bd915d047af0e05cd67dcd51c06cf3b655b9108e24cb8ce8adfe481c32bb963a08ba91f76e958d3ab213a5865e5fe3f1d7ee2a971ba83c188d47c00b39bb

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/348-207-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/348-1072-0x00000000058A0000-0x00000000059AA000-memory.dmp

Filesize
1.0MB

Download
memory/348-180-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-182-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-184-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-186-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-188-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-190-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-192-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-194-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-196-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-200-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-198-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-202-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-205-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/348-204-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-208-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-176-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-210-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-212-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-214-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-216-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-218-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-220-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-222-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-224-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-226-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-228-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-1071-0x0000000005250000-0x0000000005868000-memory.dmp

Filesize
6.1MB

Download
memory/348-178-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-1073-0x00000000059E0000-0x00000000059F2000-memory.dmp

Filesize
72KB

Download
memory/348-1074-0x0000000005A00000-0x0000000005A3C000-memory.dmp

Filesize
240KB

Download
memory/348-1075-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/348-1077-0x0000000005CF0000-0x0000000005D82000-memory.dmp

Filesize
584KB

Download
memory/348-1078-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Filesize
408KB

Download
memory/348-1079-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/348-1080-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/348-1081-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/348-1082-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/348-1083-0x00000000066F0000-0x0000000006766000-memory.dmp

Filesize
472KB

Download
memory/348-1084-0x0000000006780000-0x00000000067D0000-memory.dmp

Filesize
320KB

Download
memory/348-1085-0x00000000067E0000-0x00000000069A2000-memory.dmp

Filesize
1.8MB

Download
memory/348-1086-0x00000000069C0000-0x0000000006EEC000-memory.dmp

Filesize
5.2MB

Download
memory/348-160-0x0000000000690000-0x00000000006DB000-memory.dmp

Filesize
300KB

Download
memory/348-161-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/348-174-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-162-0x0000000004CA0000-0x0000000005244000-memory.dmp

Filesize
5.6MB

Download
memory/348-172-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-170-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-168-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-166-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-164-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/348-163-0x0000000004AB0000-0x0000000004AEF000-memory.dmp

Filesize
252KB

Download
memory/2384-154-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/4168-1099-0x00000000004B0000-0x00000000004EB000-memory.dmp

Filesize
236KB

Download
memory/4532-1092-0x0000000000330000-0x0000000000360000-memory.dmp

Filesize
192KB

Download
memory/4532-1093-0x0000000004CB0000-0x0000000004CC0000-memory.dmp

Filesize
64KB

Download