amadey | 704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf

Analysis

max time kernel
140s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2023 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exe
Size

1.0MB
MD5

46329b965e004e4f75d3be4192ec42f9
SHA1

f62ed4f1ca1e341c845bda9f1921ec89c10e7cef
SHA256

704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf
SHA512

850698aa0d78093f82bff270932c80679ea2a2374cbbb8052b62f2944c3bf11b0782c3fa8f3701ad0fb2a243126b55b57b464217fb53c447203371f1ba457b4a
SSDEEP

24576:LyTDW0A80uTojqrAthiz4uAHSo86GRnNxf8YxV:+TDWf8OIMs4u8y1JNxEY

Score

10^/10

amadey redline brat rosn discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

3.70

77.91.124.207/plays/chapter/index.php

Extracted

Family

redline

Botnet

rosn

176.113.115.145:4125

Attributes

auth_value
050a19e1db4d0024b0f23b37dcf961f4

Extracted

Family

redline

Botnet

brat

176.113.115.145:4125

Attributes

auth_value
1f9c658aed2f70f42f99a57a005561cf

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

az619917.execor7612.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	az619917.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	az619917.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	az619917.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	az619917.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	cor7612.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	az619917.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	az619917.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	cor7612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	cor7612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	cor7612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	cor7612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	cor7612.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 17 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3708-234-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-235-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-237-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-239-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-241-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-243-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-245-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-247-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-249-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-251-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-253-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-255-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-257-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-259-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-261-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-263-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline
behavioral1/memory/3708-265-0x0000000004A70000-0x0000000004AAF000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

bu335790.exeoneetx.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	bu335790.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 11 IoCs

Processes:

kina6358.exekina8158.exekina7527.exeaz619917.exebu335790.exeoneetx.execor7612.exediP23s87.exeen619154.exeoneetx.exeoneetx.exe

pid	process
1524	kina6358.exe
2836	kina8158.exe
2340	kina7527.exe
1744	az619917.exe
3940	bu335790.exe
3740	oneetx.exe
3020	cor7612.exe
3708	diP23s87.exe
548	en619154.exe
1948	oneetx.exe
1120	oneetx.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1240 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1240	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

az619917.execor7612.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	az619917.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	cor7612.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	cor7612.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

kina7527.exe704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exekina6358.exekina8158.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina7527.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	kina7527.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina6358.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	kina6358.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kina8158.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	kina8158.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 30 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4284	3940	WerFault.exe	bu335790.exe
840	3940	WerFault.exe	bu335790.exe
2948	3940	WerFault.exe	bu335790.exe
5016	3940	WerFault.exe	bu335790.exe
4372	3940	WerFault.exe	bu335790.exe
1956	3940	WerFault.exe	bu335790.exe
816	3940	WerFault.exe	bu335790.exe
3584	3940	WerFault.exe	bu335790.exe
2988	3940	WerFault.exe	bu335790.exe
404	3940	WerFault.exe	bu335790.exe
1268	3740	WerFault.exe	oneetx.exe
880	3740	WerFault.exe	oneetx.exe
3372	3740	WerFault.exe	oneetx.exe
4180	3740	WerFault.exe	oneetx.exe
3260	3740	WerFault.exe	oneetx.exe
3212	3740	WerFault.exe	oneetx.exe
372	3740	WerFault.exe	oneetx.exe
4844	3740	WerFault.exe	oneetx.exe
2608	3740	WerFault.exe	oneetx.exe
4148	3740	WerFault.exe	oneetx.exe
4780	3740	WerFault.exe	oneetx.exe
1952	3740	WerFault.exe	oneetx.exe
4344	3020	WerFault.exe	cor7612.exe
452	3708	WerFault.exe	diP23s87.exe
3904	3740	WerFault.exe	oneetx.exe
4760	1948	WerFault.exe	oneetx.exe
1676	3740	WerFault.exe	oneetx.exe
3180	3740	WerFault.exe	oneetx.exe
3020	3740	WerFault.exe	oneetx.exe
2120	1120	WerFault.exe	oneetx.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2236 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

az619917.execor7612.exediP23s87.exeen619154.exe

pid process

1744 az619917.exe
1744 az619917.exe
3020 cor7612.exe
3020 cor7612.exe
3708 diP23s87.exe
3708 diP23s87.exe
548 en619154.exe
548 en619154.exe

pid	process
2236	schtasks.exe

pid	process
1744	az619917.exe
1744	az619917.exe
3020	cor7612.exe
3020	cor7612.exe
3708	diP23s87.exe
3708	diP23s87.exe
548	en619154.exe
548	en619154.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

az619917.execor7612.exediP23s87.exeen619154.exe

description	pid	process
Token: SeDebugPrivilege	1744	az619917.exe
Token: SeDebugPrivilege	3020	cor7612.exe
Token: SeDebugPrivilege	3708	diP23s87.exe
Token: SeDebugPrivilege	548	en619154.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

bu335790.exe

pid process

3940 bu335790.exe

pid	process
3940	bu335790.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exekina6358.exekina8158.exekina7527.exebu335790.exeoneetx.exe

description	pid	process	target process
PID 4924 wrote to memory of 1524	4924	704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exe	kina6358.exe
PID 4924 wrote to memory of 1524	4924	704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exe	kina6358.exe
PID 4924 wrote to memory of 1524	4924	704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exe	kina6358.exe
PID 1524 wrote to memory of 2836	1524	kina6358.exe	kina8158.exe
PID 1524 wrote to memory of 2836	1524	kina6358.exe	kina8158.exe
PID 1524 wrote to memory of 2836	1524	kina6358.exe	kina8158.exe
PID 2836 wrote to memory of 2340	2836	kina8158.exe	kina7527.exe
PID 2836 wrote to memory of 2340	2836	kina8158.exe	kina7527.exe
PID 2836 wrote to memory of 2340	2836	kina8158.exe	kina7527.exe
PID 2340 wrote to memory of 1744	2340	kina7527.exe	az619917.exe
PID 2340 wrote to memory of 1744	2340	kina7527.exe	az619917.exe
PID 2340 wrote to memory of 3940	2340	kina7527.exe	bu335790.exe
PID 2340 wrote to memory of 3940	2340	kina7527.exe	bu335790.exe
PID 2340 wrote to memory of 3940	2340	kina7527.exe	bu335790.exe
PID 3940 wrote to memory of 3740	3940	bu335790.exe	oneetx.exe
PID 3940 wrote to memory of 3740	3940	bu335790.exe	oneetx.exe
PID 3940 wrote to memory of 3740	3940	bu335790.exe	oneetx.exe
PID 2836 wrote to memory of 3020	2836	kina8158.exe	cor7612.exe
PID 2836 wrote to memory of 3020	2836	kina8158.exe	cor7612.exe
PID 2836 wrote to memory of 3020	2836	kina8158.exe	cor7612.exe
PID 3740 wrote to memory of 2236	3740	oneetx.exe	schtasks.exe
PID 3740 wrote to memory of 2236	3740	oneetx.exe	schtasks.exe
PID 3740 wrote to memory of 2236	3740	oneetx.exe	schtasks.exe
PID 1524 wrote to memory of 3708	1524	kina6358.exe	diP23s87.exe
PID 1524 wrote to memory of 3708	1524	kina6358.exe	diP23s87.exe
PID 1524 wrote to memory of 3708	1524	kina6358.exe	diP23s87.exe
PID 4924 wrote to memory of 548	4924	704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exe	en619154.exe
PID 4924 wrote to memory of 548	4924	704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exe	en619154.exe
PID 4924 wrote to memory of 548	4924	704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exe	en619154.exe
PID 3740 wrote to memory of 1240	3740	oneetx.exe	rundll32.exe
PID 3740 wrote to memory of 1240	3740	oneetx.exe	rundll32.exe
PID 3740 wrote to memory of 1240	3740	oneetx.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exe
"C:\Users\Admin\AppData\Local\Temp\704222e09f450394cc6fd5d37f5482b34fa0ac18506c7bec3abbef880a2330bf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4924

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6358.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6358.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1524

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8158.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8158.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2836

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7527.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7527.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2340

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az619917.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az619917.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu335790.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu335790.exe
5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 696
6⤵
- Program crash
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 780
6⤵
- Program crash
PID:840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 856
6⤵
- Program crash
PID:2948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 968
6⤵
- Program crash
PID:5016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 872
6⤵
- Program crash
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 872
6⤵
- Program crash
PID:1956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 1208
6⤵
- Program crash
PID:816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 1276
6⤵
- Program crash
PID:3584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 1320
6⤵
- Program crash
PID:2988

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"
6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 692
7⤵
- Program crash
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 876
7⤵
- Program crash
PID:880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 932
7⤵
- Program crash
PID:3372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 924
7⤵
- Program crash
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1084
7⤵
- Program crash
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1100
7⤵
- Program crash
PID:3212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1028
7⤵
- Program crash
PID:372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1092
7⤵
- Program crash
PID:4844

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F
7⤵
- Creates scheduled task(s)
PID:2236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 916
7⤵
- Program crash
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1260
7⤵
- Program crash
PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 744
7⤵
- Program crash
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 756
7⤵
- Program crash
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1128
7⤵
- Program crash
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1536
7⤵
- Program crash
PID:1676

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
7⤵
- Loads dropped DLL
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1580
7⤵
- Program crash
PID:3180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 1628
7⤵
- Program crash
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 1372
6⤵
- Program crash
PID:404

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor7612.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor7612.exe
4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3020 -s 1084
5⤵
- Program crash
PID:4344

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\diP23s87.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\diP23s87.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3708 -s 1328
4⤵
- Program crash
PID:452

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en619154.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en619154.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3940 -ip 3940
1⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3940 -ip 3940
1⤵
PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3940 -ip 3940
1⤵
PID:1856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3940 -ip 3940
1⤵
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3940 -ip 3940
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3940 -ip 3940
1⤵
PID:2112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3940 -ip 3940
1⤵
PID:4064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 3940 -ip 3940
1⤵
PID:3976

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3940 -ip 3940
1⤵
PID:1068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3940 -ip 3940
1⤵
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3740 -ip 3740
1⤵
PID:1060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3740 -ip 3740
1⤵
PID:4032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3740 -ip 3740
1⤵
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3740 -ip 3740
1⤵
PID:3828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3740 -ip 3740
1⤵
PID:1416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3740 -ip 3740
1⤵
PID:1572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3740 -ip 3740
1⤵
PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3740 -ip 3740
1⤵
PID:4276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3740 -ip 3740
1⤵
PID:1412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3740 -ip 3740
1⤵
PID:1940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3740 -ip 3740
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3740 -ip 3740
1⤵
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3020 -ip 3020
1⤵
PID:4284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3708 -ip 3708
1⤵
PID:3704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3740 -ip 3740
1⤵
PID:1412

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:1948

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 316
2⤵
- Program crash
PID:4760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 1948 -ip 1948
1⤵
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3740 -ip 3740
1⤵
PID:1680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3740 -ip 3740
1⤵
PID:3396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3740 -ip 3740
1⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
1⤵
- Executes dropped EXE
PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1120 -s 320
2⤵
- Program crash
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1120 -ip 1120
1⤵
PID:4372

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe
Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en619154.exe
Filesize
168KB

MD5
cd637d87ffec3216ba41ea859fe659ac

SHA1
d208732c736c5a6f2367fc49c9056be21a3eca76

SHA256
2ecb5e91e0faac5fe93749ad90ec115a6681aff24a7c6733d6c52047c93d8ffd

SHA512
9a7dd1fd784d63ed4694344b198f575943abcd90a708752407f99eb68a77b02452738143a38f8e1dd65238b91f84025900f0c2d183a9427fdfe86b9439af9ca7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en619154.exe
Filesize
168KB

MD5
cd637d87ffec3216ba41ea859fe659ac

SHA1
d208732c736c5a6f2367fc49c9056be21a3eca76

SHA256
2ecb5e91e0faac5fe93749ad90ec115a6681aff24a7c6733d6c52047c93d8ffd

SHA512
9a7dd1fd784d63ed4694344b198f575943abcd90a708752407f99eb68a77b02452738143a38f8e1dd65238b91f84025900f0c2d183a9427fdfe86b9439af9ca7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6358.exe
Filesize
921KB

MD5
a475680d7d552278aa3316561d2eebd1

SHA1
b60ec03b4d565710200ded0d13d7f518ac5d72ad

SHA256
fff49525fd1c5ae92a1ef47b789dd2eb1d8ee3114149caebbdeae9b148c526fe

SHA512
47bd79510aa01d3e819f6a18278ce5de0aba1e15606f90ad2cbe113afaf3e18ec7f6c5ade2f6f5d385645c5579523a1d8a5d62792c65f6af40db51556264687a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6358.exe
Filesize
921KB

MD5
a475680d7d552278aa3316561d2eebd1

SHA1
b60ec03b4d565710200ded0d13d7f518ac5d72ad

SHA256
fff49525fd1c5ae92a1ef47b789dd2eb1d8ee3114149caebbdeae9b148c526fe

SHA512
47bd79510aa01d3e819f6a18278ce5de0aba1e15606f90ad2cbe113afaf3e18ec7f6c5ade2f6f5d385645c5579523a1d8a5d62792c65f6af40db51556264687a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\diP23s87.exe
Filesize
297KB

MD5
8530bc74b9008c95eed4f935a740c3a4

SHA1
18d2f4da24d0b2c42817dc2fbe089a302396fbda

SHA256
269389c988b8310aee477a54b48c40eb099910f05f836639b26cd28de2d6ae7a

SHA512
39b512fa7aec19dde3639d2d4ee1a8f66756b795ea819010f785bf1f0543bf1076960d46b35fb20286710c3ecca3585eb83953215dbaeb7ea333434691a83cfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\diP23s87.exe
Filesize
297KB

MD5
8530bc74b9008c95eed4f935a740c3a4

SHA1
18d2f4da24d0b2c42817dc2fbe089a302396fbda

SHA256
269389c988b8310aee477a54b48c40eb099910f05f836639b26cd28de2d6ae7a

SHA512
39b512fa7aec19dde3639d2d4ee1a8f66756b795ea819010f785bf1f0543bf1076960d46b35fb20286710c3ecca3585eb83953215dbaeb7ea333434691a83cfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8158.exe
Filesize
589KB

MD5
0dc94c7e9f67e85d5c96aa9763b5d409

SHA1
205bd7ed075dd63c573223bf3075e4fa153f70ee

SHA256
5b8f86687d9f0ac0e24a968c22cd27226c7c904cebe01cd4f95f62c929f38673

SHA512
231ba56b296703db2e5a94e88413f286609e591ccd1b83c7ee0b279bc33a6a8b97a18738ff19a6babda64b741191107a2a8682c1ba324618137a97ba6afb62e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina8158.exe
Filesize
589KB

MD5
0dc94c7e9f67e85d5c96aa9763b5d409

SHA1
205bd7ed075dd63c573223bf3075e4fa153f70ee

SHA256
5b8f86687d9f0ac0e24a968c22cd27226c7c904cebe01cd4f95f62c929f38673

SHA512
231ba56b296703db2e5a94e88413f286609e591ccd1b83c7ee0b279bc33a6a8b97a18738ff19a6babda64b741191107a2a8682c1ba324618137a97ba6afb62e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor7612.exe
Filesize
239KB

MD5
f6a4dafc10a2b68133a83eda0eb81ba0

SHA1
c733d7388a6a32101767e4260acbc280fbe5cd6b

SHA256
80c72962b04086c2b7ab7a3cc5aa662489110181da5afb3b08fb94ac1d48045d

SHA512
6726c62f40216827af57ef8e0a44f032d375f2f5bf7e6ccaefc3c1ed3b9e0d9c38714f73f82f11ac858f2a721f53f753ad1185e577e046bf3de18b8bbb35a307

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor7612.exe
Filesize
239KB

MD5
f6a4dafc10a2b68133a83eda0eb81ba0

SHA1
c733d7388a6a32101767e4260acbc280fbe5cd6b

SHA256
80c72962b04086c2b7ab7a3cc5aa662489110181da5afb3b08fb94ac1d48045d

SHA512
6726c62f40216827af57ef8e0a44f032d375f2f5bf7e6ccaefc3c1ed3b9e0d9c38714f73f82f11ac858f2a721f53f753ad1185e577e046bf3de18b8bbb35a307

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7527.exe
Filesize
316KB

MD5
b7a3a0471503d35434c24cb292dd0cc7

SHA1
a5c5e3f20676dd7cf4c418d95ee5258cab92c81f

SHA256
df8a148c6ce83e67cb6d07a9add2af36f0bd763d76ec7e435d969531cbc45e3b

SHA512
4d53cfad941f03237b42d98cf80f698996b9d359d5f35654bd74bb4bfcbbbb28e7f3acd9dfb7cccdc92be7bd6132812b1b518a5312ddb2079f6cea0fb0642922

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7527.exe
Filesize
316KB

MD5
b7a3a0471503d35434c24cb292dd0cc7

SHA1
a5c5e3f20676dd7cf4c418d95ee5258cab92c81f

SHA256
df8a148c6ce83e67cb6d07a9add2af36f0bd763d76ec7e435d969531cbc45e3b

SHA512
4d53cfad941f03237b42d98cf80f698996b9d359d5f35654bd74bb4bfcbbbb28e7f3acd9dfb7cccdc92be7bd6132812b1b518a5312ddb2079f6cea0fb0642922

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az619917.exe
Filesize
11KB

MD5
48803dfa6ea8251d4a8385725583e285

SHA1
2431f4d4292221780e5b881e0bd157a1278281a0

SHA256
ddcaf2a173846c0af3983471f9168639b7fbaf5170207237573052bad2509eb2

SHA512
af4916f6e24a0eeec7f9a460ee5fdf03e123cd803b9d6d7fdf4a54713690945ddb208ba55ad80b8b7f47e373d5178bf3607320d34477d8c37a41d17871937cc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az619917.exe
Filesize
11KB

MD5
48803dfa6ea8251d4a8385725583e285

SHA1
2431f4d4292221780e5b881e0bd157a1278281a0

SHA256
ddcaf2a173846c0af3983471f9168639b7fbaf5170207237573052bad2509eb2

SHA512
af4916f6e24a0eeec7f9a460ee5fdf03e123cd803b9d6d7fdf4a54713690945ddb208ba55ad80b8b7f47e373d5178bf3607320d34477d8c37a41d17871937cc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu335790.exe
Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu335790.exe
Filesize
231KB

MD5
f8117f396c10315824172b564d08490e

SHA1
96c20a6f156aa6e75f75fa9038a8878d75401138

SHA256
7f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba

SHA512
60606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll
Filesize
89KB

MD5
4061d8dd5006b99d06fa208c0063dfcf

SHA1
38e7df8d8e631f3e9b227df3b9326d187e18cce5

SHA256
b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0

SHA512
71de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll
Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/548-1162-0x0000000000A60000-0x0000000000A90000-memory.dmp

Filesize
192KB

Download
memory/548-1163-0x0000000005210000-0x0000000005220000-memory.dmp

Filesize
64KB

Download
memory/1744-161-0x0000000000580000-0x000000000058A000-memory.dmp

Filesize
40KB

Download
memory/3020-191-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-204-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-206-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-208-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-210-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-212-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-214-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-216-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-218-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-187-0x0000000004C60000-0x0000000005204000-memory.dmp

Filesize
5.6MB

Download
memory/3020-220-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3020-221-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/3020-222-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/3020-223-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/3020-225-0x0000000000400000-0x00000000004AA000-memory.dmp

Filesize
680KB

Download
memory/3020-202-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-200-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-188-0x0000000000580000-0x00000000005AD000-memory.dmp

Filesize
180KB

Download
memory/3020-189-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/3020-190-0x0000000004C50000-0x0000000004C60000-memory.dmp

Filesize
64KB

Download
memory/3020-192-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-194-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-196-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3020-198-0x00000000024A0000-0x00000000024B2000-memory.dmp

Filesize
72KB

Download
memory/3708-253-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-1147-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3708-243-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-245-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-247-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-249-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-251-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-239-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-255-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-257-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-259-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-261-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-263-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-265-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-1140-0x00000000056E0000-0x0000000005CF8000-memory.dmp

Filesize
6.1MB

Download
memory/3708-1141-0x0000000005140000-0x000000000524A000-memory.dmp

Filesize
1.0MB

Download
memory/3708-1142-0x0000000005280000-0x0000000005292000-memory.dmp

Filesize
72KB

Download
memory/3708-1143-0x00000000052A0000-0x00000000052DC000-memory.dmp

Filesize
240KB

Download
memory/3708-1144-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3708-241-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-1148-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3708-1149-0x0000000005590000-0x00000000055F6000-memory.dmp

Filesize
408KB

Download
memory/3708-1150-0x0000000006260000-0x00000000062F2000-memory.dmp

Filesize
584KB

Download
memory/3708-1151-0x0000000006590000-0x0000000006606000-memory.dmp

Filesize
472KB

Download
memory/3708-1152-0x0000000006620000-0x0000000006670000-memory.dmp

Filesize
320KB

Download
memory/3708-1153-0x00000000066A0000-0x0000000006862000-memory.dmp

Filesize
1.8MB

Download
memory/3708-1154-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3708-1155-0x0000000006880000-0x0000000006DAC000-memory.dmp

Filesize
5.2MB

Download
memory/3708-237-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-235-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-234-0x0000000004A70000-0x0000000004AAF000-memory.dmp

Filesize
252KB

Download
memory/3708-233-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3708-232-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3708-231-0x0000000004AE0000-0x0000000004AF0000-memory.dmp

Filesize
64KB

Download
memory/3708-230-0x0000000001ED0000-0x0000000001F1B000-memory.dmp

Filesize
300KB

Download
memory/3740-219-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3940-182-0x0000000000400000-0x00000000004A8000-memory.dmp

Filesize
672KB

Download
memory/3940-167-0x0000000000580000-0x00000000005BB000-memory.dmp

Filesize
236KB

Download