d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8

Analysis

max time kernel
144s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
21-04-2023 04:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8.exe
Size

1.0MB
MD5

8b7a915896c13c04606b0ba1bb097bec
SHA1

2aeda30570cd54b91fc727e6448a0f35fe7103fe
SHA256

d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8
SHA512

70d52d3fce296ef7a257bc8f2ac49098cdb25433714717d9b0ea320f3b66cf67ec511df655316288cb9fc4b667207357c18820f323960bc965a097d722bbe268
SSDEEP

24576:yyBoTslOxSQl2BjptLbcUTyxf7JCOvepQ/EEKJqxbs:ZtOofBjp9/Tqf4aepQ/Lo

Score

10^/10

discovery evasion persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	pr903153.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	pr903153.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	pr903153.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	pr903153.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	pr903153.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	pr903153.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	si788280.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	oneetx.exe

Executes dropped EXE 9 IoCs

pid	Process
4512	un475546.exe
4908	un528482.exe
2156	pr903153.exe
4760	qu556065.exe
3580	rk041019.exe
3544	si788280.exe
2032	oneetx.exe
4600	oneetx.exe
1144	oneetx.exe

Loads dropped DLL 1 IoCs

pid	Process
1216	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	pr903153.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	pr903153.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un475546.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	un475546.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	un528482.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	un528482.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 32 IoCs

pid	pid_target	Process	procid_target
4200	2156	WerFault.exe	86
4288	4760	WerFault.exe	92
900	3544	WerFault.exe	96
4440	3544	WerFault.exe	96
4172	3544	WerFault.exe	96
1540	3544	WerFault.exe	96
1740	3544	WerFault.exe	96
932	3544	WerFault.exe	96
4112	3544	WerFault.exe	96
2576	3544	WerFault.exe	96
2464	3544	WerFault.exe	96
4040	3544	WerFault.exe	96
4772	2032	WerFault.exe	116
232	2032	WerFault.exe	116
4684	2032	WerFault.exe	116
2352	2032	WerFault.exe	116
4192	2032	WerFault.exe	116
1708	2032	WerFault.exe	116
2156	2032	WerFault.exe	116
4724	2032	WerFault.exe	116
3216	2032	WerFault.exe	116
2808	2032	WerFault.exe	116
4576	2032	WerFault.exe	116
2860	2032	WerFault.exe	116
5052	2032	WerFault.exe	116
4440	2032	WerFault.exe	116
4932	4600	WerFault.exe	161
2340	2032	WerFault.exe	116
3496	2032	WerFault.exe	116
3964	2032	WerFault.exe	116
3420	2032	WerFault.exe	116
3944	1144	WerFault.exe	173

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2384	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2156	pr903153.exe
2156	pr903153.exe
4760	qu556065.exe
4760	qu556065.exe
3580	rk041019.exe
3580	rk041019.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2156	pr903153.exe
Token: SeDebugPrivilege	4760	qu556065.exe
Token: SeDebugPrivilege	3580	rk041019.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3544	si788280.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 4512	2724	d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8.exe	84
PID 2724 wrote to memory of 4512	2724	d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8.exe	84
PID 2724 wrote to memory of 4512	2724	d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8.exe	84
PID 4512 wrote to memory of 4908	4512	un475546.exe	85
PID 4512 wrote to memory of 4908	4512	un475546.exe	85
PID 4512 wrote to memory of 4908	4512	un475546.exe	85
PID 4908 wrote to memory of 2156	4908	un528482.exe	86
PID 4908 wrote to memory of 2156	4908	un528482.exe	86
PID 4908 wrote to memory of 2156	4908	un528482.exe	86
PID 4908 wrote to memory of 4760	4908	un528482.exe	92
PID 4908 wrote to memory of 4760	4908	un528482.exe	92
PID 4908 wrote to memory of 4760	4908	un528482.exe	92
PID 4512 wrote to memory of 3580	4512	un475546.exe	95
PID 4512 wrote to memory of 3580	4512	un475546.exe	95
PID 4512 wrote to memory of 3580	4512	un475546.exe	95
PID 2724 wrote to memory of 3544	2724	d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8.exe	96
PID 2724 wrote to memory of 3544	2724	d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8.exe	96
PID 2724 wrote to memory of 3544	2724	d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8.exe	96
PID 3544 wrote to memory of 2032	3544	si788280.exe	116
PID 3544 wrote to memory of 2032	3544	si788280.exe	116
PID 3544 wrote to memory of 2032	3544	si788280.exe	116
PID 2032 wrote to memory of 2384	2032	oneetx.exe	134
PID 2032 wrote to memory of 2384	2032	oneetx.exe	134
PID 2032 wrote to memory of 2384	2032	oneetx.exe	134
PID 2032 wrote to memory of 4680	2032	oneetx.exe	142
PID 2032 wrote to memory of 4680	2032	oneetx.exe	142
PID 2032 wrote to memory of 4680	2032	oneetx.exe	142
PID 4680 wrote to memory of 4780	4680	cmd.exe	146
PID 4680 wrote to memory of 4780	4680	cmd.exe	146
PID 4680 wrote to memory of 4780	4680	cmd.exe	146
PID 4680 wrote to memory of 4640	4680	cmd.exe	147
PID 4680 wrote to memory of 4640	4680	cmd.exe	147
PID 4680 wrote to memory of 4640	4680	cmd.exe	147
PID 4680 wrote to memory of 4544	4680	cmd.exe	148
PID 4680 wrote to memory of 4544	4680	cmd.exe	148
PID 4680 wrote to memory of 4544	4680	cmd.exe	148
PID 4680 wrote to memory of 4908	4680	cmd.exe	150
PID 4680 wrote to memory of 4908	4680	cmd.exe	150
PID 4680 wrote to memory of 4908	4680	cmd.exe	150
PID 4680 wrote to memory of 1908	4680	cmd.exe	149
PID 4680 wrote to memory of 1908	4680	cmd.exe	149
PID 4680 wrote to memory of 1908	4680	cmd.exe	149
PID 4680 wrote to memory of 3064	4680	cmd.exe	151
PID 4680 wrote to memory of 3064	4680	cmd.exe	151
PID 4680 wrote to memory of 3064	4680	cmd.exe	151
PID 2032 wrote to memory of 1216	2032	oneetx.exe	168
PID 2032 wrote to memory of 1216	2032	oneetx.exe	168
PID 2032 wrote to memory of 1216	2032	oneetx.exe	168

C:\Users\Admin\AppData\Local\Temp\d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8.exe
"C:\Users\Admin\AppData\Local\Temp\d94bb3362598b35a9a2e2ee8119392c6c14a68db33d3ea648f326ba721cfabd8.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un475546.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un475546.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un528482.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un528482.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr903153.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr903153.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2156
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 1084
        5⤵
        Program crash
        
        PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu556065.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu556065.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4760
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 1316
        5⤵
        Program crash
        
        PID:4288
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk041019.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk041019.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3580
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si788280.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si788280.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 696
    3⤵
    - Program crash
    PID:900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 780
    3⤵
    - Program crash
    PID:4440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 856
    3⤵
    - Program crash
    PID:4172
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 864
    3⤵
    - Program crash
    PID:1540
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 968
    3⤵
    - Program crash
    PID:1740
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 872
    3⤵
    - Program crash
    PID:932
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1212
    3⤵
    - Program crash
    PID:4112
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1228
    3⤵
    - Program crash
    PID:2576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 1276
    3⤵
    - Program crash
    PID:2464
- - C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
    "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 692
      4⤵
      Program crash
      PID:4772
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 856
      4⤵
      Program crash
      PID:232
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 936
      4⤵
      Program crash
      PID:4684
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1052
      4⤵
      Program crash
      PID:2352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1088
      4⤵
      Program crash
      PID:4192
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1088
      4⤵
      Program crash
      PID:1708
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1116
      4⤵
      Program crash
      PID:2156
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe" /F
      4⤵
      Creates scheduled task(s)
      PID:2384
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 992
      4⤵
      Program crash
      PID:4724
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 776
      4⤵
      Program crash
      PID:3216
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb7ae701b3" /P "Admin:N"&&CACLS "..\cb7ae701b3" /P "Admin:R" /E&&Exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4680
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4780
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:N"
        5⤵
        
        PID:4640
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "oneetx.exe" /P "Admin:R" /E
        5⤵
        
        PID:4544
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:N"
        5⤵
        
        PID:1908
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        5⤵
        
        PID:4908
    - - C:\Windows\SysWOW64\cacls.exe
        
        CACLS "..\cb7ae701b3" /P "Admin:R" /E
        5⤵
        
        PID:3064
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 752
      4⤵
      Program crash
      PID:2808
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1252
      4⤵
      Program crash
      PID:4576
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 752
      4⤵
      Program crash
      PID:2860
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1292
      4⤵
      Program crash
      PID:5052
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1468
      4⤵
      Program crash
      PID:4440
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1104
      4⤵
      Program crash
      PID:2340
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1076
      4⤵
      Program crash
      PID:3496
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main
      4⤵
      Loads dropped DLL
      PID:1216
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1332
      4⤵
      Program crash
      PID:3964
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 1664
      4⤵
      Program crash
      PID:3420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3544 -s 788
    3⤵
    - Program crash
    PID:4040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2156 -ip 2156
1⤵
PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4760 -ip 4760
1⤵
PID:1712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3544 -ip 3544
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 3544 -ip 3544
1⤵
PID:3940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3544 -ip 3544
1⤵
PID:1408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 3544 -ip 3544
1⤵
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3544 -ip 3544
1⤵
PID:956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3544 -ip 3544
1⤵
PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3544 -ip 3544
1⤵
PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3544 -ip 3544
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3544 -ip 3544
1⤵
PID:936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3544 -ip 3544
1⤵
PID:2580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2032 -ip 2032
1⤵
PID:3392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2032 -ip 2032
1⤵
PID:236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2032 -ip 2032
1⤵
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2032 -ip 2032
1⤵
PID:4916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2032 -ip 2032
1⤵
PID:4380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2032 -ip 2032
1⤵
PID:848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2032 -ip 2032
1⤵
PID:4036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2032 -ip 2032
1⤵
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2032 -ip 2032
1⤵
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 2032 -ip 2032
1⤵
PID:4664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2032 -ip 2032
1⤵
PID:1952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2032 -ip 2032
1⤵
PID:3812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2032 -ip 2032
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2032 -ip 2032
1⤵
PID:4536

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:4600
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 312
  2⤵
  - Program crash
  PID:4932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4600 -ip 4600
1⤵
PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2032 -ip 2032
1⤵
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2032 -ip 2032
1⤵
PID:3112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2032 -ip 2032
1⤵
PID:4548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2032 -ip 2032
1⤵
PID:2724

C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe
1⤵
- Executes dropped EXE
PID:1144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 316
  2⤵
  - Program crash
  PID:3944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 1144 -ip 1144
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si788280.exe

Filesize
370KB

MD5
216057b618ec6d3628c5e2f31677bcd2

SHA1
906426e26a7d317ffb381a01bea519dbe44496f6

SHA256
74377f522f99754068ec3406fa13ff88db7fe13eebe34471f1805671c95c152d

SHA512
a6e05673dddd480b1c7f312cf0de88358c6511f910bf56a35ee3e0b27c37ea556d402426fbdb26b03c5ac06de7b501419131086a3bd627288822c93644e3e178

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si788280.exe

Filesize
370KB

MD5
216057b618ec6d3628c5e2f31677bcd2

SHA1
906426e26a7d317ffb381a01bea519dbe44496f6

SHA256
74377f522f99754068ec3406fa13ff88db7fe13eebe34471f1805671c95c152d

SHA512
a6e05673dddd480b1c7f312cf0de88358c6511f910bf56a35ee3e0b27c37ea556d402426fbdb26b03c5ac06de7b501419131086a3bd627288822c93644e3e178

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un475546.exe

Filesize
750KB

MD5
4540d7ebd35f1884498dbfc1975681a9

SHA1
de1638f8bf4a55ecd0a77b3e254e6a9bd8b7876a

SHA256
7783b5fb0a19f8364e978a6ed357c40b14e7a62bc483b5ba239b78c4c27c293f

SHA512
8d0210136f50ab0e4af4023fd22b058236dba0e962cde0337e5d256dc810c2680fb0084f35d6974d24366f627008cc97c80c412d4dc56852a7635a26c624330c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un475546.exe

Filesize
750KB

MD5
4540d7ebd35f1884498dbfc1975681a9

SHA1
de1638f8bf4a55ecd0a77b3e254e6a9bd8b7876a

SHA256
7783b5fb0a19f8364e978a6ed357c40b14e7a62bc483b5ba239b78c4c27c293f

SHA512
8d0210136f50ab0e4af4023fd22b058236dba0e962cde0337e5d256dc810c2680fb0084f35d6974d24366f627008cc97c80c412d4dc56852a7635a26c624330c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk041019.exe

Filesize
136KB

MD5
ac0ffc4fceebe7be421ae8fc8517d1bf

SHA1
fa6a6f1878e561b5401ae36422add3d34cfdf6dd

SHA256
fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718

SHA512
23de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk041019.exe

Filesize
136KB

MD5
ac0ffc4fceebe7be421ae8fc8517d1bf

SHA1
fa6a6f1878e561b5401ae36422add3d34cfdf6dd

SHA256
fe0c2e45eda219cfb1d2bd132437d2412d84cbe8cc2787dd4ff710e1be5c9718

SHA512
23de94ab73fc8cf91d573870d7ac1fb6976eaed31d93e0619378ea93ac5feaf06967bc652525b584bba1b973a2c6e6075b8d7dbe3a8ddf5d569b4e80722bfb93

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un528482.exe

Filesize
596KB

MD5
354811ef38c5f32203da8d69a775aa3e

SHA1
547d4a3bc7891af2680556d6d7af93f32358d9cd

SHA256
d1352444d15ebce75a0eef5f438731c0e690b0b207c57aded5d74f08703022e8

SHA512
01aa0a4c47e671de02ee24c06a62498bb5fded36782727aeb2b81b267e478f49f6fc707180765b01d11add7bf40b84036a5bab777bf8be70bb21bbb5c2800775

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un528482.exe

Filesize
596KB

MD5
354811ef38c5f32203da8d69a775aa3e

SHA1
547d4a3bc7891af2680556d6d7af93f32358d9cd

SHA256
d1352444d15ebce75a0eef5f438731c0e690b0b207c57aded5d74f08703022e8

SHA512
01aa0a4c47e671de02ee24c06a62498bb5fded36782727aeb2b81b267e478f49f6fc707180765b01d11add7bf40b84036a5bab777bf8be70bb21bbb5c2800775

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr903153.exe

Filesize
391KB

MD5
850f2b254181bc173ffff425a6e1236e

SHA1
91d33e81fa60d2777995321311f34c21ef343315

SHA256
f1467121b52575d49dab39f465d5035821ba643d572c21360727117a6dfc9759

SHA512
6355bbf15044e88869f3609c71c1e742232227f5b276139b53fa557946e13edcd48d5edaeb0f8c70ede54881995d25ee42e7fec3400ac92cf80f3c818126e31d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr903153.exe

Filesize
391KB

MD5
850f2b254181bc173ffff425a6e1236e

SHA1
91d33e81fa60d2777995321311f34c21ef343315

SHA256
f1467121b52575d49dab39f465d5035821ba643d572c21360727117a6dfc9759

SHA512
6355bbf15044e88869f3609c71c1e742232227f5b276139b53fa557946e13edcd48d5edaeb0f8c70ede54881995d25ee42e7fec3400ac92cf80f3c818126e31d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu556065.exe

Filesize
474KB

MD5
ac0beff6d6c6e608bfcaa2dde6b2e2a8

SHA1
9c630a799a79819fb498e80166303d5e384394d8

SHA256
4643f0540b3a6dabc4d4219531ff1d70e46c2ef76f075e2b39515816595a11f4

SHA512
f7a0af6f1ffe9665fda47be2eff1de26e2ab1c49f23839a7d68edafbd33cd4f810eca7169b4e00f1a66edcf8c45a34a010070bb9e0060eee8a0471529f9ac16f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu556065.exe

Filesize
474KB

MD5
ac0beff6d6c6e608bfcaa2dde6b2e2a8

SHA1
9c630a799a79819fb498e80166303d5e384394d8

SHA256
4643f0540b3a6dabc4d4219531ff1d70e46c2ef76f075e2b39515816595a11f4

SHA512
f7a0af6f1ffe9665fda47be2eff1de26e2ab1c49f23839a7d68edafbd33cd4f810eca7169b4e00f1a66edcf8c45a34a010070bb9e0060eee8a0471529f9ac16f

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
370KB

MD5
216057b618ec6d3628c5e2f31677bcd2

SHA1
906426e26a7d317ffb381a01bea519dbe44496f6

SHA256
74377f522f99754068ec3406fa13ff88db7fe13eebe34471f1805671c95c152d

SHA512
a6e05673dddd480b1c7f312cf0de88358c6511f910bf56a35ee3e0b27c37ea556d402426fbdb26b03c5ac06de7b501419131086a3bd627288822c93644e3e178

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
370KB

MD5
216057b618ec6d3628c5e2f31677bcd2

SHA1
906426e26a7d317ffb381a01bea519dbe44496f6

SHA256
74377f522f99754068ec3406fa13ff88db7fe13eebe34471f1805671c95c152d

SHA512
a6e05673dddd480b1c7f312cf0de88358c6511f910bf56a35ee3e0b27c37ea556d402426fbdb26b03c5ac06de7b501419131086a3bd627288822c93644e3e178

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
370KB

MD5
216057b618ec6d3628c5e2f31677bcd2

SHA1
906426e26a7d317ffb381a01bea519dbe44496f6

SHA256
74377f522f99754068ec3406fa13ff88db7fe13eebe34471f1805671c95c152d

SHA512
a6e05673dddd480b1c7f312cf0de88358c6511f910bf56a35ee3e0b27c37ea556d402426fbdb26b03c5ac06de7b501419131086a3bd627288822c93644e3e178

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
370KB

MD5
216057b618ec6d3628c5e2f31677bcd2

SHA1
906426e26a7d317ffb381a01bea519dbe44496f6

SHA256
74377f522f99754068ec3406fa13ff88db7fe13eebe34471f1805671c95c152d

SHA512
a6e05673dddd480b1c7f312cf0de88358c6511f910bf56a35ee3e0b27c37ea556d402426fbdb26b03c5ac06de7b501419131086a3bd627288822c93644e3e178

Download Submit
C:\Users\Admin\AppData\Local\Temp\cb7ae701b3\oneetx.exe

Filesize
370KB

MD5
216057b618ec6d3628c5e2f31677bcd2

SHA1
906426e26a7d317ffb381a01bea519dbe44496f6

SHA256
74377f522f99754068ec3406fa13ff88db7fe13eebe34471f1805671c95c152d

SHA512
a6e05673dddd480b1c7f312cf0de88358c6511f910bf56a35ee3e0b27c37ea556d402426fbdb26b03c5ac06de7b501419131086a3bd627288822c93644e3e178

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll

Filesize
89KB

MD5
f577e9f9bb3716a1405af573fbf2afb4

SHA1
7e2a18c86e4912f9218fbe7c8cf64e04afb90f6e

SHA256
4b3391b13b28318497485a35a26a9c6389ef46eb497f473ff3ec06e0289fdbcb

SHA512
fb7791bd8dd6124a657fbf3de52864442a66209540e34a3f085bcb0019937712b3a538e092751baf57bbe9abd6b764e02dc0b214a02492ec4b8459029b0d7add

Download Submit
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dll

Filesize
162B

MD5
1b7c22a214949975556626d7217e9a39

SHA1
d01c97e2944166ed23e47e4a62ff471ab8fa031f

SHA256
340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87

SHA512
ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5

Download Submit
memory/2156-157-0x0000000002950000-0x0000000002960000-memory.dmp

Filesize
64KB

Download
memory/2156-172-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-176-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-178-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-180-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-182-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-184-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-186-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-187-0x0000000000400000-0x0000000000807000-memory.dmp

Filesize
4.0MB

Download
memory/2156-188-0x0000000002950000-0x0000000002960000-memory.dmp

Filesize
64KB

Download
memory/2156-189-0x0000000002950000-0x0000000002960000-memory.dmp

Filesize
64KB

Download
memory/2156-190-0x0000000002950000-0x0000000002960000-memory.dmp

Filesize
64KB

Download
memory/2156-192-0x0000000000400000-0x0000000000807000-memory.dmp

Filesize
4.0MB

Download
memory/2156-174-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-170-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-168-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-166-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-164-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-162-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-160-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-159-0x00000000026C0000-0x00000000026D2000-memory.dmp

Filesize
72KB

Download
memory/2156-158-0x0000000004DE0000-0x0000000005384000-memory.dmp

Filesize
5.6MB

Download
memory/2156-155-0x00000000008E0000-0x000000000090D000-memory.dmp

Filesize
180KB

Download
memory/2156-156-0x0000000002950000-0x0000000002960000-memory.dmp

Filesize
64KB

Download
memory/3544-1017-0x00000000009A0000-0x00000000009D5000-memory.dmp

Filesize
212KB

Download
memory/3580-1010-0x00000000008A0000-0x00000000008C8000-memory.dmp

Filesize
160KB

Download
memory/3580-1011-0x0000000007950000-0x0000000007960000-memory.dmp

Filesize
64KB

Download
memory/4760-208-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-226-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-228-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-230-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-530-0x0000000000D40000-0x0000000000D86000-memory.dmp

Filesize
280KB

Download
memory/4760-532-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/4760-534-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/4760-537-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/4760-993-0x0000000007980000-0x0000000007F98000-memory.dmp

Filesize
6.1MB

Download
memory/4760-994-0x00000000029D0000-0x00000000029E2000-memory.dmp

Filesize
72KB

Download
memory/4760-995-0x0000000007FA0000-0x00000000080AA000-memory.dmp

Filesize
1.0MB

Download
memory/4760-996-0x00000000025D0000-0x00000000025E0000-memory.dmp

Filesize
64KB

Download
memory/4760-997-0x00000000080B0000-0x00000000080EC000-memory.dmp

Filesize
240KB

Download
memory/4760-998-0x00000000083B0000-0x0000000008416000-memory.dmp

Filesize
408KB

Download
memory/4760-999-0x0000000008A70000-0x0000000008B02000-memory.dmp

Filesize
584KB

Download
memory/4760-1000-0x0000000008B40000-0x0000000008BB6000-memory.dmp

Filesize
472KB

Download
memory/4760-1001-0x0000000008C20000-0x0000000008DE2000-memory.dmp

Filesize
1.8MB

Download
memory/4760-1002-0x0000000008DF0000-0x000000000931C000-memory.dmp

Filesize
5.2MB

Download
memory/4760-224-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-222-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-220-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-218-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-216-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-214-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-212-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-210-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-206-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-204-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-202-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-200-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-198-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-197-0x0000000002870000-0x00000000028A5000-memory.dmp

Filesize
212KB

Download
memory/4760-1003-0x0000000009430000-0x000000000944E000-memory.dmp

Filesize
120KB

Download
memory/4760-1004-0x0000000002770000-0x00000000027C0000-memory.dmp

Filesize
320KB

Download