Analysis
-
max time kernel
115s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2023 00:21
Static task
static1
Behavioral task
behavioral1
Sample
1cb1ab3718b08953c99cb4bf4b7e48e1.exe
Resource
win7-20230220-en
General
-
Target
1cb1ab3718b08953c99cb4bf4b7e48e1.exe
-
Size
1.2MB
-
MD5
1cb1ab3718b08953c99cb4bf4b7e48e1
-
SHA1
f2ffddffa4a926e4f001d72af7de032d8bafd6b6
-
SHA256
80d6758fc3e6a83608bc60dfe1693e9d24cd3207df0722d58209e14c2685aa22
-
SHA512
f750911a6396a4d6cd6de28023701d7b813313161f5e66858769fe01c49a2b45de1ac8eed5d8190359bcd612cf31139fccc2dc7b3921188738c1eb4ee38f701f
-
SSDEEP
24576:+yGZWUT9o6xHz4xHnFg/HWo2bpFyBPI16yD3Qq/LtnqjpKjwP/U:NGZWko2anFg/2RbTylyZtnqlK
Malware Config
Extracted
redline
ronur
193.233.20.20:4134
-
auth_value
f88f86755a528d4b25f6f3628c460965
Extracted
redline
funka
193.233.20.20:4134
-
auth_value
cdb395608d7ec633dce3d2f0c7fb0741
Extracted
amadey
3.67
193.233.20.15/dF30Hn4m/index.php
Signatures
-
Processes:
mBy36kE.exeiuv99ZS.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection mBy36kE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" mBy36kE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" mBy36kE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" mBy36kE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" mBy36kE.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection iuv99ZS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" iuv99ZS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" iuv99ZS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" mBy36kE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" iuv99ZS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" iuv99ZS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" iuv99ZS.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral2/memory/4244-179-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-182-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-184-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-180-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-186-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-188-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-190-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-192-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-194-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-198-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-200-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-196-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-202-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-204-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-206-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-208-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-210-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-212-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-214-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-216-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-218-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-220-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-222-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-224-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-226-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-228-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-230-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-232-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-234-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-236-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-238-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-240-0x0000000005240000-0x000000000527E000-memory.dmp family_redline behavioral2/memory/4244-242-0x0000000005240000-0x000000000527E000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rsA73Pj.exemnolyk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation rsA73Pj.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 12 IoCs
Processes:
sxW36oT69.exesxF46am78.exesoz61Nc21.exesZf57lJ67.exeiuv99ZS.exekme28RL.exemBy36kE.exensM91iO53.exeoPb73xO.exersA73Pj.exemnolyk.exemnolyk.exepid process 2672 sxW36oT69.exe 2072 sxF46am78.exe 4496 soz61Nc21.exe 4500 sZf57lJ67.exe 5056 iuv99ZS.exe 4244 kme28RL.exe 2024 mBy36kE.exe 2896 nsM91iO53.exe 1332 oPb73xO.exe 4328 rsA73Pj.exe 3968 mnolyk.exe 4472 mnolyk.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2768 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
iuv99ZS.exemBy36kE.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" iuv99ZS.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features mBy36kE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" mBy36kE.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
1cb1ab3718b08953c99cb4bf4b7e48e1.exesxW36oT69.exesoz61Nc21.exesZf57lJ67.exesxF46am78.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1cb1ab3718b08953c99cb4bf4b7e48e1.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sxW36oT69.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" sxW36oT69.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce soz61Nc21.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sZf57lJ67.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" sZf57lJ67.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1cb1ab3718b08953c99cb4bf4b7e48e1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" sxF46am78.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" soz61Nc21.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sxF46am78.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4164 4244 WerFault.exe kme28RL.exe 1232 2024 WerFault.exe mBy36kE.exe 5020 2896 WerFault.exe nsM91iO53.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
iuv99ZS.exekme28RL.exemBy36kE.exensM91iO53.exeoPb73xO.exepid process 5056 iuv99ZS.exe 5056 iuv99ZS.exe 4244 kme28RL.exe 4244 kme28RL.exe 2024 mBy36kE.exe 2024 mBy36kE.exe 2896 nsM91iO53.exe 2896 nsM91iO53.exe 1332 oPb73xO.exe 1332 oPb73xO.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
iuv99ZS.exekme28RL.exemBy36kE.exensM91iO53.exeoPb73xO.exedescription pid process Token: SeDebugPrivilege 5056 iuv99ZS.exe Token: SeDebugPrivilege 4244 kme28RL.exe Token: SeDebugPrivilege 2024 mBy36kE.exe Token: SeDebugPrivilege 2896 nsM91iO53.exe Token: SeDebugPrivilege 1332 oPb73xO.exe -
Suspicious use of WriteProcessMemory 59 IoCs
Processes:
1cb1ab3718b08953c99cb4bf4b7e48e1.exesxW36oT69.exesxF46am78.exesoz61Nc21.exesZf57lJ67.exersA73Pj.exemnolyk.execmd.exedescription pid process target process PID 4640 wrote to memory of 2672 4640 1cb1ab3718b08953c99cb4bf4b7e48e1.exe sxW36oT69.exe PID 4640 wrote to memory of 2672 4640 1cb1ab3718b08953c99cb4bf4b7e48e1.exe sxW36oT69.exe PID 4640 wrote to memory of 2672 4640 1cb1ab3718b08953c99cb4bf4b7e48e1.exe sxW36oT69.exe PID 2672 wrote to memory of 2072 2672 sxW36oT69.exe sxF46am78.exe PID 2672 wrote to memory of 2072 2672 sxW36oT69.exe sxF46am78.exe PID 2672 wrote to memory of 2072 2672 sxW36oT69.exe sxF46am78.exe PID 2072 wrote to memory of 4496 2072 sxF46am78.exe soz61Nc21.exe PID 2072 wrote to memory of 4496 2072 sxF46am78.exe soz61Nc21.exe PID 2072 wrote to memory of 4496 2072 sxF46am78.exe soz61Nc21.exe PID 4496 wrote to memory of 4500 4496 soz61Nc21.exe sZf57lJ67.exe PID 4496 wrote to memory of 4500 4496 soz61Nc21.exe sZf57lJ67.exe PID 4496 wrote to memory of 4500 4496 soz61Nc21.exe sZf57lJ67.exe PID 4500 wrote to memory of 5056 4500 sZf57lJ67.exe iuv99ZS.exe PID 4500 wrote to memory of 5056 4500 sZf57lJ67.exe iuv99ZS.exe PID 4500 wrote to memory of 4244 4500 sZf57lJ67.exe kme28RL.exe PID 4500 wrote to memory of 4244 4500 sZf57lJ67.exe kme28RL.exe PID 4500 wrote to memory of 4244 4500 sZf57lJ67.exe kme28RL.exe PID 4496 wrote to memory of 2024 4496 soz61Nc21.exe mBy36kE.exe PID 4496 wrote to memory of 2024 4496 soz61Nc21.exe mBy36kE.exe PID 4496 wrote to memory of 2024 4496 soz61Nc21.exe mBy36kE.exe PID 2072 wrote to memory of 2896 2072 sxF46am78.exe nsM91iO53.exe PID 2072 wrote to memory of 2896 2072 sxF46am78.exe nsM91iO53.exe PID 2072 wrote to memory of 2896 2072 sxF46am78.exe nsM91iO53.exe PID 2672 wrote to memory of 1332 2672 sxW36oT69.exe oPb73xO.exe PID 2672 wrote to memory of 1332 2672 sxW36oT69.exe oPb73xO.exe PID 2672 wrote to memory of 1332 2672 sxW36oT69.exe oPb73xO.exe PID 4640 wrote to memory of 4328 4640 1cb1ab3718b08953c99cb4bf4b7e48e1.exe rsA73Pj.exe PID 4640 wrote to memory of 4328 4640 1cb1ab3718b08953c99cb4bf4b7e48e1.exe rsA73Pj.exe PID 4640 wrote to memory of 4328 4640 1cb1ab3718b08953c99cb4bf4b7e48e1.exe rsA73Pj.exe PID 4328 wrote to memory of 3968 4328 rsA73Pj.exe mnolyk.exe PID 4328 wrote to memory of 3968 4328 rsA73Pj.exe mnolyk.exe PID 4328 wrote to memory of 3968 4328 rsA73Pj.exe mnolyk.exe PID 3968 wrote to memory of 2388 3968 mnolyk.exe schtasks.exe PID 3968 wrote to memory of 2388 3968 mnolyk.exe schtasks.exe PID 3968 wrote to memory of 2388 3968 mnolyk.exe schtasks.exe PID 3968 wrote to memory of 1416 3968 mnolyk.exe cmd.exe PID 3968 wrote to memory of 1416 3968 mnolyk.exe cmd.exe PID 3968 wrote to memory of 1416 3968 mnolyk.exe cmd.exe PID 1416 wrote to memory of 4844 1416 cmd.exe cmd.exe PID 1416 wrote to memory of 4844 1416 cmd.exe cmd.exe PID 1416 wrote to memory of 4844 1416 cmd.exe cmd.exe PID 1416 wrote to memory of 3712 1416 cmd.exe cacls.exe PID 1416 wrote to memory of 3712 1416 cmd.exe cacls.exe PID 1416 wrote to memory of 3712 1416 cmd.exe cacls.exe PID 1416 wrote to memory of 2512 1416 cmd.exe cacls.exe PID 1416 wrote to memory of 2512 1416 cmd.exe cacls.exe PID 1416 wrote to memory of 2512 1416 cmd.exe cacls.exe PID 1416 wrote to memory of 1372 1416 cmd.exe cmd.exe PID 1416 wrote to memory of 1372 1416 cmd.exe cmd.exe PID 1416 wrote to memory of 1372 1416 cmd.exe cmd.exe PID 1416 wrote to memory of 5036 1416 cmd.exe cacls.exe PID 1416 wrote to memory of 5036 1416 cmd.exe cacls.exe PID 1416 wrote to memory of 5036 1416 cmd.exe cacls.exe PID 1416 wrote to memory of 64 1416 cmd.exe cacls.exe PID 1416 wrote to memory of 64 1416 cmd.exe cacls.exe PID 1416 wrote to memory of 64 1416 cmd.exe cacls.exe PID 3968 wrote to memory of 2768 3968 mnolyk.exe rundll32.exe PID 3968 wrote to memory of 2768 3968 mnolyk.exe rundll32.exe PID 3968 wrote to memory of 2768 3968 mnolyk.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cb1ab3718b08953c99cb4bf4b7e48e1.exe"C:\Users\Admin\AppData\Local\Temp\1cb1ab3718b08953c99cb4bf4b7e48e1.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sxW36oT69.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sxW36oT69.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxF46am78.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxF46am78.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\soz61Nc21.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\soz61Nc21.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sZf57lJ67.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sZf57lJ67.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iuv99ZS.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iuv99ZS.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kme28RL.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kme28RL.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 13327⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mBy36kE.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mBy36kE.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2024 -s 10926⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nsM91iO53.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nsM91iO53.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2896 -s 13205⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oPb73xO.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oPb73xO.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rsA73Pj.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rsA73Pj.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4f9dd6f8a7" /P "Admin:N"&&CACLS "..\4f9dd6f8a7" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4f9dd6f8a7" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4f9dd6f8a7" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4244 -ip 42441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2024 -ip 20241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2896 -ip 28961⤵
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rsA73Pj.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rsA73Pj.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sxW36oT69.exeFilesize
1.0MB
MD5a5b4daa646e162ff0ee21f0898eeb3b4
SHA17b6d7e124ae66b820b4627c5b20ccbaa5fc61055
SHA256c19ee3fb26f2ef45bfcf42331cf54bbeaad4eeabaf725e30df7531ae2edcfc36
SHA512192190a88d1a61f566b18a8cd241d140a177f1530bd70e0285e97e4e0062d2ec2e53b1ad1b84b4d8ba8064794c5a9b232d65895410df3ead601b0738da7819b7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sxW36oT69.exeFilesize
1.0MB
MD5a5b4daa646e162ff0ee21f0898eeb3b4
SHA17b6d7e124ae66b820b4627c5b20ccbaa5fc61055
SHA256c19ee3fb26f2ef45bfcf42331cf54bbeaad4eeabaf725e30df7531ae2edcfc36
SHA512192190a88d1a61f566b18a8cd241d140a177f1530bd70e0285e97e4e0062d2ec2e53b1ad1b84b4d8ba8064794c5a9b232d65895410df3ead601b0738da7819b7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oPb73xO.exeFilesize
175KB
MD52ca336ffac2e58e59bf4ba497e146fd7
SHA1ab8ebd53709abd15fd7d1df9dd91cbfbecb3ef14
SHA2568a07fc51578589686a864b2d74ac3c1b02a9ceee8f8a20d432832228d9665459
SHA5123a42bf9db2ec8fb1851a61e81d93a3a92765036f5aa768a228f8b6988de18a03259e1886c6d87c3549163e8a6c73b69479a3c35f49a87d332a37718d928c5d4b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oPb73xO.exeFilesize
175KB
MD52ca336ffac2e58e59bf4ba497e146fd7
SHA1ab8ebd53709abd15fd7d1df9dd91cbfbecb3ef14
SHA2568a07fc51578589686a864b2d74ac3c1b02a9ceee8f8a20d432832228d9665459
SHA5123a42bf9db2ec8fb1851a61e81d93a3a92765036f5aa768a228f8b6988de18a03259e1886c6d87c3549163e8a6c73b69479a3c35f49a87d332a37718d928c5d4b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxF46am78.exeFilesize
885KB
MD5fbc39d98b21c57bb23c712cc56a82b89
SHA1fb0f08cf5e967cea01e43d43444e1253b04e79c3
SHA256076c5d2a1a3a8cf7bf1c9c93d6239dba40b9b750d478f5995fde4943b97f5e78
SHA512ebae782cf96d3098dda03ca18737f48c83a1555800bf8564a5bd5530a0077ef67e83e3df7adaf3badd7385d2272f9d500bf1110a658ce87becba96cdfae52718
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\sxF46am78.exeFilesize
885KB
MD5fbc39d98b21c57bb23c712cc56a82b89
SHA1fb0f08cf5e967cea01e43d43444e1253b04e79c3
SHA256076c5d2a1a3a8cf7bf1c9c93d6239dba40b9b750d478f5995fde4943b97f5e78
SHA512ebae782cf96d3098dda03ca18737f48c83a1555800bf8564a5bd5530a0077ef67e83e3df7adaf3badd7385d2272f9d500bf1110a658ce87becba96cdfae52718
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nsM91iO53.exeFilesize
301KB
MD546a350ec17aa05c9f49e6b14baca36c1
SHA1d34a3d5526ca215f5f099ac3bbd626c4ec038110
SHA2565fb168bb6fb8907a04c177b5ac06bc9e79d6d7e17a0d397421b2b4833f548cf9
SHA512a7e953db834fd2b702f6147c585b506481c56bf5fd26eb70785f7aa1d6a41cc47c3466092778b64c6c98453ef92be6315397dcaa7f7c2f276b38d0ef2c0ac8d2
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\nsM91iO53.exeFilesize
301KB
MD546a350ec17aa05c9f49e6b14baca36c1
SHA1d34a3d5526ca215f5f099ac3bbd626c4ec038110
SHA2565fb168bb6fb8907a04c177b5ac06bc9e79d6d7e17a0d397421b2b4833f548cf9
SHA512a7e953db834fd2b702f6147c585b506481c56bf5fd26eb70785f7aa1d6a41cc47c3466092778b64c6c98453ef92be6315397dcaa7f7c2f276b38d0ef2c0ac8d2
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\soz61Nc21.exeFilesize
662KB
MD5b8f21f99e3c85d79de7681839457e4df
SHA17bf51bff283c4a7f440244bb6ea8168c8a4717e6
SHA256bf36acde8c2168300e7dd380a5fc5e60cea52c4c325ee1faab07fa27e7a156bc
SHA512c75cecae0c5d99bd9a1bff421d59fc81b6d1158f81943da91b2fb31fe4306509c6e431f651138e96038448510b05b151b04dd870997263e3c880330cee6c9fa6
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\soz61Nc21.exeFilesize
662KB
MD5b8f21f99e3c85d79de7681839457e4df
SHA17bf51bff283c4a7f440244bb6ea8168c8a4717e6
SHA256bf36acde8c2168300e7dd380a5fc5e60cea52c4c325ee1faab07fa27e7a156bc
SHA512c75cecae0c5d99bd9a1bff421d59fc81b6d1158f81943da91b2fb31fe4306509c6e431f651138e96038448510b05b151b04dd870997263e3c880330cee6c9fa6
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mBy36kE.exeFilesize
243KB
MD59480a15f56f6b9a481ffc03118cf1a78
SHA11ad5070d31e67439a6b1204e94df28394d50c2b2
SHA256a2aec4a50763d9996238b4118393045f47ef7262acfc476d58402a53621f75ac
SHA512dd07b4b9412436bdd7c557d6d690b9db61595fd310d4750cab4d3f41b48f2524666454f9de6f2009b0d318ce4b2e4aa0d59167fe8fbab2a5a6e4ad8202cf04c8
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mBy36kE.exeFilesize
243KB
MD59480a15f56f6b9a481ffc03118cf1a78
SHA11ad5070d31e67439a6b1204e94df28394d50c2b2
SHA256a2aec4a50763d9996238b4118393045f47ef7262acfc476d58402a53621f75ac
SHA512dd07b4b9412436bdd7c557d6d690b9db61595fd310d4750cab4d3f41b48f2524666454f9de6f2009b0d318ce4b2e4aa0d59167fe8fbab2a5a6e4ad8202cf04c8
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sZf57lJ67.exeFilesize
389KB
MD59c32ef3882afb90b292b3f12ff14d22f
SHA10336d24f456128752bd7d1d7b0e69f65685b34e8
SHA2562e2e042f96029a2e92971a89c92aa410eb77f8d1d6070493247034c36dfc1045
SHA5120c2003c9c1c761999a1634013138bae655b7fcfb1e149aa8b5235398a9c1f49cf386886d8fb8b0528cb0b68612a1c8a63acb44af62572bba4e0e1e07d5ac129f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sZf57lJ67.exeFilesize
389KB
MD59c32ef3882afb90b292b3f12ff14d22f
SHA10336d24f456128752bd7d1d7b0e69f65685b34e8
SHA2562e2e042f96029a2e92971a89c92aa410eb77f8d1d6070493247034c36dfc1045
SHA5120c2003c9c1c761999a1634013138bae655b7fcfb1e149aa8b5235398a9c1f49cf386886d8fb8b0528cb0b68612a1c8a63acb44af62572bba4e0e1e07d5ac129f
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iuv99ZS.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iuv99ZS.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kme28RL.exeFilesize
301KB
MD546a350ec17aa05c9f49e6b14baca36c1
SHA1d34a3d5526ca215f5f099ac3bbd626c4ec038110
SHA2565fb168bb6fb8907a04c177b5ac06bc9e79d6d7e17a0d397421b2b4833f548cf9
SHA512a7e953db834fd2b702f6147c585b506481c56bf5fd26eb70785f7aa1d6a41cc47c3466092778b64c6c98453ef92be6315397dcaa7f7c2f276b38d0ef2c0ac8d2
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kme28RL.exeFilesize
301KB
MD546a350ec17aa05c9f49e6b14baca36c1
SHA1d34a3d5526ca215f5f099ac3bbd626c4ec038110
SHA2565fb168bb6fb8907a04c177b5ac06bc9e79d6d7e17a0d397421b2b4833f548cf9
SHA512a7e953db834fd2b702f6147c585b506481c56bf5fd26eb70785f7aa1d6a41cc47c3466092778b64c6c98453ef92be6315397dcaa7f7c2f276b38d0ef2c0ac8d2
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kme28RL.exeFilesize
301KB
MD546a350ec17aa05c9f49e6b14baca36c1
SHA1d34a3d5526ca215f5f099ac3bbd626c4ec038110
SHA2565fb168bb6fb8907a04c177b5ac06bc9e79d6d7e17a0d397421b2b4833f548cf9
SHA512a7e953db834fd2b702f6147c585b506481c56bf5fd26eb70785f7aa1d6a41cc47c3466092778b64c6c98453ef92be6315397dcaa7f7c2f276b38d0ef2c0ac8d2
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5937b902b8ad05afb922313d2341143f4
SHA1b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1
SHA256f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849
SHA51291f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5937b902b8ad05afb922313d2341143f4
SHA1b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1
SHA256f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849
SHA51291f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5937b902b8ad05afb922313d2341143f4
SHA1b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1
SHA256f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849
SHA51291f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1332-2065-0x0000000000D30000-0x0000000000D62000-memory.dmpFilesize
200KB
-
memory/1332-2066-0x0000000005950000-0x0000000005960000-memory.dmpFilesize
64KB
-
memory/2024-1141-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2024-1143-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2024-1142-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2024-1138-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2024-1137-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2024-1136-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2024-1135-0x0000000000590000-0x00000000005BD000-memory.dmpFilesize
180KB
-
memory/2896-1807-0x0000000002600000-0x0000000002610000-memory.dmpFilesize
64KB
-
memory/2896-1808-0x0000000002600000-0x0000000002610000-memory.dmpFilesize
64KB
-
memory/2896-1810-0x0000000002600000-0x0000000002610000-memory.dmpFilesize
64KB
-
memory/2896-2058-0x0000000002600000-0x0000000002610000-memory.dmpFilesize
64KB
-
memory/4244-188-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-220-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-228-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-230-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-232-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-234-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-236-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-238-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-240-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-242-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-1085-0x00000000052E0000-0x00000000058F8000-memory.dmpFilesize
6.1MB
-
memory/4244-1086-0x0000000005980000-0x0000000005A8A000-memory.dmpFilesize
1.0MB
-
memory/4244-1087-0x0000000005AC0000-0x0000000005AD2000-memory.dmpFilesize
72KB
-
memory/4244-1088-0x0000000005AE0000-0x0000000005B1C000-memory.dmpFilesize
240KB
-
memory/4244-1089-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4244-1091-0x0000000005DD0000-0x0000000005E36000-memory.dmpFilesize
408KB
-
memory/4244-1092-0x0000000006490000-0x0000000006522000-memory.dmpFilesize
584KB
-
memory/4244-1093-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4244-1094-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4244-1095-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4244-1096-0x0000000006670000-0x00000000066E6000-memory.dmpFilesize
472KB
-
memory/4244-1097-0x0000000006700000-0x0000000006750000-memory.dmpFilesize
320KB
-
memory/4244-1098-0x0000000006780000-0x0000000006942000-memory.dmpFilesize
1.8MB
-
memory/4244-1099-0x0000000006950000-0x0000000006E7C000-memory.dmpFilesize
5.2MB
-
memory/4244-1101-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4244-224-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-222-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-226-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-218-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-216-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-214-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-212-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-210-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-208-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-206-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-204-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-202-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-196-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-200-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-198-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-194-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-192-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-190-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-186-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-180-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-184-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-182-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-179-0x0000000005240000-0x000000000527E000-memory.dmpFilesize
248KB
-
memory/4244-176-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4244-178-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4244-177-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4244-175-0x00000000005A0000-0x00000000005EB000-memory.dmpFilesize
300KB
-
memory/4244-174-0x0000000004C40000-0x00000000051E4000-memory.dmpFilesize
5.6MB
-
memory/5056-168-0x0000000000080000-0x000000000008A000-memory.dmpFilesize
40KB