Analysis
-
max time kernel
115s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-02-2023 09:04
Static task
static1
General
-
Target
7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exe
-
Size
1.2MB
-
MD5
5a9e4badd5d125446da63bf754efac64
-
SHA1
48ef880aacffeea83508297cd3801ab7422fab5e
-
SHA256
7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727
-
SHA512
afb5014c2f75938f737b3d21e5ca16e8985ee34965ba282406e9a321f134e587337a51d9ea7bb2772a3c3def97cf3a8e01c090e53d4ea6f292485b4211705c6e
-
SSDEEP
24576:CyUufpPIAj/Mj5tU3GEftI7XSrq/tQjsxmfqRKnAoyVpc:pJfXMj820tIDSWVQjqmSUAr
Malware Config
Extracted
redline
ronur
193.233.20.20:4134
-
auth_value
f88f86755a528d4b25f6f3628c460965
Extracted
redline
funka
193.233.20.20:4134
-
auth_value
cdb395608d7ec633dce3d2f0c7fb0741
Extracted
amadey
3.67
193.233.20.15/dF30Hn4m/index.php
Signatures
-
Processes:
mUe98Dx.exeiBk92xE.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection mUe98Dx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" mUe98Dx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" mUe98Dx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" mUe98Dx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection iBk92xE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" iBk92xE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" iBk92xE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" iBk92xE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" mUe98Dx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" iBk92xE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" iBk92xE.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" mUe98Dx.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/1264-179-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-180-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-182-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-184-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-186-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-188-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-190-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-192-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-194-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-196-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-198-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-200-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-202-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-204-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-206-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-208-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-210-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-212-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-214-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-216-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-218-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-220-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-222-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-224-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-226-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-228-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-230-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-232-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-234-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-236-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-238-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-240-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/1264-242-0x0000000005230000-0x000000000526E000-memory.dmp family_redline behavioral1/memory/3980-1248-0x0000000004CC0000-0x0000000004CD0000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
riu67YF.exemnolyk.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation riu67YF.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation mnolyk.exe -
Executes dropped EXE 12 IoCs
Processes:
sDv52Sw27.exesaq94HB91.exesqc87ji40.exesxg11Ux85.exeiBk92xE.exekmC04Cd.exemUe98Dx.exeneU77Ay62.exeoaa92iY.exeriu67YF.exemnolyk.exemnolyk.exepid process 3176 sDv52Sw27.exe 4432 saq94HB91.exe 1248 sqc87ji40.exe 3300 sxg11Ux85.exe 1820 iBk92xE.exe 1264 kmC04Cd.exe 4104 mUe98Dx.exe 3980 neU77Ay62.exe 1920 oaa92iY.exe 4388 riu67YF.exe 2820 mnolyk.exe 5048 mnolyk.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 5032 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
iBk92xE.exemUe98Dx.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" iBk92xE.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features mUe98Dx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" mUe98Dx.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exesaq94HB91.exesqc87ji40.exesxg11Ux85.exesDv52Sw27.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce saq94HB91.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" sqc87ji40.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" saq94HB91.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sqc87ji40.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sxg11Ux85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" sxg11Ux85.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce sDv52Sw27.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" sDv52Sw27.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2848 1264 WerFault.exe kmC04Cd.exe 4460 4104 WerFault.exe mUe98Dx.exe 2400 3980 WerFault.exe neU77Ay62.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
iBk92xE.exekmC04Cd.exemUe98Dx.exeneU77Ay62.exeoaa92iY.exepid process 1820 iBk92xE.exe 1820 iBk92xE.exe 1264 kmC04Cd.exe 1264 kmC04Cd.exe 4104 mUe98Dx.exe 4104 mUe98Dx.exe 3980 neU77Ay62.exe 3980 neU77Ay62.exe 1920 oaa92iY.exe 1920 oaa92iY.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
iBk92xE.exekmC04Cd.exemUe98Dx.exeneU77Ay62.exeoaa92iY.exedescription pid process Token: SeDebugPrivilege 1820 iBk92xE.exe Token: SeDebugPrivilege 1264 kmC04Cd.exe Token: SeDebugPrivilege 4104 mUe98Dx.exe Token: SeDebugPrivilege 3980 neU77Ay62.exe Token: SeDebugPrivilege 1920 oaa92iY.exe -
Suspicious use of WriteProcessMemory 59 IoCs
Processes:
7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exesDv52Sw27.exesaq94HB91.exesqc87ji40.exesxg11Ux85.exeriu67YF.exemnolyk.execmd.exedescription pid process target process PID 1460 wrote to memory of 3176 1460 7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exe sDv52Sw27.exe PID 1460 wrote to memory of 3176 1460 7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exe sDv52Sw27.exe PID 1460 wrote to memory of 3176 1460 7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exe sDv52Sw27.exe PID 3176 wrote to memory of 4432 3176 sDv52Sw27.exe saq94HB91.exe PID 3176 wrote to memory of 4432 3176 sDv52Sw27.exe saq94HB91.exe PID 3176 wrote to memory of 4432 3176 sDv52Sw27.exe saq94HB91.exe PID 4432 wrote to memory of 1248 4432 saq94HB91.exe sqc87ji40.exe PID 4432 wrote to memory of 1248 4432 saq94HB91.exe sqc87ji40.exe PID 4432 wrote to memory of 1248 4432 saq94HB91.exe sqc87ji40.exe PID 1248 wrote to memory of 3300 1248 sqc87ji40.exe sxg11Ux85.exe PID 1248 wrote to memory of 3300 1248 sqc87ji40.exe sxg11Ux85.exe PID 1248 wrote to memory of 3300 1248 sqc87ji40.exe sxg11Ux85.exe PID 3300 wrote to memory of 1820 3300 sxg11Ux85.exe iBk92xE.exe PID 3300 wrote to memory of 1820 3300 sxg11Ux85.exe iBk92xE.exe PID 3300 wrote to memory of 1264 3300 sxg11Ux85.exe kmC04Cd.exe PID 3300 wrote to memory of 1264 3300 sxg11Ux85.exe kmC04Cd.exe PID 3300 wrote to memory of 1264 3300 sxg11Ux85.exe kmC04Cd.exe PID 1248 wrote to memory of 4104 1248 sqc87ji40.exe mUe98Dx.exe PID 1248 wrote to memory of 4104 1248 sqc87ji40.exe mUe98Dx.exe PID 1248 wrote to memory of 4104 1248 sqc87ji40.exe mUe98Dx.exe PID 4432 wrote to memory of 3980 4432 saq94HB91.exe neU77Ay62.exe PID 4432 wrote to memory of 3980 4432 saq94HB91.exe neU77Ay62.exe PID 4432 wrote to memory of 3980 4432 saq94HB91.exe neU77Ay62.exe PID 3176 wrote to memory of 1920 3176 sDv52Sw27.exe oaa92iY.exe PID 3176 wrote to memory of 1920 3176 sDv52Sw27.exe oaa92iY.exe PID 3176 wrote to memory of 1920 3176 sDv52Sw27.exe oaa92iY.exe PID 1460 wrote to memory of 4388 1460 7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exe riu67YF.exe PID 1460 wrote to memory of 4388 1460 7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exe riu67YF.exe PID 1460 wrote to memory of 4388 1460 7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exe riu67YF.exe PID 4388 wrote to memory of 2820 4388 riu67YF.exe mnolyk.exe PID 4388 wrote to memory of 2820 4388 riu67YF.exe mnolyk.exe PID 4388 wrote to memory of 2820 4388 riu67YF.exe mnolyk.exe PID 2820 wrote to memory of 4828 2820 mnolyk.exe schtasks.exe PID 2820 wrote to memory of 4828 2820 mnolyk.exe schtasks.exe PID 2820 wrote to memory of 4828 2820 mnolyk.exe schtasks.exe PID 2820 wrote to memory of 2040 2820 mnolyk.exe cmd.exe PID 2820 wrote to memory of 2040 2820 mnolyk.exe cmd.exe PID 2820 wrote to memory of 2040 2820 mnolyk.exe cmd.exe PID 2040 wrote to memory of 244 2040 cmd.exe cmd.exe PID 2040 wrote to memory of 244 2040 cmd.exe cmd.exe PID 2040 wrote to memory of 244 2040 cmd.exe cmd.exe PID 2040 wrote to memory of 1952 2040 cmd.exe cacls.exe PID 2040 wrote to memory of 1952 2040 cmd.exe cacls.exe PID 2040 wrote to memory of 1952 2040 cmd.exe cacls.exe PID 2040 wrote to memory of 4280 2040 cmd.exe cacls.exe PID 2040 wrote to memory of 4280 2040 cmd.exe cacls.exe PID 2040 wrote to memory of 4280 2040 cmd.exe cacls.exe PID 2040 wrote to memory of 3772 2040 cmd.exe cmd.exe PID 2040 wrote to memory of 3772 2040 cmd.exe cmd.exe PID 2040 wrote to memory of 3772 2040 cmd.exe cmd.exe PID 2040 wrote to memory of 3276 2040 cmd.exe cacls.exe PID 2040 wrote to memory of 3276 2040 cmd.exe cacls.exe PID 2040 wrote to memory of 3276 2040 cmd.exe cacls.exe PID 2040 wrote to memory of 4580 2040 cmd.exe cacls.exe PID 2040 wrote to memory of 4580 2040 cmd.exe cacls.exe PID 2040 wrote to memory of 4580 2040 cmd.exe cacls.exe PID 2820 wrote to memory of 5032 2820 mnolyk.exe rundll32.exe PID 2820 wrote to memory of 5032 2820 mnolyk.exe rundll32.exe PID 2820 wrote to memory of 5032 2820 mnolyk.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exe"C:\Users\Admin\AppData\Local\Temp\7bd20ce8e217d92d1426d989419e99b4a7f2ee7f82a67a48e5eff465c2192727.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sDv52Sw27.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sDv52Sw27.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\saq94HB91.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\saq94HB91.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sqc87ji40.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sqc87ji40.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sxg11Ux85.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sxg11Ux85.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iBk92xE.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iBk92xE.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kmC04Cd.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kmC04Cd.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1264 -s 13607⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mUe98Dx.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mUe98Dx.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 10926⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\neU77Ay62.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\neU77Ay62.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 13405⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oaa92iY.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oaa92iY.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\riu67YF.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\riu67YF.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe"C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR "C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "mnolyk.exe" /P "Admin:N"&&CACLS "mnolyk.exe" /P "Admin:R" /E&&echo Y|CACLS "..\4f9dd6f8a7" /P "Admin:N"&&CACLS "..\4f9dd6f8a7" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "mnolyk.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4f9dd6f8a7" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\4f9dd6f8a7" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1264 -ip 12641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4104 -ip 41041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3980 -ip 39801⤵
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeC:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\4f9dd6f8a7\mnolyk.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\riu67YF.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\riu67YF.exeFilesize
239KB
MD50179181b2d4a5bb1346b67a4be5ef57c
SHA1556750988b21379fd24e18b31e6cf14f36bf9e99
SHA2560a763637206a70a3ec6707fe5728ea673ae3bc11eb5e059d962e99dcc3991f31
SHA5121adaab4993ec3d1e32b9cc780ab17b5a6acfe352789aaf2872e91bef738dd5aca3115071ac42a21c4fd19a82a522b515243ebef340249115cfbe6951cb3c9cee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sDv52Sw27.exeFilesize
1.1MB
MD5081b4b1e52ce3c29059b90f10c47c8f6
SHA1e8ba0cf5b3d6b8ba198c7daf5d43aad9822e23e5
SHA256d107439a66fb68acf0477ce63ac56f71e2f4c2627bbc45737f187a2908546702
SHA5124b74576aa63301eb6bd970df10b53add427e4fec9de67115c9c5471cee40a8c8c1437766059062451f6bfe73c6b83ae57ca5189925a38926e33df60b5b2b9688
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\sDv52Sw27.exeFilesize
1.1MB
MD5081b4b1e52ce3c29059b90f10c47c8f6
SHA1e8ba0cf5b3d6b8ba198c7daf5d43aad9822e23e5
SHA256d107439a66fb68acf0477ce63ac56f71e2f4c2627bbc45737f187a2908546702
SHA5124b74576aa63301eb6bd970df10b53add427e4fec9de67115c9c5471cee40a8c8c1437766059062451f6bfe73c6b83ae57ca5189925a38926e33df60b5b2b9688
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oaa92iY.exeFilesize
175KB
MD52ca336ffac2e58e59bf4ba497e146fd7
SHA1ab8ebd53709abd15fd7d1df9dd91cbfbecb3ef14
SHA2568a07fc51578589686a864b2d74ac3c1b02a9ceee8f8a20d432832228d9665459
SHA5123a42bf9db2ec8fb1851a61e81d93a3a92765036f5aa768a228f8b6988de18a03259e1886c6d87c3549163e8a6c73b69479a3c35f49a87d332a37718d928c5d4b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\oaa92iY.exeFilesize
175KB
MD52ca336ffac2e58e59bf4ba497e146fd7
SHA1ab8ebd53709abd15fd7d1df9dd91cbfbecb3ef14
SHA2568a07fc51578589686a864b2d74ac3c1b02a9ceee8f8a20d432832228d9665459
SHA5123a42bf9db2ec8fb1851a61e81d93a3a92765036f5aa768a228f8b6988de18a03259e1886c6d87c3549163e8a6c73b69479a3c35f49a87d332a37718d928c5d4b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\saq94HB91.exeFilesize
950KB
MD5ae9d5f54b077ad27ee3d6417c4ad0388
SHA14b252ba65d919c5e3671f3c65bf938bb689cb04d
SHA25627cb2b75f9791d0d46b391f4301349c928b45ed84b35c34113ecf35856f4e3b7
SHA5124007719ecdb7e3a2d792fbb0b999474bab135cc93369d453ed28ee7e2d406046c8b6c469834225720b54a38d8d4d64fb3e4036e2f703496d3fab765c83cec4f7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\saq94HB91.exeFilesize
950KB
MD5ae9d5f54b077ad27ee3d6417c4ad0388
SHA14b252ba65d919c5e3671f3c65bf938bb689cb04d
SHA25627cb2b75f9791d0d46b391f4301349c928b45ed84b35c34113ecf35856f4e3b7
SHA5124007719ecdb7e3a2d792fbb0b999474bab135cc93369d453ed28ee7e2d406046c8b6c469834225720b54a38d8d4d64fb3e4036e2f703496d3fab765c83cec4f7
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\neU77Ay62.exeFilesize
318KB
MD5e4f88c8bb3ab557c1d81538d0502a383
SHA1a166ee437dd19429a8cf6305193ca6a6aae95a1f
SHA256393774bea391742496d0d25d96eaeb5208a479bac33b82514df4af2070bdae7d
SHA512691d4366d6f6ad181a652486d4559e50507e7f7bf8fb114c54316f0b5f005a1fbc8d8fed8f0b51d02c6ef94eee8c3c5a7b973f61d49b01f3bf2f057610e896de
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\neU77Ay62.exeFilesize
318KB
MD5e4f88c8bb3ab557c1d81538d0502a383
SHA1a166ee437dd19429a8cf6305193ca6a6aae95a1f
SHA256393774bea391742496d0d25d96eaeb5208a479bac33b82514df4af2070bdae7d
SHA512691d4366d6f6ad181a652486d4559e50507e7f7bf8fb114c54316f0b5f005a1fbc8d8fed8f0b51d02c6ef94eee8c3c5a7b973f61d49b01f3bf2f057610e896de
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sqc87ji40.exeFilesize
676KB
MD5c4ca559b2da132dbf70a5fe39782076e
SHA1a2e411e75643d94840a9618aee9466f7db3ef5ae
SHA256114b20fed91b7cb962d90efccd6d246d35cdf3cba018e9ec0b151a1598d8c935
SHA5128a435cd008e4917e7c428be6e1b8aaa271734b9a5c2e4ee3e8ac86762bd2d30e74e19024358cfd48aff85764fa8def000166396cd306dc9ed68e1cde2387d85a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\sqc87ji40.exeFilesize
676KB
MD5c4ca559b2da132dbf70a5fe39782076e
SHA1a2e411e75643d94840a9618aee9466f7db3ef5ae
SHA256114b20fed91b7cb962d90efccd6d246d35cdf3cba018e9ec0b151a1598d8c935
SHA5128a435cd008e4917e7c428be6e1b8aaa271734b9a5c2e4ee3e8ac86762bd2d30e74e19024358cfd48aff85764fa8def000166396cd306dc9ed68e1cde2387d85a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mUe98Dx.exeFilesize
260KB
MD5175c5d55fc3ea448c13119e807034f5f
SHA1df96c8b490dd36bac2e067238c1ebd87216a1835
SHA2569912d8b1aa4df6602c92f9ed5066106a0f3a6437e7c483d59c1eae0c477a7d93
SHA5121ac2e4fc353c6e9f06066158efeeb2c4c3a4a984ca71cd58adcab8e69ee6485197a69db497c7f3cffaebd342792de8d258fd5a50dccd8b8be8c2fbf6de6fdf81
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\mUe98Dx.exeFilesize
260KB
MD5175c5d55fc3ea448c13119e807034f5f
SHA1df96c8b490dd36bac2e067238c1ebd87216a1835
SHA2569912d8b1aa4df6602c92f9ed5066106a0f3a6437e7c483d59c1eae0c477a7d93
SHA5121ac2e4fc353c6e9f06066158efeeb2c4c3a4a984ca71cd58adcab8e69ee6485197a69db497c7f3cffaebd342792de8d258fd5a50dccd8b8be8c2fbf6de6fdf81
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sxg11Ux85.exeFilesize
396KB
MD51bcedd5ab816eb707ede7df01c9c86e7
SHA18de9b7d5607717546e18ada170666ea637f5165b
SHA2567aca51627a6f4acc42bcc763216b06e307baefcf51ab1490e185b01d4fe62282
SHA5124ee860e77091598b6950d117787feb8d76449bf9a4218b82ef84eee11d5550447080a7cec030b6db02ab0d9948755fc18e8c78ac2a61312d2915fd5c5377da60
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\sxg11Ux85.exeFilesize
396KB
MD51bcedd5ab816eb707ede7df01c9c86e7
SHA18de9b7d5607717546e18ada170666ea637f5165b
SHA2567aca51627a6f4acc42bcc763216b06e307baefcf51ab1490e185b01d4fe62282
SHA5124ee860e77091598b6950d117787feb8d76449bf9a4218b82ef84eee11d5550447080a7cec030b6db02ab0d9948755fc18e8c78ac2a61312d2915fd5c5377da60
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iBk92xE.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\iBk92xE.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kmC04Cd.exeFilesize
318KB
MD5e4f88c8bb3ab557c1d81538d0502a383
SHA1a166ee437dd19429a8cf6305193ca6a6aae95a1f
SHA256393774bea391742496d0d25d96eaeb5208a479bac33b82514df4af2070bdae7d
SHA512691d4366d6f6ad181a652486d4559e50507e7f7bf8fb114c54316f0b5f005a1fbc8d8fed8f0b51d02c6ef94eee8c3c5a7b973f61d49b01f3bf2f057610e896de
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kmC04Cd.exeFilesize
318KB
MD5e4f88c8bb3ab557c1d81538d0502a383
SHA1a166ee437dd19429a8cf6305193ca6a6aae95a1f
SHA256393774bea391742496d0d25d96eaeb5208a479bac33b82514df4af2070bdae7d
SHA512691d4366d6f6ad181a652486d4559e50507e7f7bf8fb114c54316f0b5f005a1fbc8d8fed8f0b51d02c6ef94eee8c3c5a7b973f61d49b01f3bf2f057610e896de
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\kmC04Cd.exeFilesize
318KB
MD5e4f88c8bb3ab557c1d81538d0502a383
SHA1a166ee437dd19429a8cf6305193ca6a6aae95a1f
SHA256393774bea391742496d0d25d96eaeb5208a479bac33b82514df4af2070bdae7d
SHA512691d4366d6f6ad181a652486d4559e50507e7f7bf8fb114c54316f0b5f005a1fbc8d8fed8f0b51d02c6ef94eee8c3c5a7b973f61d49b01f3bf2f057610e896de
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5937b902b8ad05afb922313d2341143f4
SHA1b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1
SHA256f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849
SHA51291f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5937b902b8ad05afb922313d2341143f4
SHA1b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1
SHA256f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849
SHA51291f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5937b902b8ad05afb922313d2341143f4
SHA1b48d5579e01000cdb3c3ef4e1ad1b97d2056a8b1
SHA256f0f0e7ab301101e6473f1dbcadd2272468af036195685c0ae51c9d90c40f0849
SHA51291f67248e47b2fced9ff802370ced4e0de675d06e7ef32acd40a479fecfe8b912dfb2abf76cb8b391f471d8dd134b5f041186541a8038ef84219c852f31f37ff
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1264-232-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-1094-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1264-198-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-200-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-202-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-204-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-206-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-208-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-210-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-212-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-214-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-216-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-218-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-220-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-222-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-224-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-226-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-228-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-230-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-194-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-234-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-236-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-238-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-240-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-242-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-1085-0x00000000052D0000-0x00000000058E8000-memory.dmpFilesize
6.1MB
-
memory/1264-1086-0x0000000005970000-0x0000000005A7A000-memory.dmpFilesize
1.0MB
-
memory/1264-1087-0x0000000005AB0000-0x0000000005AC2000-memory.dmpFilesize
72KB
-
memory/1264-1088-0x0000000005AD0000-0x0000000005B0C000-memory.dmpFilesize
240KB
-
memory/1264-1089-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1264-1091-0x0000000005DC0000-0x0000000005E52000-memory.dmpFilesize
584KB
-
memory/1264-1092-0x0000000005E60000-0x0000000005EC6000-memory.dmpFilesize
408KB
-
memory/1264-1093-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1264-196-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-1095-0x0000000006570000-0x00000000065E6000-memory.dmpFilesize
472KB
-
memory/1264-1096-0x00000000065F0000-0x0000000006640000-memory.dmpFilesize
320KB
-
memory/1264-1097-0x00000000079D0000-0x0000000007B92000-memory.dmpFilesize
1.8MB
-
memory/1264-1098-0x0000000007BA0000-0x00000000080CC000-memory.dmpFilesize
5.2MB
-
memory/1264-1099-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1264-174-0x0000000004C80000-0x0000000005224000-memory.dmpFilesize
5.6MB
-
memory/1264-176-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1264-175-0x0000000000680000-0x00000000006CB000-memory.dmpFilesize
300KB
-
memory/1264-177-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1264-178-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1264-179-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-180-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-192-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-182-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-184-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-186-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-188-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1264-190-0x0000000005230000-0x000000000526E000-memory.dmpFilesize
248KB
-
memory/1820-168-0x0000000000FF0000-0x0000000000FFA000-memory.dmpFilesize
40KB
-
memory/1920-2066-0x0000000000B90000-0x0000000000BC2000-memory.dmpFilesize
200KB
-
memory/1920-2067-0x0000000005790000-0x00000000057A0000-memory.dmpFilesize
64KB
-
memory/3980-2060-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3980-2058-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3980-2056-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3980-1246-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3980-1248-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/3980-2059-0x0000000004CC0000-0x0000000004CD0000-memory.dmpFilesize
64KB
-
memory/4104-1140-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4104-1112-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4104-1110-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4104-1107-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4104-1106-0x0000000000650000-0x000000000067D000-memory.dmpFilesize
180KB
-
memory/4104-1141-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB
-
memory/4104-1142-0x0000000004C00000-0x0000000004C10000-memory.dmpFilesize
64KB