Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 19:23
Static task
static1
General
-
Target
39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exe
-
Size
1.0MB
-
MD5
4dd91c6b91f4af0efb128ef9fd8ec008
-
SHA1
048962b927d4da4bdfb0b915938502845906f30a
-
SHA256
39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7
-
SHA512
961f85c0c703adf3db65ba1b16b15f089ee2cd4ef50c8561cd13831da26fd08062daa82d744dba6d66d1e317f3c61c5dcad8749590dc7322b2396cead1b94a62
-
SSDEEP
24576:6y46U3CYFIAC8ZvcbeXuMWMJ5C7h0xfPz0kcS5vQ:BFhYyACgcbe+MfJ5Ct0xngkcS5v
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
brat
176.113.115.145:4125
-
auth_value
1f9c658aed2f70f42f99a57a005561cf
Signatures
-
Processes:
az079360.execor0356.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az079360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az079360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cor0356.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cor0356.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cor0356.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az079360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az079360.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az079360.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cor0356.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cor0356.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cor0356.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az079360.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/2056-231-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-232-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-234-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-236-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-238-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-242-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-244-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-240-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-246-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-248-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-250-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-252-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-254-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-256-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-258-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-262-0x0000000005030000-0x000000000506F000-memory.dmp family_redline behavioral1/memory/2056-266-0x0000000005030000-0x000000000506F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bu612983.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation bu612983.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 11 IoCs
Processes:
kina3232.exekina9878.exekina9785.exeaz079360.exebu612983.exeoneetx.execor0356.exedBU99s84.exeen626375.exeoneetx.exeoneetx.exepid process 2544 kina3232.exe 4924 kina9878.exe 2948 kina9785.exe 1336 az079360.exe 1232 bu612983.exe 2832 oneetx.exe 2916 cor0356.exe 2056 dBU99s84.exe 3108 en626375.exe 4952 oneetx.exe 4064 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4656 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
cor0356.exeaz079360.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cor0356.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az079360.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cor0356.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
kina9785.exe39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exekina3232.exekina9878.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kina9785.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina3232.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina3232.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina9878.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kina9878.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina9785.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4584 1232 WerFault.exe bu612983.exe 3408 1232 WerFault.exe bu612983.exe 5100 1232 WerFault.exe bu612983.exe 1972 1232 WerFault.exe bu612983.exe 868 1232 WerFault.exe bu612983.exe 3404 1232 WerFault.exe bu612983.exe 916 1232 WerFault.exe bu612983.exe 4768 1232 WerFault.exe bu612983.exe 4092 1232 WerFault.exe bu612983.exe 4292 1232 WerFault.exe bu612983.exe 4176 2832 WerFault.exe oneetx.exe 220 2832 WerFault.exe oneetx.exe 3024 2832 WerFault.exe oneetx.exe 4836 2832 WerFault.exe oneetx.exe 376 2832 WerFault.exe oneetx.exe 1140 2832 WerFault.exe oneetx.exe 1932 2832 WerFault.exe oneetx.exe 1992 2832 WerFault.exe oneetx.exe 4612 2832 WerFault.exe oneetx.exe 1668 2832 WerFault.exe oneetx.exe 4596 2832 WerFault.exe oneetx.exe 3832 2832 WerFault.exe oneetx.exe 1712 2916 WerFault.exe cor0356.exe 3056 2056 WerFault.exe dBU99s84.exe 4352 2832 WerFault.exe oneetx.exe 4456 4952 WerFault.exe oneetx.exe 2280 2832 WerFault.exe oneetx.exe 4344 2832 WerFault.exe oneetx.exe 1052 2832 WerFault.exe oneetx.exe 3856 4064 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
az079360.execor0356.exedBU99s84.exeen626375.exepid process 1336 az079360.exe 1336 az079360.exe 2916 cor0356.exe 2916 cor0356.exe 2056 dBU99s84.exe 2056 dBU99s84.exe 3108 en626375.exe 3108 en626375.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
az079360.execor0356.exedBU99s84.exeen626375.exedescription pid process Token: SeDebugPrivilege 1336 az079360.exe Token: SeDebugPrivilege 2916 cor0356.exe Token: SeDebugPrivilege 2056 dBU99s84.exe Token: SeDebugPrivilege 3108 en626375.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bu612983.exepid process 1232 bu612983.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exekina3232.exekina9878.exekina9785.exebu612983.exeoneetx.exedescription pid process target process PID 4296 wrote to memory of 2544 4296 39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exe kina3232.exe PID 4296 wrote to memory of 2544 4296 39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exe kina3232.exe PID 4296 wrote to memory of 2544 4296 39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exe kina3232.exe PID 2544 wrote to memory of 4924 2544 kina3232.exe kina9878.exe PID 2544 wrote to memory of 4924 2544 kina3232.exe kina9878.exe PID 2544 wrote to memory of 4924 2544 kina3232.exe kina9878.exe PID 4924 wrote to memory of 2948 4924 kina9878.exe kina9785.exe PID 4924 wrote to memory of 2948 4924 kina9878.exe kina9785.exe PID 4924 wrote to memory of 2948 4924 kina9878.exe kina9785.exe PID 2948 wrote to memory of 1336 2948 kina9785.exe az079360.exe PID 2948 wrote to memory of 1336 2948 kina9785.exe az079360.exe PID 2948 wrote to memory of 1232 2948 kina9785.exe bu612983.exe PID 2948 wrote to memory of 1232 2948 kina9785.exe bu612983.exe PID 2948 wrote to memory of 1232 2948 kina9785.exe bu612983.exe PID 1232 wrote to memory of 2832 1232 bu612983.exe oneetx.exe PID 1232 wrote to memory of 2832 1232 bu612983.exe oneetx.exe PID 1232 wrote to memory of 2832 1232 bu612983.exe oneetx.exe PID 4924 wrote to memory of 2916 4924 kina9878.exe cor0356.exe PID 4924 wrote to memory of 2916 4924 kina9878.exe cor0356.exe PID 4924 wrote to memory of 2916 4924 kina9878.exe cor0356.exe PID 2832 wrote to memory of 3952 2832 oneetx.exe schtasks.exe PID 2832 wrote to memory of 3952 2832 oneetx.exe schtasks.exe PID 2832 wrote to memory of 3952 2832 oneetx.exe schtasks.exe PID 2544 wrote to memory of 2056 2544 kina3232.exe dBU99s84.exe PID 2544 wrote to memory of 2056 2544 kina3232.exe dBU99s84.exe PID 2544 wrote to memory of 2056 2544 kina3232.exe dBU99s84.exe PID 4296 wrote to memory of 3108 4296 39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exe en626375.exe PID 4296 wrote to memory of 3108 4296 39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exe en626375.exe PID 4296 wrote to memory of 3108 4296 39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exe en626375.exe PID 2832 wrote to memory of 4656 2832 oneetx.exe rundll32.exe PID 2832 wrote to memory of 4656 2832 oneetx.exe rundll32.exe PID 2832 wrote to memory of 4656 2832 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exe"C:\Users\Admin\AppData\Local\Temp\39ed8e8dd028533bc42b810ed35020d7ab94d33ac2463e3e984e9da64f75a8f7.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina3232.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina3232.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina9878.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina9878.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9785.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9785.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az079360.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az079360.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu612983.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu612983.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 6966⤵
- Program crash
PID:4584 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 7806⤵
- Program crash
PID:3408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 8566⤵
- Program crash
PID:5100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 9606⤵
- Program crash
PID:1972 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 9766⤵
- Program crash
PID:868 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 9966⤵
- Program crash
PID:3404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 12166⤵
- Program crash
PID:916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 12326⤵
- Program crash
PID:4768 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 13206⤵
- Program crash
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 6927⤵
- Program crash
PID:4176 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 8447⤵
- Program crash
PID:220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 10167⤵
- Program crash
PID:3024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 10087⤵
- Program crash
PID:4836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 10807⤵
- Program crash
PID:376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 10807⤵
- Program crash
PID:1140 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 10927⤵
- Program crash
PID:1932 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F7⤵
- Creates scheduled task(s)
PID:3952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 9927⤵
- Program crash
PID:1992 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 7527⤵
- Program crash
PID:4612 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 8927⤵
- Program crash
PID:1668 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 12887⤵
- Program crash
PID:4596 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 14287⤵
- Program crash
PID:3832 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 11007⤵
- Program crash
PID:4352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 16287⤵
- Program crash
PID:2280 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:4656 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 14367⤵
- Program crash
PID:4344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2832 -s 16447⤵
- Program crash
PID:1052 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 13606⤵
- Program crash
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor0356.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor0356.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 10765⤵
- Program crash
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dBU99s84.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dBU99s84.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2056 -s 13484⤵
- Program crash
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en626375.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en626375.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 1232 -ip 12321⤵PID:4428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1232 -ip 12321⤵PID:316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 1232 -ip 12321⤵PID:3624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1232 -ip 12321⤵PID:4084
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1232 -ip 12321⤵PID:4028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1232 -ip 12321⤵PID:3296
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 1232 -ip 12321⤵PID:3184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 1232 -ip 12321⤵PID:4424
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1232 -ip 12321⤵PID:4340
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1232 -ip 12321⤵PID:4240
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2832 -ip 28321⤵PID:3280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2832 -ip 28321⤵PID:856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2832 -ip 28321⤵PID:1968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2832 -ip 28321⤵PID:2168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2832 -ip 28321⤵PID:5080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2832 -ip 28321⤵PID:4208
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2832 -ip 28321⤵PID:5076
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 2832 -ip 28321⤵PID:3816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2832 -ip 28321⤵PID:4608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2832 -ip 28321⤵PID:4888
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2832 -ip 28321⤵PID:3092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2832 -ip 28321⤵PID:2452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2916 -ip 29161⤵PID:636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2056 -ip 20561⤵PID:2228
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 2832 -ip 28321⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:4952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 3122⤵
- Program crash
PID:4456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4952 -ip 49521⤵PID:1964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2832 -ip 28321⤵PID:1592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2832 -ip 28321⤵PID:1852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2832 -ip 28321⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:4064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 3122⤵
- Program crash
PID:3856
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4064 -ip 40641⤵PID:208
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en626375.exeFilesize
168KB
MD541a71ae93348897ccce18c9eb70a4313
SHA160d7795812e9293161ebbfb8a046d4c1282939d7
SHA256a0fcc736644b9aa62613ea7038296de169a65648c2615c3f7ce8deb2081806d9
SHA51292860b1e30bb20295f37723f32aea4c914626d804450707bc68c2b7ab34c4fea26d42dc3d27bc6e52ad4aa4ff74784265504f089e0ab09cfb39e02321fb3c3e9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en626375.exeFilesize
168KB
MD541a71ae93348897ccce18c9eb70a4313
SHA160d7795812e9293161ebbfb8a046d4c1282939d7
SHA256a0fcc736644b9aa62613ea7038296de169a65648c2615c3f7ce8deb2081806d9
SHA51292860b1e30bb20295f37723f32aea4c914626d804450707bc68c2b7ab34c4fea26d42dc3d27bc6e52ad4aa4ff74784265504f089e0ab09cfb39e02321fb3c3e9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina3232.exeFilesize
920KB
MD52946bc39ca2a4658d20aefd85e4638dd
SHA17b7d1788fafe924e94edc87c798cf68f9c0ddf18
SHA2569be1aff27342580fac41983f8db40be2288efa11a6223338b389d8d29a9cbac2
SHA512d0891ed73580fe1e9059bf79a85ae80af396989ff9661aafe333a2d4927f1293f749b4d40a270f1b7eeb6170488ad46a7227489895ebc43f517d4c50c578d9b2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina3232.exeFilesize
920KB
MD52946bc39ca2a4658d20aefd85e4638dd
SHA17b7d1788fafe924e94edc87c798cf68f9c0ddf18
SHA2569be1aff27342580fac41983f8db40be2288efa11a6223338b389d8d29a9cbac2
SHA512d0891ed73580fe1e9059bf79a85ae80af396989ff9661aafe333a2d4927f1293f749b4d40a270f1b7eeb6170488ad46a7227489895ebc43f517d4c50c578d9b2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dBU99s84.exeFilesize
297KB
MD5ce158e5bcbd34adc21464ea9747be762
SHA17e276f4b6a09744bd334b27b3954f4ff9d871f31
SHA25625a4d24deed995c23ca140f887743cdbe061ad7dbc56c2a5d97b67853de6be87
SHA512a88457f86f4da51be9bef0837f01709a87e00a8c2899f69a2b9132f599e81614f17777e6c56b504adb83ef3a8e0b690c8f8d3d6323f6a0931bfa43c8c78ff0dc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dBU99s84.exeFilesize
297KB
MD5ce158e5bcbd34adc21464ea9747be762
SHA17e276f4b6a09744bd334b27b3954f4ff9d871f31
SHA25625a4d24deed995c23ca140f887743cdbe061ad7dbc56c2a5d97b67853de6be87
SHA512a88457f86f4da51be9bef0837f01709a87e00a8c2899f69a2b9132f599e81614f17777e6c56b504adb83ef3a8e0b690c8f8d3d6323f6a0931bfa43c8c78ff0dc
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina9878.exeFilesize
589KB
MD5bcb59cb904ec449eb8afd6eda87fcc61
SHA195d7c580313d0dc30d319685e15dd2d7de016d7f
SHA25669ebcb1b50ca2698731622fa01ec9db02e31ed3eabec17802657fe5aa1efde54
SHA5129fe5b45ecda1f14b070c9b0c64d039ca482de74713859b76d7d371c620846a922150a5561410fb88410710f22cad9235b1c9af34e60cd873f1df8436ecf782e0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina9878.exeFilesize
589KB
MD5bcb59cb904ec449eb8afd6eda87fcc61
SHA195d7c580313d0dc30d319685e15dd2d7de016d7f
SHA25669ebcb1b50ca2698731622fa01ec9db02e31ed3eabec17802657fe5aa1efde54
SHA5129fe5b45ecda1f14b070c9b0c64d039ca482de74713859b76d7d371c620846a922150a5561410fb88410710f22cad9235b1c9af34e60cd873f1df8436ecf782e0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor0356.exeFilesize
239KB
MD51b74e4b2899bd92459e69d43b46e956b
SHA1ee767bb5b7e36ba80e6b7293c29534fde8fdbcc1
SHA2564fc67893dc421952a10656bb99b4bceaaa647529813cc218941b62feb6a0e2b8
SHA512427ad5491998379caf0608c045c3ca9efac30382709614f88d6045e05f301ed4c5ad2ccd010013e0094c5711459089c5438d7328a7095706ad200d22fd57bb5d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor0356.exeFilesize
239KB
MD51b74e4b2899bd92459e69d43b46e956b
SHA1ee767bb5b7e36ba80e6b7293c29534fde8fdbcc1
SHA2564fc67893dc421952a10656bb99b4bceaaa647529813cc218941b62feb6a0e2b8
SHA512427ad5491998379caf0608c045c3ca9efac30382709614f88d6045e05f301ed4c5ad2ccd010013e0094c5711459089c5438d7328a7095706ad200d22fd57bb5d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9785.exeFilesize
316KB
MD5e52cc44624108d54a5844fc3ea81d69b
SHA11341103e9fa999c6618d3e5f6efbd52f2743efe2
SHA256af4804d7583020bf87fdd262a254afafcdf94fd48c3cc57600da13a78eb90059
SHA512024b49b219d6d9991ae188e6a31841be8c3b3f8bf86cee90e45648893feaa8febe6377ea73e366287e9a11e312aad0837102f7161dbe9acf54ec94e078fd87ae
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9785.exeFilesize
316KB
MD5e52cc44624108d54a5844fc3ea81d69b
SHA11341103e9fa999c6618d3e5f6efbd52f2743efe2
SHA256af4804d7583020bf87fdd262a254afafcdf94fd48c3cc57600da13a78eb90059
SHA512024b49b219d6d9991ae188e6a31841be8c3b3f8bf86cee90e45648893feaa8febe6377ea73e366287e9a11e312aad0837102f7161dbe9acf54ec94e078fd87ae
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az079360.exeFilesize
11KB
MD5d97c7c5b39de9b6792ca318d796b512b
SHA10f0ec0621e8b4a7e3a79b7b85e65168675279eaa
SHA2569410938297d9cbcec3ff420b46239a18fd0da4e15cb14d8e788056adc616a221
SHA512eabed4daacd917e21ec6741cf94104ef8731800caefb71750538b32f9317a936489bff35388eaca08cb0092d204f630a89fb9d2a9fd2bfecea8723b4c684a1c2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az079360.exeFilesize
11KB
MD5d97c7c5b39de9b6792ca318d796b512b
SHA10f0ec0621e8b4a7e3a79b7b85e65168675279eaa
SHA2569410938297d9cbcec3ff420b46239a18fd0da4e15cb14d8e788056adc616a221
SHA512eabed4daacd917e21ec6741cf94104ef8731800caefb71750538b32f9317a936489bff35388eaca08cb0092d204f630a89fb9d2a9fd2bfecea8723b4c684a1c2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu612983.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu612983.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1232-182-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1232-167-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/1336-161-0x0000000000940000-0x000000000094A000-memory.dmpFilesize
40KB
-
memory/2056-1143-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/2056-1150-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/2056-1157-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/2056-1155-0x0000000007B30000-0x000000000805C000-memory.dmpFilesize
5.2MB
-
memory/2056-1154-0x0000000007950000-0x0000000007B12000-memory.dmpFilesize
1.8MB
-
memory/2056-1153-0x00000000078F0000-0x0000000007940000-memory.dmpFilesize
320KB
-
memory/2056-1152-0x0000000007860000-0x00000000078D6000-memory.dmpFilesize
472KB
-
memory/2056-1151-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/2056-1149-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/2056-1148-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/2056-1145-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/2056-1144-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/2056-1142-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/2056-1141-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/2056-264-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/2056-266-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-262-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-263-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/2056-231-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-232-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-234-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-236-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-238-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-242-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-244-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-240-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-246-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-248-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-250-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-252-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-254-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-256-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-259-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/2056-258-0x0000000005030000-0x000000000506F000-memory.dmpFilesize
252KB
-
memory/2056-261-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/2832-220-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2916-211-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-189-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2916-224-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2916-223-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2916-222-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2916-197-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-221-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2916-201-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-219-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-217-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-203-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-215-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-187-0x0000000000680000-0x00000000006AD000-memory.dmpFilesize
180KB
-
memory/2916-226-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2916-192-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-205-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-207-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-195-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-209-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-213-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-190-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/2916-193-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-199-0x0000000004A10000-0x0000000004A22000-memory.dmpFilesize
72KB
-
memory/2916-191-0x0000000004BA0000-0x0000000005144000-memory.dmpFilesize
5.6MB
-
memory/2916-188-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/3108-1169-0x00000000016F0000-0x0000000001700000-memory.dmpFilesize
64KB
-
memory/3108-1164-0x00000000016F0000-0x0000000001700000-memory.dmpFilesize
64KB
-
memory/3108-1163-0x0000000000E00000-0x0000000000E30000-memory.dmpFilesize
192KB