Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 19:26
Static task
static1
General
-
Target
462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exe
-
Size
1.0MB
-
MD5
8c51d6362ab0bc32bd404697e6a1a9fb
-
SHA1
8802eaf0a971fc192bd8a4b9a1f8659798a90bf4
-
SHA256
462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf
-
SHA512
2b067bfcdda8a2f02810709e3939f97a3cc66411ad442eec1f21e3773bec46bbd4291e4d0aa85fc004796c27f040686e3a16759b9962df7ec78ad360718c0ba4
-
SSDEEP
24576:Gyt4zlTGM5ptwUOjt+oTTSvuFowUfnDGoyxfx9BjOMBJa:VUTDFoTOvuFowcPyxJPjOM
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
brat
176.113.115.145:4125
-
auth_value
1f9c658aed2f70f42f99a57a005561cf
Signatures
-
Processes:
cor7487.exeaz848779.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cor7487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az848779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az848779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az848779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cor7487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cor7487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cor7487.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az848779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az848779.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az848779.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cor7487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cor7487.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/3164-235-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-238-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-236-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-240-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-242-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-244-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-246-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-250-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-248-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-252-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-254-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-256-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-258-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-264-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-262-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-260-0x0000000002530000-0x000000000256F000-memory.dmp family_redline behavioral1/memory/3164-266-0x0000000002530000-0x000000000256F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bu938922.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation bu938922.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 11 IoCs
Processes:
kina0359.exekina0226.exekina0961.exeaz848779.exebu938922.exeoneetx.execor7487.exedTl98s06.exeen611836.exeoneetx.exeoneetx.exepid process 2848 kina0359.exe 1344 kina0226.exe 3736 kina0961.exe 1512 az848779.exe 2104 bu938922.exe 2844 oneetx.exe 3868 cor7487.exe 3164 dTl98s06.exe 3696 en611836.exe 1808 oneetx.exe 4020 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 636 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
az848779.execor7487.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az848779.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cor7487.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cor7487.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
kina0961.exe462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exekina0359.exekina0226.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kina0961.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina0359.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina0359.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina0226.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kina0226.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina0961.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3096 2104 WerFault.exe bu938922.exe 4244 2104 WerFault.exe bu938922.exe 4356 2104 WerFault.exe bu938922.exe 4640 2104 WerFault.exe bu938922.exe 4648 2104 WerFault.exe bu938922.exe 3108 2104 WerFault.exe bu938922.exe 4140 2104 WerFault.exe bu938922.exe 4516 2104 WerFault.exe bu938922.exe 4760 2104 WerFault.exe bu938922.exe 1680 2104 WerFault.exe bu938922.exe 4204 2844 WerFault.exe oneetx.exe 4700 2844 WerFault.exe oneetx.exe 5028 2844 WerFault.exe oneetx.exe 2820 2844 WerFault.exe oneetx.exe 2036 2844 WerFault.exe oneetx.exe 4200 2844 WerFault.exe oneetx.exe 1800 2844 WerFault.exe oneetx.exe 2172 2844 WerFault.exe oneetx.exe 896 2844 WerFault.exe oneetx.exe 4764 2844 WerFault.exe oneetx.exe 1204 2844 WerFault.exe oneetx.exe 2936 2844 WerFault.exe oneetx.exe 4324 3868 WerFault.exe cor7487.exe 4024 3164 WerFault.exe dTl98s06.exe 5028 2844 WerFault.exe oneetx.exe 2024 1808 WerFault.exe oneetx.exe 316 2844 WerFault.exe oneetx.exe 1848 2844 WerFault.exe oneetx.exe 2620 2844 WerFault.exe oneetx.exe 3824 4020 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
az848779.execor7487.exedTl98s06.exeen611836.exepid process 1512 az848779.exe 1512 az848779.exe 3868 cor7487.exe 3868 cor7487.exe 3164 dTl98s06.exe 3164 dTl98s06.exe 3696 en611836.exe 3696 en611836.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
az848779.execor7487.exedTl98s06.exeen611836.exedescription pid process Token: SeDebugPrivilege 1512 az848779.exe Token: SeDebugPrivilege 3868 cor7487.exe Token: SeDebugPrivilege 3164 dTl98s06.exe Token: SeDebugPrivilege 3696 en611836.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bu938922.exepid process 2104 bu938922.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exekina0359.exekina0226.exekina0961.exebu938922.exeoneetx.exedescription pid process target process PID 1912 wrote to memory of 2848 1912 462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exe kina0359.exe PID 1912 wrote to memory of 2848 1912 462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exe kina0359.exe PID 1912 wrote to memory of 2848 1912 462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exe kina0359.exe PID 2848 wrote to memory of 1344 2848 kina0359.exe kina0226.exe PID 2848 wrote to memory of 1344 2848 kina0359.exe kina0226.exe PID 2848 wrote to memory of 1344 2848 kina0359.exe kina0226.exe PID 1344 wrote to memory of 3736 1344 kina0226.exe kina0961.exe PID 1344 wrote to memory of 3736 1344 kina0226.exe kina0961.exe PID 1344 wrote to memory of 3736 1344 kina0226.exe kina0961.exe PID 3736 wrote to memory of 1512 3736 kina0961.exe az848779.exe PID 3736 wrote to memory of 1512 3736 kina0961.exe az848779.exe PID 3736 wrote to memory of 2104 3736 kina0961.exe bu938922.exe PID 3736 wrote to memory of 2104 3736 kina0961.exe bu938922.exe PID 3736 wrote to memory of 2104 3736 kina0961.exe bu938922.exe PID 2104 wrote to memory of 2844 2104 bu938922.exe oneetx.exe PID 2104 wrote to memory of 2844 2104 bu938922.exe oneetx.exe PID 2104 wrote to memory of 2844 2104 bu938922.exe oneetx.exe PID 1344 wrote to memory of 3868 1344 kina0226.exe cor7487.exe PID 1344 wrote to memory of 3868 1344 kina0226.exe cor7487.exe PID 1344 wrote to memory of 3868 1344 kina0226.exe cor7487.exe PID 2844 wrote to memory of 4728 2844 oneetx.exe schtasks.exe PID 2844 wrote to memory of 4728 2844 oneetx.exe schtasks.exe PID 2844 wrote to memory of 4728 2844 oneetx.exe schtasks.exe PID 2848 wrote to memory of 3164 2848 kina0359.exe dTl98s06.exe PID 2848 wrote to memory of 3164 2848 kina0359.exe dTl98s06.exe PID 2848 wrote to memory of 3164 2848 kina0359.exe dTl98s06.exe PID 1912 wrote to memory of 3696 1912 462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exe en611836.exe PID 1912 wrote to memory of 3696 1912 462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exe en611836.exe PID 1912 wrote to memory of 3696 1912 462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exe en611836.exe PID 2844 wrote to memory of 636 2844 oneetx.exe rundll32.exe PID 2844 wrote to memory of 636 2844 oneetx.exe rundll32.exe PID 2844 wrote to memory of 636 2844 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exe"C:\Users\Admin\AppData\Local\Temp\462b8268b2913c3a47ccffabd406c0ca5a107beeb0fed2633e23e8e22bb97fdf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina0359.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina0359.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0226.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0226.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina0961.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina0961.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az848779.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az848779.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu938922.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu938922.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 6966⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 7806⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 8566⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 9526⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 9566⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 9846⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 11886⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 12646⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 13726⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 6927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 9047⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 9367⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 10527⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 10727⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 11087⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 11327⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 10007⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 7807⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 8767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 12887⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 14367⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 11447⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 16367⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 14407⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 16527⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 14566⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor7487.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor7487.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 10885⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dTl98s06.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dTl98s06.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3164 -s 16404⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en611836.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en611836.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2104 -ip 21041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2104 -ip 21041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2104 -ip 21041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2104 -ip 21041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2104 -ip 21041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 2104 -ip 21041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2104 -ip 21041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2104 -ip 21041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2104 -ip 21041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2104 -ip 21041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 3868 -ip 38681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 3164 -ip 31641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2844 -ip 28441⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1808 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 1808 -ip 18081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2844 -ip 28441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 2844 -ip 28441⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4020 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4020 -ip 40201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en611836.exeFilesize
168KB
MD515e7f109dcfe1f2edd29d52debff9f7a
SHA1f5418ca653e50490cb39efd5aa38886d7a8c869d
SHA256db85d867e8505a1ff62d5eab3c5bc63022e48e3a782678b4eec9c45ad38ee6be
SHA5126c6f1c226bd958211e10574efb2e5580ba6837c4b1fbfa6c47bb7354a4432bba2fc261ff3b4d14d9eff2d58c57c9d496e936dbeb170129de4f7a9296c749886e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en611836.exeFilesize
168KB
MD515e7f109dcfe1f2edd29d52debff9f7a
SHA1f5418ca653e50490cb39efd5aa38886d7a8c869d
SHA256db85d867e8505a1ff62d5eab3c5bc63022e48e3a782678b4eec9c45ad38ee6be
SHA5126c6f1c226bd958211e10574efb2e5580ba6837c4b1fbfa6c47bb7354a4432bba2fc261ff3b4d14d9eff2d58c57c9d496e936dbeb170129de4f7a9296c749886e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina0359.exeFilesize
921KB
MD50de51fe82a855760dd4e6185e719a2c9
SHA1df26e330b96d2a3c5bf508e6851d70eac88bb8a5
SHA2569b66bdd8b82c01811075d5757bd4844d039001b77145c1ef54c41606ff6c9569
SHA5129038c96742b4786d24484efb47b04eca1b6ab8e2991bda4ad75e32f590d4e9067e81281ba228e8f7b24c2d8788cce8cb2ac68d3188f68d921c3fec379ec0539c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina0359.exeFilesize
921KB
MD50de51fe82a855760dd4e6185e719a2c9
SHA1df26e330b96d2a3c5bf508e6851d70eac88bb8a5
SHA2569b66bdd8b82c01811075d5757bd4844d039001b77145c1ef54c41606ff6c9569
SHA5129038c96742b4786d24484efb47b04eca1b6ab8e2991bda4ad75e32f590d4e9067e81281ba228e8f7b24c2d8788cce8cb2ac68d3188f68d921c3fec379ec0539c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dTl98s06.exeFilesize
297KB
MD568e7ec96977800fed4881c5681fff067
SHA1b83c4406e9a5b3d8096291cdce01e98fc7ff5a05
SHA256650ad04ce09a0a709086d766975158ea0624c9766a709b754c57be17460caef1
SHA51235c60bcd2715e00c35f203379fb26c26a3821e6a849b50f9e67e82639e32753c5272dad97857402d3ba1d18dfb598e444dd99359990a4a1f7f1d26bb23565d3c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dTl98s06.exeFilesize
297KB
MD568e7ec96977800fed4881c5681fff067
SHA1b83c4406e9a5b3d8096291cdce01e98fc7ff5a05
SHA256650ad04ce09a0a709086d766975158ea0624c9766a709b754c57be17460caef1
SHA51235c60bcd2715e00c35f203379fb26c26a3821e6a849b50f9e67e82639e32753c5272dad97857402d3ba1d18dfb598e444dd99359990a4a1f7f1d26bb23565d3c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0226.exeFilesize
589KB
MD5ca447b8740e129019a4b4125d836125a
SHA1c66289389f735b72c09e683cd2e76e1faf0549e4
SHA25604edf0cdda16208c2b2fd9388319f53034c6916fe3dd995dd1c842c315dfb5a6
SHA5122a096a205fbca76633f922f43a3ab44ee85d73ee82b630bda917f91b63b48e94cc15b13efe70dc99e601837c64f7c3b9e34b3799bd2352dee15ac806c13d6390
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0226.exeFilesize
589KB
MD5ca447b8740e129019a4b4125d836125a
SHA1c66289389f735b72c09e683cd2e76e1faf0549e4
SHA25604edf0cdda16208c2b2fd9388319f53034c6916fe3dd995dd1c842c315dfb5a6
SHA5122a096a205fbca76633f922f43a3ab44ee85d73ee82b630bda917f91b63b48e94cc15b13efe70dc99e601837c64f7c3b9e34b3799bd2352dee15ac806c13d6390
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor7487.exeFilesize
239KB
MD581d75972640d5ac618745b7bbe22a552
SHA15f64a71d73f272dad4b0fd18a690ebfa4ea15969
SHA2563350cf5bc9cf608f0d4c9c9799154a73bd8b449d975f31845d534373965d4121
SHA5122a9f5706d47a69e02e646f358ed56cb0d97b546859d80cf41669e12c25f1c26f13defb67713109c892284048fa84ace0c841b8d72c55f3e82591b428690cf308
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor7487.exeFilesize
239KB
MD581d75972640d5ac618745b7bbe22a552
SHA15f64a71d73f272dad4b0fd18a690ebfa4ea15969
SHA2563350cf5bc9cf608f0d4c9c9799154a73bd8b449d975f31845d534373965d4121
SHA5122a9f5706d47a69e02e646f358ed56cb0d97b546859d80cf41669e12c25f1c26f13defb67713109c892284048fa84ace0c841b8d72c55f3e82591b428690cf308
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina0961.exeFilesize
316KB
MD5c151a43602fd6bbcf94e802a7203ec9c
SHA17059ad4c66afb5fd957d1ffdc518aa684610955f
SHA256830e869a1da68298ef3d1960f169b63738f654fa67f4c0cba09c9956a7aee333
SHA512d1cc7b0e28e33386aee80d52828f8e33521af00913d5961eb0d9ff995760cc583216ebe3a0184bde7bd5e9153cbd9835d67e283bb3f5ef5eb0e88b29ea3096d7
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina0961.exeFilesize
316KB
MD5c151a43602fd6bbcf94e802a7203ec9c
SHA17059ad4c66afb5fd957d1ffdc518aa684610955f
SHA256830e869a1da68298ef3d1960f169b63738f654fa67f4c0cba09c9956a7aee333
SHA512d1cc7b0e28e33386aee80d52828f8e33521af00913d5961eb0d9ff995760cc583216ebe3a0184bde7bd5e9153cbd9835d67e283bb3f5ef5eb0e88b29ea3096d7
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az848779.exeFilesize
11KB
MD56614daa0e2c58bda3581378aedd0f860
SHA11a35d62da36800a27020dfd173a9893b546024ff
SHA25617d5cf11f6a2c5912636bfddd5c6b8d6817afb1701acbbc0c34d66129200b737
SHA512a3a1d75fc6eb06c4618f9c06e2ba860453ec27e81afe6c980137baec823710ffb9837cc9cf8fdde7b3fd56575bae801b864f5364948a4bd045c7473d9ddf748e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az848779.exeFilesize
11KB
MD56614daa0e2c58bda3581378aedd0f860
SHA11a35d62da36800a27020dfd173a9893b546024ff
SHA25617d5cf11f6a2c5912636bfddd5c6b8d6817afb1701acbbc0c34d66129200b737
SHA512a3a1d75fc6eb06c4618f9c06e2ba860453ec27e81afe6c980137baec823710ffb9837cc9cf8fdde7b3fd56575bae801b864f5364948a4bd045c7473d9ddf748e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu938922.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu938922.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1512-161-0x0000000000970000-0x000000000097A000-memory.dmpFilesize
40KB
-
memory/2104-182-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2104-167-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/2844-220-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/3164-1143-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/3164-1151-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/3164-1157-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/3164-1156-0x0000000006E80000-0x0000000006ED0000-memory.dmpFilesize
320KB
-
memory/3164-1155-0x0000000006E00000-0x0000000006E76000-memory.dmpFilesize
472KB
-
memory/3164-1154-0x0000000006780000-0x0000000006CAC000-memory.dmpFilesize
5.2MB
-
memory/3164-1153-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/3164-1152-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/3164-1149-0x00000000065B0000-0x0000000006772000-memory.dmpFilesize
1.8MB
-
memory/3164-1148-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/3164-1147-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/3164-1145-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/3164-1144-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/3164-1142-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/3164-1141-0x0000000005240000-0x0000000005858000-memory.dmpFilesize
6.1MB
-
memory/3164-266-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-260-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-232-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/3164-233-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/3164-231-0x0000000000510000-0x000000000055B000-memory.dmpFilesize
300KB
-
memory/3164-235-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-234-0x0000000004C80000-0x0000000004C90000-memory.dmpFilesize
64KB
-
memory/3164-238-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-236-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-240-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-242-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-244-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-246-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-250-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-248-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-252-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-254-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-256-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-258-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-264-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3164-262-0x0000000002530000-0x000000000256F000-memory.dmpFilesize
252KB
-
memory/3696-1163-0x0000000000800000-0x0000000000830000-memory.dmpFilesize
192KB
-
memory/3696-1165-0x0000000002AA0000-0x0000000002AB0000-memory.dmpFilesize
64KB
-
memory/3868-217-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-221-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3868-213-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-224-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3868-211-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-222-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3868-205-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-209-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-207-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-218-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3868-201-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-215-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-199-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-225-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3868-219-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3868-197-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-195-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-226-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3868-203-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-193-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-191-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-190-0x00000000024A0000-0x00000000024B2000-memory.dmpFilesize
72KB
-
memory/3868-189-0x0000000004AD0000-0x0000000005074000-memory.dmpFilesize
5.6MB
-
memory/3868-188-0x0000000004AC0000-0x0000000004AD0000-memory.dmpFilesize
64KB
-
memory/3868-187-0x0000000001E70000-0x0000000001E9D000-memory.dmpFilesize
180KB