Analysis
-
max time kernel
142s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 19:13
Static task
static1
General
-
Target
68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exe
-
Size
1.0MB
-
MD5
a4a2b4958a8db87499b03a1c323b1730
-
SHA1
9fd6865aa518360672da9b294156c7338f9d3acb
-
SHA256
68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6
-
SHA512
d1996e558416fc8b4f9b979d530dc06a9fd5b9a4153fc3c0f2bd22467898b86c3565e92090209f3825b429d7f19d067cacd11816d272a2bb5db673383b6d4485
-
SSDEEP
24576:Ty3J2cz2gw28HaWoUC3AdoFMZ9hYqCNe+jZRXApm8XTnOsf:m5LzC2KToP3EPCN1jZ9Apm8Dnj
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
brat
176.113.115.145:4125
-
auth_value
1f9c658aed2f70f42f99a57a005561cf
Signatures
-
Processes:
az139231.execor3094.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az139231.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cor3094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cor3094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cor3094.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az139231.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az139231.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az139231.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az139231.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cor3094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cor3094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cor3094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az139231.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/1216-231-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-232-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-234-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-237-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-243-0x0000000004BC0000-0x0000000004BD0000-memory.dmp family_redline behavioral1/memory/1216-241-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-244-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-246-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-248-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-250-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-252-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-254-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-256-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-258-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-260-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-262-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-264-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline behavioral1/memory/1216-266-0x0000000004AA0000-0x0000000004ADF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bu358861.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation bu358861.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 11 IoCs
Processes:
kina6100.exekina0395.exekina7712.exeaz139231.exebu358861.exeoneetx.execor3094.exedhA43s25.exeen465632.exeoneetx.exeoneetx.exepid process 4176 kina6100.exe 2024 kina0395.exe 4492 kina7712.exe 2752 az139231.exe 2152 bu358861.exe 4212 oneetx.exe 3632 cor3094.exe 1216 dhA43s25.exe 3668 en465632.exe 4588 oneetx.exe 5048 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 5056 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
cor3094.exeaz139231.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cor3094.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az139231.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cor3094.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exekina6100.exekina0395.exekina7712.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina6100.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina6100.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina0395.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kina0395.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina7712.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kina7712.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 36 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2268 2152 WerFault.exe bu358861.exe 1376 2152 WerFault.exe bu358861.exe 112 2152 WerFault.exe bu358861.exe 2200 2152 WerFault.exe bu358861.exe 3108 2152 WerFault.exe bu358861.exe 3868 2152 WerFault.exe bu358861.exe 4328 2152 WerFault.exe bu358861.exe 1688 2152 WerFault.exe bu358861.exe 3368 2152 WerFault.exe bu358861.exe 848 2152 WerFault.exe bu358861.exe 4380 4212 WerFault.exe oneetx.exe 1580 4212 WerFault.exe oneetx.exe 1508 4212 WerFault.exe oneetx.exe 3132 4212 WerFault.exe oneetx.exe 4556 4212 WerFault.exe oneetx.exe 1064 4212 WerFault.exe oneetx.exe 4396 4212 WerFault.exe oneetx.exe 4540 4212 WerFault.exe oneetx.exe 4376 4212 WerFault.exe oneetx.exe 2700 4212 WerFault.exe oneetx.exe 4284 4212 WerFault.exe oneetx.exe 4408 4212 WerFault.exe oneetx.exe 2260 3632 WerFault.exe cor3094.exe 32 1216 WerFault.exe dhA43s25.exe 3880 4212 WerFault.exe oneetx.exe 4100 4588 WerFault.exe oneetx.exe 2552 4212 WerFault.exe oneetx.exe 1968 4588 WerFault.exe oneetx.exe 3808 4212 WerFault.exe oneetx.exe 3936 4588 WerFault.exe oneetx.exe 3976 4588 WerFault.exe oneetx.exe 2924 4212 WerFault.exe oneetx.exe 2880 5048 WerFault.exe oneetx.exe 4112 5048 WerFault.exe oneetx.exe 4784 5048 WerFault.exe oneetx.exe 3748 5048 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
az139231.execor3094.exedhA43s25.exeen465632.exepid process 2752 az139231.exe 2752 az139231.exe 3632 cor3094.exe 3632 cor3094.exe 1216 dhA43s25.exe 1216 dhA43s25.exe 3668 en465632.exe 3668 en465632.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
az139231.execor3094.exedhA43s25.exeen465632.exedescription pid process Token: SeDebugPrivilege 2752 az139231.exe Token: SeDebugPrivilege 3632 cor3094.exe Token: SeDebugPrivilege 1216 dhA43s25.exe Token: SeDebugPrivilege 3668 en465632.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bu358861.exepid process 2152 bu358861.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exekina6100.exekina0395.exekina7712.exebu358861.exeoneetx.exedescription pid process target process PID 2604 wrote to memory of 4176 2604 68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exe kina6100.exe PID 2604 wrote to memory of 4176 2604 68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exe kina6100.exe PID 2604 wrote to memory of 4176 2604 68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exe kina6100.exe PID 4176 wrote to memory of 2024 4176 kina6100.exe kina0395.exe PID 4176 wrote to memory of 2024 4176 kina6100.exe kina0395.exe PID 4176 wrote to memory of 2024 4176 kina6100.exe kina0395.exe PID 2024 wrote to memory of 4492 2024 kina0395.exe kina7712.exe PID 2024 wrote to memory of 4492 2024 kina0395.exe kina7712.exe PID 2024 wrote to memory of 4492 2024 kina0395.exe kina7712.exe PID 4492 wrote to memory of 2752 4492 kina7712.exe az139231.exe PID 4492 wrote to memory of 2752 4492 kina7712.exe az139231.exe PID 4492 wrote to memory of 2152 4492 kina7712.exe bu358861.exe PID 4492 wrote to memory of 2152 4492 kina7712.exe bu358861.exe PID 4492 wrote to memory of 2152 4492 kina7712.exe bu358861.exe PID 2152 wrote to memory of 4212 2152 bu358861.exe oneetx.exe PID 2152 wrote to memory of 4212 2152 bu358861.exe oneetx.exe PID 2152 wrote to memory of 4212 2152 bu358861.exe oneetx.exe PID 2024 wrote to memory of 3632 2024 kina0395.exe cor3094.exe PID 2024 wrote to memory of 3632 2024 kina0395.exe cor3094.exe PID 2024 wrote to memory of 3632 2024 kina0395.exe cor3094.exe PID 4212 wrote to memory of 4780 4212 oneetx.exe schtasks.exe PID 4212 wrote to memory of 4780 4212 oneetx.exe schtasks.exe PID 4212 wrote to memory of 4780 4212 oneetx.exe schtasks.exe PID 4176 wrote to memory of 1216 4176 kina6100.exe dhA43s25.exe PID 4176 wrote to memory of 1216 4176 kina6100.exe dhA43s25.exe PID 4176 wrote to memory of 1216 4176 kina6100.exe dhA43s25.exe PID 2604 wrote to memory of 3668 2604 68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exe en465632.exe PID 2604 wrote to memory of 3668 2604 68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exe en465632.exe PID 2604 wrote to memory of 3668 2604 68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exe en465632.exe PID 4212 wrote to memory of 5056 4212 oneetx.exe rundll32.exe PID 4212 wrote to memory of 5056 4212 oneetx.exe rundll32.exe PID 4212 wrote to memory of 5056 4212 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exe"C:\Users\Admin\AppData\Local\Temp\68ce73fdd86986216273cfd357bd2f4dbf431df0bb6a81124817ce72a8f13fd6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6100.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6100.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0395.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0395.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7712.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7712.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az139231.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az139231.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu358861.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu358861.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 6966⤵
- Program crash
PID:2268 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 7286⤵
- Program crash
PID:1376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 8566⤵
- Program crash
PID:112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 9686⤵
- Program crash
PID:2200 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 9766⤵
- Program crash
PID:3108 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 9766⤵
- Program crash
PID:3868 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 12126⤵
- Program crash
PID:4328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 12566⤵
- Program crash
PID:1688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 12886⤵
- Program crash
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 6927⤵
- Program crash
PID:4380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 9327⤵
- Program crash
PID:1580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 9447⤵
- Program crash
PID:1508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 10887⤵
- Program crash
PID:3132 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 11327⤵
- Program crash
PID:4556 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 11727⤵
- Program crash
PID:1064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 9447⤵
- Program crash
PID:4396 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 11367⤵
- Program crash
PID:4540 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F7⤵
- Creates scheduled task(s)
PID:4780 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 10127⤵
- Program crash
PID:4376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 8727⤵
- Program crash
PID:2700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 12527⤵
- Program crash
PID:4284 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 6927⤵
- Program crash
PID:4408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 11007⤵
- Program crash
PID:3880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 16207⤵
- Program crash
PID:2552 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:5056 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 11727⤵
- Program crash
PID:3808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 16367⤵
- Program crash
PID:2924 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2152 -s 7246⤵
- Program crash
PID:848 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor3094.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor3094.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3632 -s 10805⤵
- Program crash
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dhA43s25.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dhA43s25.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1216 -s 17564⤵
- Program crash
PID:32 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en465632.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en465632.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2152 -ip 21521⤵PID:408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2152 -ip 21521⤵PID:3928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 392 -p 2152 -ip 21521⤵PID:2660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2152 -ip 21521⤵PID:32
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2152 -ip 21521⤵PID:4324
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2152 -ip 21521⤵PID:3692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2152 -ip 21521⤵PID:1796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2152 -ip 21521⤵PID:4184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2152 -ip 21521⤵PID:1276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2152 -ip 21521⤵PID:4796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4212 -ip 42121⤵PID:4192
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4212 -ip 42121⤵PID:2968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4212 -ip 42121⤵PID:2488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4212 -ip 42121⤵PID:5096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4212 -ip 42121⤵PID:4520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4212 -ip 42121⤵PID:4160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4212 -ip 42121⤵PID:1604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4212 -ip 42121⤵PID:2688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4212 -ip 42121⤵PID:436
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4212 -ip 42121⤵PID:924
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 4212 -ip 42121⤵PID:928
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4212 -ip 42121⤵PID:1684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3632 -ip 36321⤵PID:1080
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1216 -ip 12161⤵PID:112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4212 -ip 42121⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:4588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 3922⤵
- Program crash
PID:4100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 5202⤵
- Program crash
PID:1968 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 6082⤵
- Program crash
PID:3936 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 6522⤵
- Program crash
PID:3976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4588 -ip 45881⤵PID:1648
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4212 -ip 42121⤵PID:1452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4588 -ip 45881⤵PID:3572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4212 -ip 42121⤵PID:848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4588 -ip 45881⤵PID:4492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4588 -ip 45881⤵PID:2680
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4212 -ip 42121⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:5048 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 3922⤵
- Program crash
PID:2880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 5042⤵
- Program crash
PID:4112 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 6082⤵
- Program crash
PID:4784 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5048 -s 6282⤵
- Program crash
PID:3748
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 5048 -ip 50481⤵PID:524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5048 -ip 50481⤵PID:3132
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5048 -ip 50481⤵PID:3816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 5048 -ip 50481⤵PID:5068
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5af7fca55ea436503f0fb684c1c158383
SHA1c6e2a00e5a4854b2c103748d47ae18356e7efa0d
SHA256cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60
SHA512f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5af7fca55ea436503f0fb684c1c158383
SHA1c6e2a00e5a4854b2c103748d47ae18356e7efa0d
SHA256cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60
SHA512f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5af7fca55ea436503f0fb684c1c158383
SHA1c6e2a00e5a4854b2c103748d47ae18356e7efa0d
SHA256cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60
SHA512f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5af7fca55ea436503f0fb684c1c158383
SHA1c6e2a00e5a4854b2c103748d47ae18356e7efa0d
SHA256cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60
SHA512f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5af7fca55ea436503f0fb684c1c158383
SHA1c6e2a00e5a4854b2c103748d47ae18356e7efa0d
SHA256cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60
SHA512f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en465632.exeFilesize
168KB
MD58b9b3aa0b2faf4e7b8946e6d901a0c6b
SHA1620286461087cecbc5872a71a73f0ea147f94e06
SHA256731226e0b625251bd441f973a161a89e91a56df7c276f4911a93f236da38d21b
SHA512a6b9bc7894940d36b2fe535023c1a868afdffd05e4245c84e828b83010409d6157850fc118d81060b5cc5e1a69e2799f0b1517666f0c699c227477bed6d4a41d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en465632.exeFilesize
168KB
MD58b9b3aa0b2faf4e7b8946e6d901a0c6b
SHA1620286461087cecbc5872a71a73f0ea147f94e06
SHA256731226e0b625251bd441f973a161a89e91a56df7c276f4911a93f236da38d21b
SHA512a6b9bc7894940d36b2fe535023c1a868afdffd05e4245c84e828b83010409d6157850fc118d81060b5cc5e1a69e2799f0b1517666f0c699c227477bed6d4a41d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6100.exeFilesize
920KB
MD5f0694312d6d9dd63f0c86e4a205cbb38
SHA113eddd915c800bd52897bd355e1bb79b09bfab4e
SHA256cc1c0025aa2967ed554bdfa4d6c61fe3a1574f26e914ddf818cfc14d65d615e5
SHA512876089be1c94fd0ba4ecaa58a72b36a56e3eb9f09219e6f8ba2a632d642d21eb30dfa29ecab1bda43ee0536d3b32b90631498c8a71e9b06d32b2f72055b2935f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6100.exeFilesize
920KB
MD5f0694312d6d9dd63f0c86e4a205cbb38
SHA113eddd915c800bd52897bd355e1bb79b09bfab4e
SHA256cc1c0025aa2967ed554bdfa4d6c61fe3a1574f26e914ddf818cfc14d65d615e5
SHA512876089be1c94fd0ba4ecaa58a72b36a56e3eb9f09219e6f8ba2a632d642d21eb30dfa29ecab1bda43ee0536d3b32b90631498c8a71e9b06d32b2f72055b2935f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dhA43s25.exeFilesize
297KB
MD502330ad7fe37542a920347dccb4c03ec
SHA1bab25bac0c8b1d775e2c494463d9c7bdf7220922
SHA256e55bdddf9c5eb68510b998772980887dffa3455f27ed6914f9ea15a200e4acaa
SHA5123aee21580742f666de1daa82590b210e6dd2244341caf22717ad657886035ae8d50e73990c367b9e6d1e963948dd7ec283570933f30d899c5c6ec7e5d416559e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dhA43s25.exeFilesize
297KB
MD502330ad7fe37542a920347dccb4c03ec
SHA1bab25bac0c8b1d775e2c494463d9c7bdf7220922
SHA256e55bdddf9c5eb68510b998772980887dffa3455f27ed6914f9ea15a200e4acaa
SHA5123aee21580742f666de1daa82590b210e6dd2244341caf22717ad657886035ae8d50e73990c367b9e6d1e963948dd7ec283570933f30d899c5c6ec7e5d416559e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0395.exeFilesize
588KB
MD500003d786cce3be470090c9dc3603369
SHA1b93c1e3a3e9ee635a291c8af15ff9861763a605e
SHA2565773ef56376342d71a697df5629ab41c42f110b744a1c6ccc29a0f637933f4b1
SHA512d81b88a95db66c3d5341f78f4b0ce84117e15be1ab29d861302d4f0a42f6ea115aa2a924d6f4622241ccbe2998f31bdfcfc3072a8bfa7a1f5c3d5a76b669b998
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina0395.exeFilesize
588KB
MD500003d786cce3be470090c9dc3603369
SHA1b93c1e3a3e9ee635a291c8af15ff9861763a605e
SHA2565773ef56376342d71a697df5629ab41c42f110b744a1c6ccc29a0f637933f4b1
SHA512d81b88a95db66c3d5341f78f4b0ce84117e15be1ab29d861302d4f0a42f6ea115aa2a924d6f4622241ccbe2998f31bdfcfc3072a8bfa7a1f5c3d5a76b669b998
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor3094.exeFilesize
239KB
MD54236f3dff0aa21258eabbeac71057ec1
SHA135e94ba5d7b10253d32e5c06a0bd6af4a0fa21ab
SHA256d12c732f5d7844d6887221f2cd2bc12822ed0d27bb841a988024032cda73a334
SHA512c4b59c5b4d5c87cda0f9693247b855f3acf7a98e9f357fa08d8bc4fe065c78c60fdd01269f7f595b955746c7818966a8ca86cd69c2d6fa7396fc11b301b1bddd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor3094.exeFilesize
239KB
MD54236f3dff0aa21258eabbeac71057ec1
SHA135e94ba5d7b10253d32e5c06a0bd6af4a0fa21ab
SHA256d12c732f5d7844d6887221f2cd2bc12822ed0d27bb841a988024032cda73a334
SHA512c4b59c5b4d5c87cda0f9693247b855f3acf7a98e9f357fa08d8bc4fe065c78c60fdd01269f7f595b955746c7818966a8ca86cd69c2d6fa7396fc11b301b1bddd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7712.exeFilesize
315KB
MD501ae05d6781c12b7fb1f70095a46282a
SHA1a078afb0a171ac01aef4e9a7266008c119afa707
SHA256dc215089faa7eebcf57ccc0c3e7a0c0caaf892630fec5f1a9e07e97b3a11c312
SHA5123312eecc5ce28c3e54351c0ec3e7d6afba00c220a19b6a07d3c061cf9164e9fb55560dcf70411ec435991bdc0147e9011c77f1048089293450cbd589aabc6ab6
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7712.exeFilesize
315KB
MD501ae05d6781c12b7fb1f70095a46282a
SHA1a078afb0a171ac01aef4e9a7266008c119afa707
SHA256dc215089faa7eebcf57ccc0c3e7a0c0caaf892630fec5f1a9e07e97b3a11c312
SHA5123312eecc5ce28c3e54351c0ec3e7d6afba00c220a19b6a07d3c061cf9164e9fb55560dcf70411ec435991bdc0147e9011c77f1048089293450cbd589aabc6ab6
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az139231.exeFilesize
11KB
MD5a9a9b032259d39964aefe070a190c7dd
SHA1f33fe4fa32548e45a442266288de7426f35d109b
SHA25605774bd7f40ef00f3143fd3b036894cfb4c549db08436bdbd466082882249458
SHA51220cae14b1eff0c15f78189bdd0d71410edfc707a706e8da68e9476a4a62e0810eae50b74532ba4e1f31bc35e9ad6f58095c1f06680bcc075c364369f88d0b27a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az139231.exeFilesize
11KB
MD5a9a9b032259d39964aefe070a190c7dd
SHA1f33fe4fa32548e45a442266288de7426f35d109b
SHA25605774bd7f40ef00f3143fd3b036894cfb4c549db08436bdbd466082882249458
SHA51220cae14b1eff0c15f78189bdd0d71410edfc707a706e8da68e9476a4a62e0810eae50b74532ba4e1f31bc35e9ad6f58095c1f06680bcc075c364369f88d0b27a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu358861.exeFilesize
231KB
MD5af7fca55ea436503f0fb684c1c158383
SHA1c6e2a00e5a4854b2c103748d47ae18356e7efa0d
SHA256cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60
SHA512f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu358861.exeFilesize
231KB
MD5af7fca55ea436503f0fb684c1c158383
SHA1c6e2a00e5a4854b2c103748d47ae18356e7efa0d
SHA256cb3b7bdaee641f2225640efc12d83f616526cc985a22e0dfb6bed041d84a8c60
SHA512f6d2b00dc84a58db17080766b05fe831d08fbf0f85750b611fcea55069622964d71473a40de64cd8fbcee7f39487e9087c632645d550f63d3ec87e2f3a36fe84
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1216-1143-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1216-1150-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1216-1157-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1216-1156-0x0000000007100000-0x0000000007150000-memory.dmpFilesize
320KB
-
memory/1216-1155-0x0000000007070000-0x00000000070E6000-memory.dmpFilesize
472KB
-
memory/1216-1154-0x00000000068D0000-0x0000000006DFC000-memory.dmpFilesize
5.2MB
-
memory/1216-1153-0x00000000066F0000-0x00000000068B2000-memory.dmpFilesize
1.8MB
-
memory/1216-1152-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1216-1151-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1216-1149-0x00000000063C0000-0x0000000006452000-memory.dmpFilesize
584KB
-
memory/1216-1147-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/1216-1145-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1216-1144-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1216-1142-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/1216-1141-0x0000000005280000-0x0000000005898000-memory.dmpFilesize
6.1MB
-
memory/1216-266-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-264-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-262-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-260-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-258-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-256-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-231-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-232-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-234-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-236-0x0000000001EE0000-0x0000000001F2B000-memory.dmpFilesize
300KB
-
memory/1216-237-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-238-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1216-240-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1216-243-0x0000000004BC0000-0x0000000004BD0000-memory.dmpFilesize
64KB
-
memory/1216-241-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-244-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-246-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-248-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-250-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-252-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/1216-254-0x0000000004AA0000-0x0000000004ADF000-memory.dmpFilesize
252KB
-
memory/2152-182-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2152-167-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB
-
memory/2752-161-0x00000000002D0000-0x00000000002DA000-memory.dmpFilesize
40KB
-
memory/3632-207-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-193-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-205-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-221-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3632-203-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-192-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-219-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-217-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-215-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-213-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-197-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-201-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-209-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-187-0x0000000004C50000-0x00000000051F4000-memory.dmpFilesize
5.6MB
-
memory/3632-222-0x0000000002190000-0x00000000021A0000-memory.dmpFilesize
64KB
-
memory/3632-195-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-211-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-199-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3632-191-0x0000000002190000-0x00000000021A0000-memory.dmpFilesize
64KB
-
memory/3632-190-0x0000000002190000-0x00000000021A0000-memory.dmpFilesize
64KB
-
memory/3632-226-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/3632-224-0x0000000002190000-0x00000000021A0000-memory.dmpFilesize
64KB
-
memory/3632-223-0x0000000002190000-0x00000000021A0000-memory.dmpFilesize
64KB
-
memory/3632-189-0x0000000002190000-0x00000000021A0000-memory.dmpFilesize
64KB
-
memory/3632-188-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB
-
memory/3668-1168-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/3668-1165-0x0000000004D00000-0x0000000004D10000-memory.dmpFilesize
64KB
-
memory/3668-1164-0x0000000000370000-0x00000000003A0000-memory.dmpFilesize
192KB
-
memory/4212-220-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB