Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 19:52
Static task
static1
General
-
Target
8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exe
-
Size
1.0MB
-
MD5
988b4266658b459a1a903aa12ec1b6e3
-
SHA1
70f029c523eba4aeacd35308fd9cc81b98549f74
-
SHA256
8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39
-
SHA512
a349a0de6549be4d9a8d38831cdee0397aa0ecb769ce0daacc9d0773f3655123f78d4bc87de2f41432cf83eb1bc3c1551cfcbd96213b8942257ca2b95084d85d
-
SSDEEP
24576:jyZAuo8HPxxyBZyqZCbzpi3vWKRsExfYzxPdxB:2ZU8pxyBZ+M/XxgzxFx
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
brat
176.113.115.145:4125
-
auth_value
1f9c658aed2f70f42f99a57a005561cf
Signatures
-
Processes:
cor7337.exeaz903388.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cor7337.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cor7337.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az903388.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az903388.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cor7337.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az903388.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cor7337.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cor7337.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cor7337.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az903388.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az903388.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az903388.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/2252-230-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-231-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-233-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-235-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-237-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-239-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-241-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-251-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-247-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-253-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-243-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-255-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-257-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-259-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-261-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-265-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline behavioral1/memory/2252-263-0x0000000004A70000-0x0000000004AAF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bu168793.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation bu168793.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 11 IoCs
Processes:
kina4588.exekina5173.exekina9537.exeaz903388.exebu168793.exeoneetx.execor7337.exedry17s80.exeoneetx.exeen674698.exeoneetx.exepid process 3244 kina4588.exe 4820 kina5173.exe 2716 kina9537.exe 228 az903388.exe 4444 bu168793.exe 984 oneetx.exe 2424 cor7337.exe 2252 dry17s80.exe 3100 oneetx.exe 4012 en674698.exe 3860 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4156 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
az903388.execor7337.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az903388.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cor7337.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cor7337.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
kina5173.exekina9537.exe8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exekina4588.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina5173.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kina5173.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina9537.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kina9537.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina4588.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina4588.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2404 4444 WerFault.exe bu168793.exe 1844 4444 WerFault.exe bu168793.exe 4960 4444 WerFault.exe bu168793.exe 5096 4444 WerFault.exe bu168793.exe 3320 4444 WerFault.exe bu168793.exe 4616 4444 WerFault.exe bu168793.exe 1232 4444 WerFault.exe bu168793.exe 3548 4444 WerFault.exe bu168793.exe 3080 4444 WerFault.exe bu168793.exe 5116 4444 WerFault.exe bu168793.exe 1580 984 WerFault.exe oneetx.exe 3948 984 WerFault.exe oneetx.exe 224 984 WerFault.exe oneetx.exe 1588 984 WerFault.exe oneetx.exe 1352 984 WerFault.exe oneetx.exe 2404 984 WerFault.exe oneetx.exe 4920 984 WerFault.exe oneetx.exe 4960 984 WerFault.exe oneetx.exe 2336 984 WerFault.exe oneetx.exe 4384 984 WerFault.exe oneetx.exe 844 984 WerFault.exe oneetx.exe 3416 984 WerFault.exe oneetx.exe 2508 2424 WerFault.exe cor7337.exe 3304 3100 WerFault.exe oneetx.exe 4100 2252 WerFault.exe dry17s80.exe 4472 984 WerFault.exe oneetx.exe 4648 984 WerFault.exe oneetx.exe 3544 984 WerFault.exe oneetx.exe 2500 984 WerFault.exe oneetx.exe 4112 3860 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
az903388.execor7337.exedry17s80.exeen674698.exepid process 228 az903388.exe 228 az903388.exe 2424 cor7337.exe 2424 cor7337.exe 2252 dry17s80.exe 2252 dry17s80.exe 4012 en674698.exe 4012 en674698.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
az903388.execor7337.exedry17s80.exeen674698.exedescription pid process Token: SeDebugPrivilege 228 az903388.exe Token: SeDebugPrivilege 2424 cor7337.exe Token: SeDebugPrivilege 2252 dry17s80.exe Token: SeDebugPrivilege 4012 en674698.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bu168793.exepid process 4444 bu168793.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exekina4588.exekina5173.exekina9537.exebu168793.exeoneetx.exedescription pid process target process PID 2412 wrote to memory of 3244 2412 8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exe kina4588.exe PID 2412 wrote to memory of 3244 2412 8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exe kina4588.exe PID 2412 wrote to memory of 3244 2412 8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exe kina4588.exe PID 3244 wrote to memory of 4820 3244 kina4588.exe kina5173.exe PID 3244 wrote to memory of 4820 3244 kina4588.exe kina5173.exe PID 3244 wrote to memory of 4820 3244 kina4588.exe kina5173.exe PID 4820 wrote to memory of 2716 4820 kina5173.exe kina9537.exe PID 4820 wrote to memory of 2716 4820 kina5173.exe kina9537.exe PID 4820 wrote to memory of 2716 4820 kina5173.exe kina9537.exe PID 2716 wrote to memory of 228 2716 kina9537.exe az903388.exe PID 2716 wrote to memory of 228 2716 kina9537.exe az903388.exe PID 2716 wrote to memory of 4444 2716 kina9537.exe bu168793.exe PID 2716 wrote to memory of 4444 2716 kina9537.exe bu168793.exe PID 2716 wrote to memory of 4444 2716 kina9537.exe bu168793.exe PID 4444 wrote to memory of 984 4444 bu168793.exe oneetx.exe PID 4444 wrote to memory of 984 4444 bu168793.exe oneetx.exe PID 4444 wrote to memory of 984 4444 bu168793.exe oneetx.exe PID 4820 wrote to memory of 2424 4820 kina5173.exe cor7337.exe PID 4820 wrote to memory of 2424 4820 kina5173.exe cor7337.exe PID 4820 wrote to memory of 2424 4820 kina5173.exe cor7337.exe PID 984 wrote to memory of 4300 984 oneetx.exe schtasks.exe PID 984 wrote to memory of 4300 984 oneetx.exe schtasks.exe PID 984 wrote to memory of 4300 984 oneetx.exe schtasks.exe PID 3244 wrote to memory of 2252 3244 kina4588.exe dry17s80.exe PID 3244 wrote to memory of 2252 3244 kina4588.exe dry17s80.exe PID 3244 wrote to memory of 2252 3244 kina4588.exe dry17s80.exe PID 2412 wrote to memory of 4012 2412 8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exe en674698.exe PID 2412 wrote to memory of 4012 2412 8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exe en674698.exe PID 2412 wrote to memory of 4012 2412 8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exe en674698.exe PID 984 wrote to memory of 4156 984 oneetx.exe rundll32.exe PID 984 wrote to memory of 4156 984 oneetx.exe rundll32.exe PID 984 wrote to memory of 4156 984 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exe"C:\Users\Admin\AppData\Local\Temp\8d06e1c8dbe3567dcd5bddc5e43ac9655b70b5d6883b252b1881007f6c9f8b39.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4588.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4588.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina5173.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina5173.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9537.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9537.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az903388.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az903388.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:228 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu168793.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu168793.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 6966⤵
- Program crash
PID:2404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 7806⤵
- Program crash
PID:1844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 8566⤵
- Program crash
PID:4960 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 9766⤵
- Program crash
PID:5096 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 9966⤵
- Program crash
PID:3320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 9646⤵
- Program crash
PID:4616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 12166⤵
- Program crash
PID:1232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 12566⤵
- Program crash
PID:3548 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 13206⤵
- Program crash
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 6927⤵
- Program crash
PID:1580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 8607⤵
- Program crash
PID:3948 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 8847⤵
- Program crash
PID:224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 9407⤵
- Program crash
PID:1588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 10727⤵
- Program crash
PID:1352 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 10727⤵
- Program crash
PID:2404 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 9487⤵
- Program crash
PID:4920 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 10967⤵
- Program crash
PID:4960 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F7⤵
- Creates scheduled task(s)
PID:4300 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 10127⤵
- Program crash
PID:2336 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 13047⤵
- Program crash
PID:4384 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 13127⤵
- Program crash
PID:844 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 13327⤵
- Program crash
PID:3416 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 9367⤵
- Program crash
PID:4472 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 16047⤵
- Program crash
PID:4648 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:4156 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 15487⤵
- Program crash
PID:3544 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 984 -s 16207⤵
- Program crash
PID:2500 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 13526⤵
- Program crash
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor7337.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor7337.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2424 -s 10805⤵
- Program crash
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dry17s80.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dry17s80.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2252 -s 13564⤵
- Program crash
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en674698.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en674698.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4444 -ip 44441⤵PID:428
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 4444 -ip 44441⤵PID:936
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4444 -ip 44441⤵PID:3300
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4444 -ip 44441⤵PID:3868
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4444 -ip 44441⤵PID:3664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4444 -ip 44441⤵PID:4632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4444 -ip 44441⤵PID:2604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4444 -ip 44441⤵PID:1408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4444 -ip 44441⤵PID:3372
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4444 -ip 44441⤵PID:1736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 984 -ip 9841⤵PID:2976
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 984 -ip 9841⤵PID:1940
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 984 -ip 9841⤵PID:1108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 984 -ip 9841⤵PID:1872
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 984 -ip 9841⤵PID:1012
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 984 -ip 9841⤵PID:3368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 984 -ip 9841⤵PID:4056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 984 -ip 9841⤵PID:1600
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 984 -ip 9841⤵PID:4880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 984 -ip 9841⤵PID:3304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 984 -ip 9841⤵PID:3884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 984 -ip 9841⤵PID:756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 2424 -ip 24241⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:3100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 3202⤵
- Program crash
PID:3304
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3100 -ip 31001⤵PID:668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 2252 -ip 22521⤵PID:2120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 984 -ip 9841⤵PID:1280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 984 -ip 9841⤵PID:4740
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 984 -ip 9841⤵PID:1684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 984 -ip 9841⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:3860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3860 -s 3122⤵
- Program crash
PID:4112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3860 -ip 38601⤵PID:4728
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en674698.exeFilesize
168KB
MD5757df8b782845d70f48e5cd0cfd2350b
SHA18f38872bb98674b146ae73004c4a91afc56999a5
SHA256f0965b868c183b2fa84cdc02a89307f18a131a21cd0fdd20deea4f04912ba6da
SHA512960d6aabfa3b1ecb0911dfcebb4fdb18e08791fdaa33aad08bed8be6ca5317e6c53579aa7496fac0d18874cffd1ea92c7b0d1a64468e855e164811a57465b9fe
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en674698.exeFilesize
168KB
MD5757df8b782845d70f48e5cd0cfd2350b
SHA18f38872bb98674b146ae73004c4a91afc56999a5
SHA256f0965b868c183b2fa84cdc02a89307f18a131a21cd0fdd20deea4f04912ba6da
SHA512960d6aabfa3b1ecb0911dfcebb4fdb18e08791fdaa33aad08bed8be6ca5317e6c53579aa7496fac0d18874cffd1ea92c7b0d1a64468e855e164811a57465b9fe
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4588.exeFilesize
920KB
MD526a76b342c7eae2042fb2c36b46d144c
SHA1a0bc08da8004cd59967fc5e9f84e205708d9e1ca
SHA2567e0065f9b3f35741d637765fa956d989d982ed82e976a85d8124afefb6f1c786
SHA512ed5c779cbad7d480fa186ead745c69d923ebe78c0d2b0cdea6de7f69c42cb226242cf651e5a8e4b509bbdd615413a9ef99512cfaaa1c301226460920a2129f59
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4588.exeFilesize
920KB
MD526a76b342c7eae2042fb2c36b46d144c
SHA1a0bc08da8004cd59967fc5e9f84e205708d9e1ca
SHA2567e0065f9b3f35741d637765fa956d989d982ed82e976a85d8124afefb6f1c786
SHA512ed5c779cbad7d480fa186ead745c69d923ebe78c0d2b0cdea6de7f69c42cb226242cf651e5a8e4b509bbdd615413a9ef99512cfaaa1c301226460920a2129f59
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dry17s80.exeFilesize
297KB
MD5c5e7ff067612fa2579db168e9d84c940
SHA16bd5242b107b0650af555de528958bda831bbfa4
SHA256b9916812ebdd1e34e63928a8c0f1643bda9e2ee766f59ac6a4c13341d1931b1d
SHA512bea657d2754f6bb2c5dae3a69c7501c083bd57ae6831e37765a29e1e17650b3ecf18db4648d32ae88e5ed6485dd28fd5e102db6d125028f374f60da5f0f5e182
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dry17s80.exeFilesize
297KB
MD5c5e7ff067612fa2579db168e9d84c940
SHA16bd5242b107b0650af555de528958bda831bbfa4
SHA256b9916812ebdd1e34e63928a8c0f1643bda9e2ee766f59ac6a4c13341d1931b1d
SHA512bea657d2754f6bb2c5dae3a69c7501c083bd57ae6831e37765a29e1e17650b3ecf18db4648d32ae88e5ed6485dd28fd5e102db6d125028f374f60da5f0f5e182
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina5173.exeFilesize
589KB
MD57a50e93a92de254df19be1a0fec05732
SHA158baabf99e657b390f784501e293db3f1423f663
SHA2563cafc0ff866ca0ee55a6281acb3639190015ddfe7d9d7bffff70616fc92a3d6c
SHA5126a2db4d0d4aedd3ae77d0de02b840a404c471181ac5e9eb65fd21ae21b0606bb4cc3965a2110dcc31874068b4bd20f0d01e1b84039b124429ed5222a73b16c3f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina5173.exeFilesize
589KB
MD57a50e93a92de254df19be1a0fec05732
SHA158baabf99e657b390f784501e293db3f1423f663
SHA2563cafc0ff866ca0ee55a6281acb3639190015ddfe7d9d7bffff70616fc92a3d6c
SHA5126a2db4d0d4aedd3ae77d0de02b840a404c471181ac5e9eb65fd21ae21b0606bb4cc3965a2110dcc31874068b4bd20f0d01e1b84039b124429ed5222a73b16c3f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor7337.exeFilesize
239KB
MD54dccd49b6b2504adad042509f6700ab5
SHA16e4b507bcdec0803edd1d88ac4ef15e551e095b2
SHA256d48b4e14e78ab540c0b42ad679dc9adf3beede7a6370ef2b391dccd007107574
SHA5129d4239c79b8ccbccb7eaef76be7a83a1f2ae0d2980efca255f9c726f26638ab8e9c99c3bd81ee6b7105ad341b6a37f23d4b020c27eca571a19bdce6c11800c72
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor7337.exeFilesize
239KB
MD54dccd49b6b2504adad042509f6700ab5
SHA16e4b507bcdec0803edd1d88ac4ef15e551e095b2
SHA256d48b4e14e78ab540c0b42ad679dc9adf3beede7a6370ef2b391dccd007107574
SHA5129d4239c79b8ccbccb7eaef76be7a83a1f2ae0d2980efca255f9c726f26638ab8e9c99c3bd81ee6b7105ad341b6a37f23d4b020c27eca571a19bdce6c11800c72
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9537.exeFilesize
316KB
MD5169e549af97643a02e33893475792ce8
SHA10cd311b9a57bfcb765705b493580d9805df7bc71
SHA256b53bbfe057a36110247061dffda8df46c8bab4fa6a57032f56e244bf9adfcb46
SHA512fb195b25b6358f98c46dd3fa588b5a4524bac80ebe294eb207651fc6fd9d439aea054f472166e626343061c98a049080d94b075f5a6de682ff5e85458930cd41
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9537.exeFilesize
316KB
MD5169e549af97643a02e33893475792ce8
SHA10cd311b9a57bfcb765705b493580d9805df7bc71
SHA256b53bbfe057a36110247061dffda8df46c8bab4fa6a57032f56e244bf9adfcb46
SHA512fb195b25b6358f98c46dd3fa588b5a4524bac80ebe294eb207651fc6fd9d439aea054f472166e626343061c98a049080d94b075f5a6de682ff5e85458930cd41
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az903388.exeFilesize
11KB
MD5eb7f95e2cf8eb156c6008678069beb6b
SHA1d604bccc0aae51965af7703630760f9d19e15cd1
SHA256eb30ec069c151a81c35d9056c0ae5ccac0e755294d47a48f33fe9e240fe25411
SHA51234deca20a21f135aa4baeb7b0cf6294c258ffc5aa7d230f45700f36a9d8c159882f19252dc338c2e371d2159efb4c5beca72472a3eac31d3c9a1b0ea18251524
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az903388.exeFilesize
11KB
MD5eb7f95e2cf8eb156c6008678069beb6b
SHA1d604bccc0aae51965af7703630760f9d19e15cd1
SHA256eb30ec069c151a81c35d9056c0ae5ccac0e755294d47a48f33fe9e240fe25411
SHA51234deca20a21f135aa4baeb7b0cf6294c258ffc5aa7d230f45700f36a9d8c159882f19252dc338c2e371d2159efb4c5beca72472a3eac31d3c9a1b0ea18251524
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu168793.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu168793.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/228-161-0x0000000000280000-0x000000000028A000-memory.dmpFilesize
40KB
-
memory/984-219-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2252-1145-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2252-1152-0x0000000007860000-0x0000000007A22000-memory.dmpFilesize
1.8MB
-
memory/2252-1157-0x0000000008090000-0x00000000080E0000-memory.dmpFilesize
320KB
-
memory/2252-1156-0x0000000007FF0000-0x0000000008066000-memory.dmpFilesize
472KB
-
memory/2252-1155-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2252-1153-0x0000000007A30000-0x0000000007F5C000-memory.dmpFilesize
5.2MB
-
memory/2252-1151-0x0000000005770000-0x00000000057D6000-memory.dmpFilesize
408KB
-
memory/2252-1150-0x00000000056D0000-0x0000000005762000-memory.dmpFilesize
584KB
-
memory/2252-1149-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2252-1148-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2252-1147-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2252-1144-0x00000000053E0000-0x000000000541C000-memory.dmpFilesize
240KB
-
memory/2252-1142-0x00000000053C0000-0x00000000053D2000-memory.dmpFilesize
72KB
-
memory/2252-1141-0x0000000005280000-0x000000000538A000-memory.dmpFilesize
1.0MB
-
memory/2252-1140-0x0000000005820000-0x0000000005E38000-memory.dmpFilesize
6.1MB
-
memory/2252-263-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-265-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-261-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-230-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-231-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-233-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-235-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-237-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-239-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-241-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-246-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2252-248-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2252-251-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-250-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/2252-247-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-244-0x0000000000700000-0x000000000074B000-memory.dmpFilesize
300KB
-
memory/2252-253-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-243-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-255-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-257-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2252-259-0x0000000004A70000-0x0000000004AAF000-memory.dmpFilesize
252KB
-
memory/2424-210-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-222-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/2424-196-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-223-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/2424-208-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-221-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/2424-194-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-220-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2424-200-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-218-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-216-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-206-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-212-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-202-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-225-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2424-198-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-214-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-204-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-192-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-191-0x0000000002480000-0x0000000002492000-memory.dmpFilesize
72KB
-
memory/2424-189-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/2424-188-0x0000000004B50000-0x0000000004B60000-memory.dmpFilesize
64KB
-
memory/2424-187-0x00000000004B0000-0x00000000004DD000-memory.dmpFilesize
180KB
-
memory/2424-190-0x0000000004B60000-0x0000000005104000-memory.dmpFilesize
5.6MB
-
memory/4012-1169-0x0000000005630000-0x0000000005640000-memory.dmpFilesize
64KB
-
memory/4012-1167-0x0000000005630000-0x0000000005640000-memory.dmpFilesize
64KB
-
memory/4012-1166-0x0000000000E00000-0x0000000000E30000-memory.dmpFilesize
192KB
-
memory/4444-182-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/4444-167-0x0000000000580000-0x00000000005BB000-memory.dmpFilesize
236KB