Analysis
-
max time kernel
148s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 19:59
Static task
static1
General
-
Target
eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exe
-
Size
1.0MB
-
MD5
81e39a924c4dc6bdc8f800ac666f554d
-
SHA1
456334041ad92d2159c32c1c72f408601886d775
-
SHA256
eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96
-
SHA512
5d27735f285cebde9c418fc0cea902e381a01378827ff1ddf344c19921f4352b86488fea0a776937f4fe87d94a988530db75f02b0bd3fa5601bc7bcb00ddeb6e
-
SSDEEP
24576:ByDGULnd2Keaq4PsRJ+XttVVSAAxfivAS:0SULd2sGEHVVSAAx5
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
brat
176.113.115.145:4125
-
auth_value
1f9c658aed2f70f42f99a57a005561cf
Signatures
-
Processes:
az370255.execor8503.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az370255.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az370255.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az370255.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az370255.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cor8503.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cor8503.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cor8503.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az370255.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cor8503.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cor8503.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cor8503.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az370255.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/1220-231-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-232-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-234-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-236-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-238-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-240-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-242-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-244-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-246-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-248-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-250-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-252-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-254-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-256-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-258-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-260-0x0000000005020000-0x000000000505F000-memory.dmp family_redline behavioral1/memory/1220-262-0x0000000005020000-0x000000000505F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bu865797.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation bu865797.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 11 IoCs
Processes:
kina2244.exekina4412.exekina7818.exeaz370255.exebu865797.exeoneetx.execor8503.exedBN81s17.exeen382367.exeoneetx.exeoneetx.exepid process 932 kina2244.exe 4736 kina4412.exe 1700 kina7818.exe 3928 az370255.exe 3916 bu865797.exe 4648 oneetx.exe 760 cor8503.exe 1220 dBN81s17.exe 3004 en382367.exe 692 oneetx.exe 3952 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4880 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
cor8503.exeaz370255.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cor8503.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cor8503.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az370255.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exekina2244.exekina4412.exekina7818.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina2244.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina2244.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina4412.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kina4412.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina7818.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kina7818.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4856 3916 WerFault.exe bu865797.exe 3700 3916 WerFault.exe bu865797.exe 2580 3916 WerFault.exe bu865797.exe 2812 3916 WerFault.exe bu865797.exe 2588 3916 WerFault.exe bu865797.exe 2468 3916 WerFault.exe bu865797.exe 2964 3916 WerFault.exe bu865797.exe 1220 3916 WerFault.exe bu865797.exe 4248 3916 WerFault.exe bu865797.exe 3372 3916 WerFault.exe bu865797.exe 4472 4648 WerFault.exe oneetx.exe 4484 4648 WerFault.exe oneetx.exe 4592 4648 WerFault.exe oneetx.exe 1088 4648 WerFault.exe oneetx.exe 3836 4648 WerFault.exe oneetx.exe 2648 4648 WerFault.exe oneetx.exe 2772 4648 WerFault.exe oneetx.exe 964 4648 WerFault.exe oneetx.exe 3700 4648 WerFault.exe oneetx.exe 2580 4648 WerFault.exe oneetx.exe 232 4648 WerFault.exe oneetx.exe 5028 4648 WerFault.exe oneetx.exe 4536 760 WerFault.exe cor8503.exe 964 1220 WerFault.exe dBN81s17.exe 2704 4648 WerFault.exe oneetx.exe 1772 692 WerFault.exe oneetx.exe 3060 4648 WerFault.exe oneetx.exe 4820 4648 WerFault.exe oneetx.exe 1008 4648 WerFault.exe oneetx.exe 4316 3952 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
az370255.execor8503.exedBN81s17.exeen382367.exepid process 3928 az370255.exe 3928 az370255.exe 760 cor8503.exe 760 cor8503.exe 1220 dBN81s17.exe 1220 dBN81s17.exe 3004 en382367.exe 3004 en382367.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
az370255.execor8503.exedBN81s17.exeen382367.exedescription pid process Token: SeDebugPrivilege 3928 az370255.exe Token: SeDebugPrivilege 760 cor8503.exe Token: SeDebugPrivilege 1220 dBN81s17.exe Token: SeDebugPrivilege 3004 en382367.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bu865797.exepid process 3916 bu865797.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exekina2244.exekina4412.exekina7818.exebu865797.exeoneetx.exedescription pid process target process PID 992 wrote to memory of 932 992 eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exe kina2244.exe PID 992 wrote to memory of 932 992 eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exe kina2244.exe PID 992 wrote to memory of 932 992 eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exe kina2244.exe PID 932 wrote to memory of 4736 932 kina2244.exe kina4412.exe PID 932 wrote to memory of 4736 932 kina2244.exe kina4412.exe PID 932 wrote to memory of 4736 932 kina2244.exe kina4412.exe PID 4736 wrote to memory of 1700 4736 kina4412.exe kina7818.exe PID 4736 wrote to memory of 1700 4736 kina4412.exe kina7818.exe PID 4736 wrote to memory of 1700 4736 kina4412.exe kina7818.exe PID 1700 wrote to memory of 3928 1700 kina7818.exe az370255.exe PID 1700 wrote to memory of 3928 1700 kina7818.exe az370255.exe PID 1700 wrote to memory of 3916 1700 kina7818.exe bu865797.exe PID 1700 wrote to memory of 3916 1700 kina7818.exe bu865797.exe PID 1700 wrote to memory of 3916 1700 kina7818.exe bu865797.exe PID 3916 wrote to memory of 4648 3916 bu865797.exe oneetx.exe PID 3916 wrote to memory of 4648 3916 bu865797.exe oneetx.exe PID 3916 wrote to memory of 4648 3916 bu865797.exe oneetx.exe PID 4736 wrote to memory of 760 4736 kina4412.exe cor8503.exe PID 4736 wrote to memory of 760 4736 kina4412.exe cor8503.exe PID 4736 wrote to memory of 760 4736 kina4412.exe cor8503.exe PID 4648 wrote to memory of 1632 4648 oneetx.exe schtasks.exe PID 4648 wrote to memory of 1632 4648 oneetx.exe schtasks.exe PID 4648 wrote to memory of 1632 4648 oneetx.exe schtasks.exe PID 932 wrote to memory of 1220 932 kina2244.exe dBN81s17.exe PID 932 wrote to memory of 1220 932 kina2244.exe dBN81s17.exe PID 932 wrote to memory of 1220 932 kina2244.exe dBN81s17.exe PID 992 wrote to memory of 3004 992 eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exe en382367.exe PID 992 wrote to memory of 3004 992 eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exe en382367.exe PID 992 wrote to memory of 3004 992 eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exe en382367.exe PID 4648 wrote to memory of 4880 4648 oneetx.exe rundll32.exe PID 4648 wrote to memory of 4880 4648 oneetx.exe rundll32.exe PID 4648 wrote to memory of 4880 4648 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exe"C:\Users\Admin\AppData\Local\Temp\eab3118e1d575b7427c236d7387899d2ba824238ef4532f18cb8e1d98f803a96.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2244.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2244.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4412.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4412.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7818.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7818.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az370255.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az370255.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu865797.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu865797.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 6966⤵
- Program crash
PID:4856 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 7886⤵
- Program crash
PID:3700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 8566⤵
- Program crash
PID:2580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 9766⤵
- Program crash
PID:2812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 9846⤵
- Program crash
PID:2588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 8566⤵
- Program crash
PID:2468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 12166⤵
- Program crash
PID:2964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 12526⤵
- Program crash
PID:1220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 13166⤵
- Program crash
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 6927⤵
- Program crash
PID:4472 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 8167⤵
- Program crash
PID:4484 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 8407⤵
- Program crash
PID:4592 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 10527⤵
- Program crash
PID:1088 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 10607⤵
- Program crash
PID:3836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 11287⤵
- Program crash
PID:2648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 11127⤵
- Program crash
PID:2772 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F7⤵
- Creates scheduled task(s)
PID:1632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 9927⤵
- Program crash
PID:964 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 6967⤵
- Program crash
PID:3700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 9127⤵
- Program crash
PID:2580 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 12487⤵
- Program crash
PID:232 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 14687⤵
- Program crash
PID:5028 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 10727⤵
- Program crash
PID:2704 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 16687⤵
- Program crash
PID:3060 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:4880 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 10607⤵
- Program crash
PID:4820 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 16847⤵
- Program crash
PID:1008 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 13566⤵
- Program crash
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor8503.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor8503.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 760 -s 10845⤵
- Program crash
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dBN81s17.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dBN81s17.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 16324⤵
- Program crash
PID:964 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en382367.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en382367.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3916 -ip 39161⤵PID:1244
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3916 -ip 39161⤵PID:3732
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3916 -ip 39161⤵PID:4500
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3916 -ip 39161⤵PID:4184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3916 -ip 39161⤵PID:2368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3916 -ip 39161⤵PID:4984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3916 -ip 39161⤵PID:2344
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3916 -ip 39161⤵PID:4536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3916 -ip 39161⤵PID:3644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3916 -ip 39161⤵PID:2024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4648 -ip 46481⤵PID:2164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4648 -ip 46481⤵PID:1056
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4648 -ip 46481⤵PID:2508
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4648 -ip 46481⤵PID:4952
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4648 -ip 46481⤵PID:1972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4648 -ip 46481⤵PID:3256
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4648 -ip 46481⤵PID:2816
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 4648 -ip 46481⤵PID:2892
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4648 -ip 46481⤵PID:1824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4648 -ip 46481⤵PID:4116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4648 -ip 46481⤵PID:2704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4648 -ip 46481⤵PID:484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 760 -ip 7601⤵PID:3660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1220 -ip 12201⤵PID:4604
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4648 -ip 46481⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:692 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 692 -s 2162⤵
- Program crash
PID:1772
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 692 -ip 6921⤵PID:3516
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4648 -ip 46481⤵PID:3592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4648 -ip 46481⤵PID:4524
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4648 -ip 46481⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:3952 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3952 -s 3202⤵
- Program crash
PID:4316
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3952 -ip 39521⤵PID:2944
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en382367.exeFilesize
168KB
MD50ea4a666df9eaaa61d2ab24228d30375
SHA1b84a4b07e29eb0997415a38dd86b1eb5e5be3361
SHA256c223adeb84c3d9de9e03d15b8588ddb7ebd3f944bc31d5245125b6792a880176
SHA512415f4c03946322bb50be89a4103b1f96185107d31e137228e5e976b02b6028fa0f81fc7b86771464f68fe9ad589511129d82a1b0d4a01f6656579adb92e3e706
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en382367.exeFilesize
168KB
MD50ea4a666df9eaaa61d2ab24228d30375
SHA1b84a4b07e29eb0997415a38dd86b1eb5e5be3361
SHA256c223adeb84c3d9de9e03d15b8588ddb7ebd3f944bc31d5245125b6792a880176
SHA512415f4c03946322bb50be89a4103b1f96185107d31e137228e5e976b02b6028fa0f81fc7b86771464f68fe9ad589511129d82a1b0d4a01f6656579adb92e3e706
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2244.exeFilesize
921KB
MD581896009c7b3954615b38e53f1f72832
SHA18ea09002dfd9ba972998e0168f0ede4fbd6cd697
SHA2560a9a686c8914576306c6ec20e228b332cced8776607aa81f59db16425bafb64d
SHA51263fe35ebcf6de3e9fad38ab4bd03edd02ed62eeac5e944177d793e9b5d1211322192885dd109152d4cc9658cbbf2f96ff559ce9ff1d0b5915a208c3ecb47aad8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2244.exeFilesize
921KB
MD581896009c7b3954615b38e53f1f72832
SHA18ea09002dfd9ba972998e0168f0ede4fbd6cd697
SHA2560a9a686c8914576306c6ec20e228b332cced8776607aa81f59db16425bafb64d
SHA51263fe35ebcf6de3e9fad38ab4bd03edd02ed62eeac5e944177d793e9b5d1211322192885dd109152d4cc9658cbbf2f96ff559ce9ff1d0b5915a208c3ecb47aad8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dBN81s17.exeFilesize
297KB
MD5efc579b83f223c02dd180f7ed0fa767b
SHA1162467bcf539d62959937dfb3089fa17d730de6e
SHA25631e9a14386cacd772033c292adbfc8b396c4c1f65b8d4378dff88739e6043c89
SHA512bc38e79b489dc2629d28d1f930a69635a31d9f855a643a146cd038d322caca7ad6945ab4c63bb2ef602d11f2a91d8b092d2a4f4b0564540699083ca7751bfdea
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dBN81s17.exeFilesize
297KB
MD5efc579b83f223c02dd180f7ed0fa767b
SHA1162467bcf539d62959937dfb3089fa17d730de6e
SHA25631e9a14386cacd772033c292adbfc8b396c4c1f65b8d4378dff88739e6043c89
SHA512bc38e79b489dc2629d28d1f930a69635a31d9f855a643a146cd038d322caca7ad6945ab4c63bb2ef602d11f2a91d8b092d2a4f4b0564540699083ca7751bfdea
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4412.exeFilesize
589KB
MD5b43c9ea6404dd775537dc3575e307003
SHA1472c4db65afab6c423621630d61af5c2343f49dd
SHA25635a15f3cdb747efcced59a31ffa941868de12072e4c2fc2b434e0cd785a30c60
SHA5120856f418b4032991a4346343edecff1287cb4e5c337fd04fdb8fd1e5c6f47c708d3436abbcfbda637b4eda91c71e22fd3bb5b9936fa9e1d6cd34c6c28b1cc567
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4412.exeFilesize
589KB
MD5b43c9ea6404dd775537dc3575e307003
SHA1472c4db65afab6c423621630d61af5c2343f49dd
SHA25635a15f3cdb747efcced59a31ffa941868de12072e4c2fc2b434e0cd785a30c60
SHA5120856f418b4032991a4346343edecff1287cb4e5c337fd04fdb8fd1e5c6f47c708d3436abbcfbda637b4eda91c71e22fd3bb5b9936fa9e1d6cd34c6c28b1cc567
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor8503.exeFilesize
239KB
MD5f7641c7833960452596915bb957f138d
SHA1991fb0d3967573fcf465da14935b120a221af89c
SHA256b5dfcf5d8281485fd67181e9c04c2cf598e8094d662cbf43c9322629d9362592
SHA512723a371ee9dbd4552993c09ef5df89cad6b8632eca21ee7359925452da2a857c79ce542890d7bf1adc12a39bfcc3f82d3dc41237a81677183cf331cc6a1591bd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor8503.exeFilesize
239KB
MD5f7641c7833960452596915bb957f138d
SHA1991fb0d3967573fcf465da14935b120a221af89c
SHA256b5dfcf5d8281485fd67181e9c04c2cf598e8094d662cbf43c9322629d9362592
SHA512723a371ee9dbd4552993c09ef5df89cad6b8632eca21ee7359925452da2a857c79ce542890d7bf1adc12a39bfcc3f82d3dc41237a81677183cf331cc6a1591bd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7818.exeFilesize
316KB
MD5367d89755d790726ca74cd71772454c4
SHA19be9291c8fc19821448d0be2d989e0e267fdadc8
SHA256e33ac481bba7b76a2ea9d9491a2590a3bd570e8b14874fc5814dda7f2fac39e0
SHA51287da952bf8e79e522bdb68f19bfb07d31f096927604bd8dcfebcc35e9d050e4570cccaf17e54755f632b6f454cb227cdb59cae27c7fcd300ed8029ec98409153
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7818.exeFilesize
316KB
MD5367d89755d790726ca74cd71772454c4
SHA19be9291c8fc19821448d0be2d989e0e267fdadc8
SHA256e33ac481bba7b76a2ea9d9491a2590a3bd570e8b14874fc5814dda7f2fac39e0
SHA51287da952bf8e79e522bdb68f19bfb07d31f096927604bd8dcfebcc35e9d050e4570cccaf17e54755f632b6f454cb227cdb59cae27c7fcd300ed8029ec98409153
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az370255.exeFilesize
11KB
MD50de18ee87c87082c289684a12eaddca3
SHA17f3bbb0dd3dbc308d5bfac029b07b036d1323eea
SHA25606066dce25f4229e5bbe144341e3630431fc00083ffe1b76360072777607a888
SHA512d27b48e1561221aa55be4c03ca08bcb2ea8f8c7c1cc27d290cae76b5286d79d16808bbab288e5e113cd4a808f1cdf251a58d42245c20c90d4bc1cdf23ea27df1
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az370255.exeFilesize
11KB
MD50de18ee87c87082c289684a12eaddca3
SHA17f3bbb0dd3dbc308d5bfac029b07b036d1323eea
SHA25606066dce25f4229e5bbe144341e3630431fc00083ffe1b76360072777607a888
SHA512d27b48e1561221aa55be4c03ca08bcb2ea8f8c7c1cc27d290cae76b5286d79d16808bbab288e5e113cd4a808f1cdf251a58d42245c20c90d4bc1cdf23ea27df1
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu865797.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu865797.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/760-194-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-197-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-199-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-201-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-203-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-205-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-207-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-209-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-211-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-213-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-215-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-217-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-219-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-187-0x0000000004C50000-0x00000000051F4000-memory.dmpFilesize
5.6MB
-
memory/760-221-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/760-222-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/760-223-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/760-224-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/760-226-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/760-195-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/760-191-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/760-188-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-189-0x00000000004B0000-0x00000000004DD000-memory.dmpFilesize
180KB
-
memory/760-190-0x0000000002660000-0x0000000002672000-memory.dmpFilesize
72KB
-
memory/760-192-0x0000000004C40000-0x0000000004C50000-memory.dmpFilesize
64KB
-
memory/1220-254-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-1146-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/1220-242-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-244-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-246-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-248-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-250-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-252-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-238-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-256-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-258-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-260-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-262-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-412-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB
-
memory/1220-416-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/1220-413-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/1220-1140-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/1220-1141-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/1220-1142-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1220-1143-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/1220-1144-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1220-240-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-1147-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/1220-1148-0x0000000006590000-0x0000000006606000-memory.dmpFilesize
472KB
-
memory/1220-1149-0x0000000006620000-0x0000000006670000-memory.dmpFilesize
320KB
-
memory/1220-1151-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/1220-1152-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/1220-1153-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/1220-1154-0x0000000004A20000-0x0000000004A30000-memory.dmpFilesize
64KB
-
memory/1220-1155-0x0000000007960000-0x0000000007B22000-memory.dmpFilesize
1.8MB
-
memory/1220-1156-0x0000000007B30000-0x000000000805C000-memory.dmpFilesize
5.2MB
-
memory/1220-236-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-234-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-231-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/1220-232-0x0000000005020000-0x000000000505F000-memory.dmpFilesize
252KB
-
memory/3004-1164-0x00000000056B0000-0x00000000056C0000-memory.dmpFilesize
64KB
-
memory/3004-1162-0x0000000000D50000-0x0000000000D80000-memory.dmpFilesize
192KB
-
memory/3916-182-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/3916-167-0x00000000005C0000-0x00000000005FB000-memory.dmpFilesize
236KB
-
memory/3928-161-0x00000000000A0000-0x00000000000AA000-memory.dmpFilesize
40KB
-
memory/4648-220-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB