Analysis
-
max time kernel
148s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:17
Static task
static1
General
-
Target
fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exe
-
Size
1.0MB
-
MD5
647bee61e84cd3d464ae7e1600416f27
-
SHA1
3edec115d9115e4025198167b2932d1353c6d402
-
SHA256
fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d
-
SHA512
b6c3436e9895675b80e1c8d55117d7e651ad77048fa51f19a7c435d9a04b85afa9ace482610cfc1eca8efdca5ad7c118a12e128e6f54a9d7e7bebfe8dd2e298d
-
SSDEEP
24576:sy2KDAFbljz5Iqtel6XOuhk4xfgQRljx:b2KDgBFI0el6eu3xIQjj
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
brat
176.113.115.145:4125
-
auth_value
1f9c658aed2f70f42f99a57a005561cf
Signatures
-
Processes:
az515808.execor5753.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az515808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az515808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az515808.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cor5753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cor5753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az515808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az515808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az515808.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cor5753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cor5753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cor5753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cor5753.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4968-235-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-236-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-238-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-240-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-244-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-242-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-246-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-248-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-250-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-252-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-254-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-256-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-258-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-260-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-262-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-264-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline behavioral1/memory/4968-266-0x0000000004AE0000-0x0000000004B1F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bu996367.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation bu996367.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 11 IoCs
Processes:
kina0454.exekina3912.exekina7287.exeaz515808.exebu996367.exeoneetx.execor5753.exedrk07s57.exeen551302.exeoneetx.exeoneetx.exepid process 3732 kina0454.exe 4528 kina3912.exe 5048 kina7287.exe 4136 az515808.exe 864 bu996367.exe 2184 oneetx.exe 2032 cor5753.exe 4968 drk07s57.exe 3668 en551302.exe 3248 oneetx.exe 4120 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4532 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
az515808.execor5753.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az515808.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cor5753.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cor5753.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
kina7287.exefdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exekina0454.exekina3912.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kina7287.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina0454.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina0454.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina3912.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kina3912.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina7287.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3900 864 WerFault.exe bu996367.exe 3432 864 WerFault.exe bu996367.exe 3380 864 WerFault.exe bu996367.exe 264 864 WerFault.exe bu996367.exe 1768 864 WerFault.exe bu996367.exe 3988 864 WerFault.exe bu996367.exe 1328 864 WerFault.exe bu996367.exe 4280 864 WerFault.exe bu996367.exe 3868 864 WerFault.exe bu996367.exe 4908 864 WerFault.exe bu996367.exe 636 2184 WerFault.exe oneetx.exe 1080 2184 WerFault.exe oneetx.exe 1576 2184 WerFault.exe oneetx.exe 4076 2184 WerFault.exe oneetx.exe 2636 2184 WerFault.exe oneetx.exe 4436 2184 WerFault.exe oneetx.exe 2368 2184 WerFault.exe oneetx.exe 1600 2184 WerFault.exe oneetx.exe 4832 2184 WerFault.exe oneetx.exe 2724 2184 WerFault.exe oneetx.exe 1148 2184 WerFault.exe oneetx.exe 4956 2184 WerFault.exe oneetx.exe 3716 2032 WerFault.exe cor5753.exe 1344 4968 WerFault.exe drk07s57.exe 3764 2184 WerFault.exe oneetx.exe 2164 3248 WerFault.exe oneetx.exe 2760 2184 WerFault.exe oneetx.exe 2192 2184 WerFault.exe oneetx.exe 3236 2184 WerFault.exe oneetx.exe 4568 4120 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
az515808.execor5753.exedrk07s57.exeen551302.exepid process 4136 az515808.exe 4136 az515808.exe 2032 cor5753.exe 2032 cor5753.exe 4968 drk07s57.exe 4968 drk07s57.exe 3668 en551302.exe 3668 en551302.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
az515808.execor5753.exedrk07s57.exeen551302.exedescription pid process Token: SeDebugPrivilege 4136 az515808.exe Token: SeDebugPrivilege 2032 cor5753.exe Token: SeDebugPrivilege 4968 drk07s57.exe Token: SeDebugPrivilege 3668 en551302.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bu996367.exepid process 864 bu996367.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exekina0454.exekina3912.exekina7287.exebu996367.exeoneetx.exedescription pid process target process PID 3016 wrote to memory of 3732 3016 fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exe kina0454.exe PID 3016 wrote to memory of 3732 3016 fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exe kina0454.exe PID 3016 wrote to memory of 3732 3016 fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exe kina0454.exe PID 3732 wrote to memory of 4528 3732 kina0454.exe kina3912.exe PID 3732 wrote to memory of 4528 3732 kina0454.exe kina3912.exe PID 3732 wrote to memory of 4528 3732 kina0454.exe kina3912.exe PID 4528 wrote to memory of 5048 4528 kina3912.exe kina7287.exe PID 4528 wrote to memory of 5048 4528 kina3912.exe kina7287.exe PID 4528 wrote to memory of 5048 4528 kina3912.exe kina7287.exe PID 5048 wrote to memory of 4136 5048 kina7287.exe az515808.exe PID 5048 wrote to memory of 4136 5048 kina7287.exe az515808.exe PID 5048 wrote to memory of 864 5048 kina7287.exe bu996367.exe PID 5048 wrote to memory of 864 5048 kina7287.exe bu996367.exe PID 5048 wrote to memory of 864 5048 kina7287.exe bu996367.exe PID 864 wrote to memory of 2184 864 bu996367.exe oneetx.exe PID 864 wrote to memory of 2184 864 bu996367.exe oneetx.exe PID 864 wrote to memory of 2184 864 bu996367.exe oneetx.exe PID 4528 wrote to memory of 2032 4528 kina3912.exe cor5753.exe PID 4528 wrote to memory of 2032 4528 kina3912.exe cor5753.exe PID 4528 wrote to memory of 2032 4528 kina3912.exe cor5753.exe PID 2184 wrote to memory of 4768 2184 oneetx.exe schtasks.exe PID 2184 wrote to memory of 4768 2184 oneetx.exe schtasks.exe PID 2184 wrote to memory of 4768 2184 oneetx.exe schtasks.exe PID 3732 wrote to memory of 4968 3732 kina0454.exe drk07s57.exe PID 3732 wrote to memory of 4968 3732 kina0454.exe drk07s57.exe PID 3732 wrote to memory of 4968 3732 kina0454.exe drk07s57.exe PID 3016 wrote to memory of 3668 3016 fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exe en551302.exe PID 3016 wrote to memory of 3668 3016 fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exe en551302.exe PID 3016 wrote to memory of 3668 3016 fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exe en551302.exe PID 2184 wrote to memory of 4532 2184 oneetx.exe rundll32.exe PID 2184 wrote to memory of 4532 2184 oneetx.exe rundll32.exe PID 2184 wrote to memory of 4532 2184 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exe"C:\Users\Admin\AppData\Local\Temp\fdcce156b7433f3919eba615a3526b214cde91c16e2c5d2f0bd094df4145474d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina0454.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina0454.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3912.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3912.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7287.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7287.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az515808.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az515808.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu996367.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu996367.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 6966⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 7726⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 8566⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 8646⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 9886⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 9886⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 12166⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 12726⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 13326⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 6927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 10047⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 10127⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 10807⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 10847⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 10807⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 10687⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 11047⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 9927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 7767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 9887⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 8847⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 11247⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 16127⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 15767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2184 -s 16287⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 864 -s 14126⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor5753.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor5753.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2032 -s 10845⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\drk07s57.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\drk07s57.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 13364⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en551302.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en551302.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 864 -ip 8641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2032 -ip 20321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4968 -ip 49681⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2184 -ip 21841⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3248 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3248 -ip 32481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2184 -ip 21841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2184 -ip 21841⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4120 -s 2162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4120 -ip 41201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en551302.exeFilesize
168KB
MD52b8cc43d3b811092316eaa12149d1623
SHA19777a0e8dd389048ca9aba5a070ea2bc9deb3b0a
SHA2565c6d6f5feeaa374947f74f8077028256399d4b15ede7a471d78d0800be6969ed
SHA5129c52a073b3cca423cb40d1b9526fd30498b2c98ce16ef7d950c7b5ef99fbc6ce4ddaca5f8e6b828be53b40a25efcc6dbd815975e48b0158ad6bbc446e6982eed
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en551302.exeFilesize
168KB
MD52b8cc43d3b811092316eaa12149d1623
SHA19777a0e8dd389048ca9aba5a070ea2bc9deb3b0a
SHA2565c6d6f5feeaa374947f74f8077028256399d4b15ede7a471d78d0800be6969ed
SHA5129c52a073b3cca423cb40d1b9526fd30498b2c98ce16ef7d950c7b5ef99fbc6ce4ddaca5f8e6b828be53b40a25efcc6dbd815975e48b0158ad6bbc446e6982eed
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina0454.exeFilesize
921KB
MD59d2083d5e7970424621b65bb0dbcaaf7
SHA1f08eb5deb4564026861905536976d6b5c1f20250
SHA2564ba78c686bb6bf61420f547a1ae336e5df7b989dd6f5830cc8696e638d5c4c7e
SHA512babefc780c62bea96c3bd6333fc4bb066383e66eac817ee3ea8d3938c1962bc9ea9e0dd26e2c33d2976cc7afed1388901ea4c0ee3d40cddfcace33e8b5c2cad0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina0454.exeFilesize
921KB
MD59d2083d5e7970424621b65bb0dbcaaf7
SHA1f08eb5deb4564026861905536976d6b5c1f20250
SHA2564ba78c686bb6bf61420f547a1ae336e5df7b989dd6f5830cc8696e638d5c4c7e
SHA512babefc780c62bea96c3bd6333fc4bb066383e66eac817ee3ea8d3938c1962bc9ea9e0dd26e2c33d2976cc7afed1388901ea4c0ee3d40cddfcace33e8b5c2cad0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\drk07s57.exeFilesize
297KB
MD5ed47fb3c96e022fe48a73363ca0a2c80
SHA15b3328e53e0200d94e83b63d0658255b2ec89b44
SHA2562d5b37f00da8fc0fabdca6fe84d68f99b7295f501af98f3abfa9ce4615ac66a9
SHA512095ba087a8fa9a8e4cce069bbc3200bac8593f1333dbbb979875fa476f9461c99396d10ea7a012aece08063840a74fcfdc396ba275cdc6c54c6f7e9668c43aca
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\drk07s57.exeFilesize
297KB
MD5ed47fb3c96e022fe48a73363ca0a2c80
SHA15b3328e53e0200d94e83b63d0658255b2ec89b44
SHA2562d5b37f00da8fc0fabdca6fe84d68f99b7295f501af98f3abfa9ce4615ac66a9
SHA512095ba087a8fa9a8e4cce069bbc3200bac8593f1333dbbb979875fa476f9461c99396d10ea7a012aece08063840a74fcfdc396ba275cdc6c54c6f7e9668c43aca
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3912.exeFilesize
589KB
MD534d5d709eb0405c2f06cf921fb990749
SHA17ea6988c9ef7ca7de93432565678bd0d58723701
SHA2560ba0f38dace962400d4b2bcd49554e89c7b82271e620871031c2cebe903cd8d3
SHA51224c9d8e2de99db933b9656fb83c74f2959743d1d2607f2773496c6940cc9fdb3f74959fdf57f8fb2d24171da735a1d37b974fe074d3d27462a5fe70a23a80b43
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3912.exeFilesize
589KB
MD534d5d709eb0405c2f06cf921fb990749
SHA17ea6988c9ef7ca7de93432565678bd0d58723701
SHA2560ba0f38dace962400d4b2bcd49554e89c7b82271e620871031c2cebe903cd8d3
SHA51224c9d8e2de99db933b9656fb83c74f2959743d1d2607f2773496c6940cc9fdb3f74959fdf57f8fb2d24171da735a1d37b974fe074d3d27462a5fe70a23a80b43
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor5753.exeFilesize
239KB
MD5be50e7ebcaa01a2dfc5344ed904668b4
SHA1ce8d8381fc4b8fb302c65fe197cfc1fe1e8ce135
SHA25668bc6c5df808000bafb71ec7b38c19ed1ac7d998011201f631a731587d014ebc
SHA512de29cfdf91a1e409cc718235686fba183208301a53d31ebd359c3b96d7800b7d0a65f5d25483b9ba1a84a0976fca54ae9914c9aa7feb68d1ecb4574bd34c64f3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor5753.exeFilesize
239KB
MD5be50e7ebcaa01a2dfc5344ed904668b4
SHA1ce8d8381fc4b8fb302c65fe197cfc1fe1e8ce135
SHA25668bc6c5df808000bafb71ec7b38c19ed1ac7d998011201f631a731587d014ebc
SHA512de29cfdf91a1e409cc718235686fba183208301a53d31ebd359c3b96d7800b7d0a65f5d25483b9ba1a84a0976fca54ae9914c9aa7feb68d1ecb4574bd34c64f3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7287.exeFilesize
316KB
MD578f0a9d38eca4e341b8aab99b38ad452
SHA1e4d93cb0597b9a1c4ddd2ec8d46b83080d81b3ee
SHA256ca0caf7e6572a2bacb38d839d89d0aa89b4858a61d684570dae26f2069596094
SHA512ed726e9c247591f8c8465bbe8e6894c1ee95209f07ef5b0a3fc22ddd8b71f2f138a85c910b09143aa97574a14de86ce740d5d5e6339afdb4d9e421871090a700
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina7287.exeFilesize
316KB
MD578f0a9d38eca4e341b8aab99b38ad452
SHA1e4d93cb0597b9a1c4ddd2ec8d46b83080d81b3ee
SHA256ca0caf7e6572a2bacb38d839d89d0aa89b4858a61d684570dae26f2069596094
SHA512ed726e9c247591f8c8465bbe8e6894c1ee95209f07ef5b0a3fc22ddd8b71f2f138a85c910b09143aa97574a14de86ce740d5d5e6339afdb4d9e421871090a700
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az515808.exeFilesize
11KB
MD52bc53be68540feae2531f8d8646412f3
SHA1f47017b31762c12d905383fd42404657e78bc0dc
SHA2567bb32a032817d13005d548d23f7c14258074926d17c614935cd9a65e1e80e12c
SHA5126b26f0272433f688ad6bc1103437a561ea750056df916644cc222f6d78572596a6c8d379228d83c809af7c723c8afa525a3adbc44f00213f849daa38bf58372a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az515808.exeFilesize
11KB
MD52bc53be68540feae2531f8d8646412f3
SHA1f47017b31762c12d905383fd42404657e78bc0dc
SHA2567bb32a032817d13005d548d23f7c14258074926d17c614935cd9a65e1e80e12c
SHA5126b26f0272433f688ad6bc1103437a561ea750056df916644cc222f6d78572596a6c8d379228d83c809af7c723c8afa525a3adbc44f00213f849daa38bf58372a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu996367.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu996367.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/864-183-0x00000000004C0000-0x00000000004FB000-memory.dmpFilesize
236KB
-
memory/864-182-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/864-167-0x00000000004C0000-0x00000000004FB000-memory.dmpFilesize
236KB
-
memory/2032-196-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-226-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/2032-208-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-210-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-212-0x00000000004B0000-0x00000000004DD000-memory.dmpFilesize
180KB
-
memory/2032-214-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/2032-213-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-216-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/2032-218-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/2032-217-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-220-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-200-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-222-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2032-224-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/2032-225-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/2032-206-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-227-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/2032-204-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-202-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-198-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-188-0x0000000004CE0000-0x0000000005284000-memory.dmpFilesize
5.6MB
-
memory/2032-189-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-190-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-192-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2032-194-0x00000000023B0000-0x00000000023C2000-memory.dmpFilesize
72KB
-
memory/2184-221-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/3668-1171-0x00000000054B0000-0x00000000054C0000-memory.dmpFilesize
64KB
-
memory/3668-1166-0x00000000054B0000-0x00000000054C0000-memory.dmpFilesize
64KB
-
memory/3668-1165-0x0000000000B70000-0x0000000000BA0000-memory.dmpFilesize
192KB
-
memory/4136-161-0x0000000000190000-0x000000000019A000-memory.dmpFilesize
40KB
-
memory/4968-256-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-1151-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4968-254-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-250-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-258-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-260-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-262-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-264-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-266-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-658-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4968-1142-0x0000000005250000-0x0000000005868000-memory.dmpFilesize
6.1MB
-
memory/4968-1143-0x00000000058B0000-0x00000000059BA000-memory.dmpFilesize
1.0MB
-
memory/4968-1144-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4968-1145-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4968-1146-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4968-1148-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/4968-1149-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/4968-252-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-1152-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4968-1153-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4968-1154-0x0000000006590000-0x0000000006606000-memory.dmpFilesize
472KB
-
memory/4968-1155-0x0000000006620000-0x0000000006670000-memory.dmpFilesize
320KB
-
memory/4968-1156-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4968-1157-0x0000000006810000-0x00000000069D2000-memory.dmpFilesize
1.8MB
-
memory/4968-1158-0x00000000069E0000-0x0000000006F0C000-memory.dmpFilesize
5.2MB
-
memory/4968-248-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-246-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-242-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-244-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-240-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-238-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-236-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-235-0x0000000004AE0000-0x0000000004B1F000-memory.dmpFilesize
252KB
-
memory/4968-234-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4968-233-0x0000000004B90000-0x0000000004BA0000-memory.dmpFilesize
64KB
-
memory/4968-232-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB