Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:24
Static task
static1
General
-
Target
a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exe
-
Size
1.0MB
-
MD5
e173ed1dffab1a00637ae5c092513c2c
-
SHA1
0026b8561b99e294f73fbaac5bc538415d7dc88b
-
SHA256
a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f
-
SHA512
d0637c5abd9e3b0a20ff970f574047dc3c0051f50ed602447790284bdb93dec216a40442f9d23e0274d643ead78b5a6d4a2f9510d82b70c90dda12e72d0811a1
-
SSDEEP
24576:7ytQgOKtCsnbKNHNa98WaGrBfiRDBwkuBmxf1aooV2:utTCUyN0aGrYRlwkumxw
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
brat
176.113.115.145:4125
-
auth_value
1f9c658aed2f70f42f99a57a005561cf
Signatures
-
Processes:
az504287.execor9302.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az504287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az504287.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cor9302.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cor9302.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cor9302.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az504287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az504287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az504287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az504287.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cor9302.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cor9302.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cor9302.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/5100-232-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-234-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-231-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-236-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-238-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-240-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-242-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-244-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-246-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-249-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-256-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-252-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-258-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-260-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-262-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-264-0x0000000004960000-0x000000000499F000-memory.dmp family_redline behavioral1/memory/5100-266-0x0000000004960000-0x000000000499F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bu251664.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation bu251664.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 11 IoCs
Processes:
kina2109.exekina3476.exekina1074.exeaz504287.exebu251664.exeoneetx.execor9302.exedlU10s94.exeen078440.exeoneetx.exeoneetx.exepid process 3556 kina2109.exe 4880 kina3476.exe 1940 kina1074.exe 3328 az504287.exe 3612 bu251664.exe 2196 oneetx.exe 1632 cor9302.exe 5100 dlU10s94.exe 4556 en078440.exe 3884 oneetx.exe 3084 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3144 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
az504287.execor9302.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az504287.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cor9302.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cor9302.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
kina1074.exea75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exekina2109.exekina3476.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kina1074.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina2109.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina2109.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina3476.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kina3476.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina1074.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4780 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3552 3612 WerFault.exe bu251664.exe 5072 3612 WerFault.exe bu251664.exe 1524 3612 WerFault.exe bu251664.exe 4356 3612 WerFault.exe bu251664.exe 4068 3612 WerFault.exe bu251664.exe 1528 3612 WerFault.exe bu251664.exe 1492 3612 WerFault.exe bu251664.exe 3680 3612 WerFault.exe bu251664.exe 900 3612 WerFault.exe bu251664.exe 2344 3612 WerFault.exe bu251664.exe 4340 2196 WerFault.exe oneetx.exe 2508 2196 WerFault.exe oneetx.exe 4776 2196 WerFault.exe oneetx.exe 1048 2196 WerFault.exe oneetx.exe 3368 2196 WerFault.exe oneetx.exe 548 2196 WerFault.exe oneetx.exe 1304 2196 WerFault.exe oneetx.exe 1848 2196 WerFault.exe oneetx.exe 1868 2196 WerFault.exe oneetx.exe 1020 2196 WerFault.exe oneetx.exe 1484 2196 WerFault.exe oneetx.exe 2844 2196 WerFault.exe oneetx.exe 904 1632 WerFault.exe cor9302.exe 4136 5100 WerFault.exe dlU10s94.exe 5060 2196 WerFault.exe oneetx.exe 2888 2196 WerFault.exe oneetx.exe 4476 2196 WerFault.exe oneetx.exe 4580 3884 WerFault.exe oneetx.exe 2804 2196 WerFault.exe oneetx.exe 4548 3084 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
az504287.execor9302.exedlU10s94.exeen078440.exepid process 3328 az504287.exe 3328 az504287.exe 1632 cor9302.exe 1632 cor9302.exe 5100 dlU10s94.exe 5100 dlU10s94.exe 4556 en078440.exe 4556 en078440.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
az504287.execor9302.exedlU10s94.exeen078440.exedescription pid process Token: SeDebugPrivilege 3328 az504287.exe Token: SeDebugPrivilege 1632 cor9302.exe Token: SeDebugPrivilege 5100 dlU10s94.exe Token: SeDebugPrivilege 4556 en078440.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bu251664.exepid process 3612 bu251664.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exekina2109.exekina3476.exekina1074.exebu251664.exeoneetx.exedescription pid process target process PID 368 wrote to memory of 3556 368 a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exe kina2109.exe PID 368 wrote to memory of 3556 368 a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exe kina2109.exe PID 368 wrote to memory of 3556 368 a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exe kina2109.exe PID 3556 wrote to memory of 4880 3556 kina2109.exe kina3476.exe PID 3556 wrote to memory of 4880 3556 kina2109.exe kina3476.exe PID 3556 wrote to memory of 4880 3556 kina2109.exe kina3476.exe PID 4880 wrote to memory of 1940 4880 kina3476.exe kina1074.exe PID 4880 wrote to memory of 1940 4880 kina3476.exe kina1074.exe PID 4880 wrote to memory of 1940 4880 kina3476.exe kina1074.exe PID 1940 wrote to memory of 3328 1940 kina1074.exe az504287.exe PID 1940 wrote to memory of 3328 1940 kina1074.exe az504287.exe PID 1940 wrote to memory of 3612 1940 kina1074.exe bu251664.exe PID 1940 wrote to memory of 3612 1940 kina1074.exe bu251664.exe PID 1940 wrote to memory of 3612 1940 kina1074.exe bu251664.exe PID 3612 wrote to memory of 2196 3612 bu251664.exe oneetx.exe PID 3612 wrote to memory of 2196 3612 bu251664.exe oneetx.exe PID 3612 wrote to memory of 2196 3612 bu251664.exe oneetx.exe PID 4880 wrote to memory of 1632 4880 kina3476.exe cor9302.exe PID 4880 wrote to memory of 1632 4880 kina3476.exe cor9302.exe PID 4880 wrote to memory of 1632 4880 kina3476.exe cor9302.exe PID 2196 wrote to memory of 1760 2196 oneetx.exe schtasks.exe PID 2196 wrote to memory of 1760 2196 oneetx.exe schtasks.exe PID 2196 wrote to memory of 1760 2196 oneetx.exe schtasks.exe PID 3556 wrote to memory of 5100 3556 kina2109.exe dlU10s94.exe PID 3556 wrote to memory of 5100 3556 kina2109.exe dlU10s94.exe PID 3556 wrote to memory of 5100 3556 kina2109.exe dlU10s94.exe PID 368 wrote to memory of 4556 368 a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exe en078440.exe PID 368 wrote to memory of 4556 368 a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exe en078440.exe PID 368 wrote to memory of 4556 368 a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exe en078440.exe PID 2196 wrote to memory of 3144 2196 oneetx.exe rundll32.exe PID 2196 wrote to memory of 3144 2196 oneetx.exe rundll32.exe PID 2196 wrote to memory of 3144 2196 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exe"C:\Users\Admin\AppData\Local\Temp\a75ac3cadbbed675cf208c16558d9513626e81887ddeddd2e33ef08f3954e39f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2109.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2109.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3476.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3476.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina1074.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina1074.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az504287.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az504287.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu251664.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu251664.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 6966⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 7806⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 8566⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 9526⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 8726⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 8726⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 12166⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 12086⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 13166⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 6927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 10127⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 10207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 10807⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 11007⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 11207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 11287⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 11527⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 10007⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 13127⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 13207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 7287⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 10727⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 16167⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 14007⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 16447⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 13606⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor9302.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor9302.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 10845⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dlU10s94.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dlU10s94.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5100 -s 13484⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en078440.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en078440.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3612 -ip 36121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3612 -ip 36121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3612 -ip 36121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3612 -ip 36121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3612 -ip 36121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3612 -ip 36121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3612 -ip 36121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3612 -ip 36121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3612 -ip 36121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3612 -ip 36121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1632 -ip 16321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5100 -ip 51001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 2196 -ip 21961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2196 -ip 21961⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 3884 -ip 38841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2196 -ip 21961⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 3322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3084 -ip 30841⤵
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en078440.exeFilesize
168KB
MD526ebb6402bfdfef3b5f2fe3540cd8589
SHA1af50025f5335405141e28249cdee15e5e4e6089e
SHA2562676022ec4316b53dbe58646452746d258b2e029ee61f4e6b226c647647d8bd8
SHA51204d0ea4b64f8eeb3f05d8f97c16dbc0007b7355b7521ce65e5569f9bdcee46054c48361bc084aeb87ab8e03306880f6c7201b00a57d0a2dbe0f027dde011a9a7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en078440.exeFilesize
168KB
MD526ebb6402bfdfef3b5f2fe3540cd8589
SHA1af50025f5335405141e28249cdee15e5e4e6089e
SHA2562676022ec4316b53dbe58646452746d258b2e029ee61f4e6b226c647647d8bd8
SHA51204d0ea4b64f8eeb3f05d8f97c16dbc0007b7355b7521ce65e5569f9bdcee46054c48361bc084aeb87ab8e03306880f6c7201b00a57d0a2dbe0f027dde011a9a7
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2109.exeFilesize
920KB
MD50626edca5761873e6a968ea9aa3059d2
SHA17e7aede699d98fad4159af4920f54485af8fff72
SHA256f3e4b178028505cae45342c88acfc132aa1b4716eccf14f388b6784a80d3c050
SHA51273f5d9d8cfdecda54b8347139703416e3217767dbc69d5712cb04b8e68bac6d2cffd5f7f046b8d9972a2cb49ec7034bf1ac7c26c9e623256fc00c2f415c8a134
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina2109.exeFilesize
920KB
MD50626edca5761873e6a968ea9aa3059d2
SHA17e7aede699d98fad4159af4920f54485af8fff72
SHA256f3e4b178028505cae45342c88acfc132aa1b4716eccf14f388b6784a80d3c050
SHA51273f5d9d8cfdecda54b8347139703416e3217767dbc69d5712cb04b8e68bac6d2cffd5f7f046b8d9972a2cb49ec7034bf1ac7c26c9e623256fc00c2f415c8a134
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dlU10s94.exeFilesize
297KB
MD5d5ba5ea8ce86808fd6815cb5477a8a30
SHA1d7449999d7d1c03e1845d56cc4f46883e9eaace2
SHA2560a9cb1f59a5231bbcacbb925d969eb0c613c638f24b8c314cafcc284369f04a7
SHA512bf3c7d2579598e9f8ee0d1650c7a3c8b77b47218a17d0bc1dfbc8aa495968f3b489844bea82eef362cc90d3711ba7e941882fd755cfa849de1907680a8f126ab
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dlU10s94.exeFilesize
297KB
MD5d5ba5ea8ce86808fd6815cb5477a8a30
SHA1d7449999d7d1c03e1845d56cc4f46883e9eaace2
SHA2560a9cb1f59a5231bbcacbb925d969eb0c613c638f24b8c314cafcc284369f04a7
SHA512bf3c7d2579598e9f8ee0d1650c7a3c8b77b47218a17d0bc1dfbc8aa495968f3b489844bea82eef362cc90d3711ba7e941882fd755cfa849de1907680a8f126ab
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3476.exeFilesize
589KB
MD5cee00698261a331442c1dbeb789c4f5b
SHA1f93cb026a705ca53e3d400c069064552ac3002bb
SHA2568f97357e2baf706adf2725b597bc8a903f9fc57cabda97c0d1069961f2d42430
SHA512223b89ad0c9570cac3b711ff8e21902c0b2a76d6173cdb5eda5fe2834918ed6cde3e05c926c944b6740d566b7706819cd1d7cc06e0b8d6fb30d1e056ba26118c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3476.exeFilesize
589KB
MD5cee00698261a331442c1dbeb789c4f5b
SHA1f93cb026a705ca53e3d400c069064552ac3002bb
SHA2568f97357e2baf706adf2725b597bc8a903f9fc57cabda97c0d1069961f2d42430
SHA512223b89ad0c9570cac3b711ff8e21902c0b2a76d6173cdb5eda5fe2834918ed6cde3e05c926c944b6740d566b7706819cd1d7cc06e0b8d6fb30d1e056ba26118c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor9302.exeFilesize
239KB
MD5fcc435ca3c4029744fb7a130aa28852b
SHA1ace7b5999164809b05af87557bbdf596b5ff48e3
SHA2565b9160c6515f5134deb4ebb40d8dab72ef9c738703c98d19a181d08e2ebe2dde
SHA5120d6e2fe5d4f098095653534e69b3f7a573c1b4c3ba3e9ccedcb316912364c6f08cb028eb9f68ae896920e0fc17eafb7f2d0c5cde8d2266d944a5192632811a02
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor9302.exeFilesize
239KB
MD5fcc435ca3c4029744fb7a130aa28852b
SHA1ace7b5999164809b05af87557bbdf596b5ff48e3
SHA2565b9160c6515f5134deb4ebb40d8dab72ef9c738703c98d19a181d08e2ebe2dde
SHA5120d6e2fe5d4f098095653534e69b3f7a573c1b4c3ba3e9ccedcb316912364c6f08cb028eb9f68ae896920e0fc17eafb7f2d0c5cde8d2266d944a5192632811a02
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina1074.exeFilesize
316KB
MD5998900000c8d31a514d7b5a23a15d45f
SHA1087a26e59be03b50758d7da375fbf93ec46ba6e7
SHA256af0db358853cdafe0141ad273ebdab07fbbb82b53d659d6bda44a64e93dad749
SHA5120ca75e4d899157027392ee8bf4012d8eb7f71adb3dd4e6ce0420fc2ff408b5e6749ade82be9b56676ab05badd5d8cc3aacacd97fc50936ac998663767d34b9f8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina1074.exeFilesize
316KB
MD5998900000c8d31a514d7b5a23a15d45f
SHA1087a26e59be03b50758d7da375fbf93ec46ba6e7
SHA256af0db358853cdafe0141ad273ebdab07fbbb82b53d659d6bda44a64e93dad749
SHA5120ca75e4d899157027392ee8bf4012d8eb7f71adb3dd4e6ce0420fc2ff408b5e6749ade82be9b56676ab05badd5d8cc3aacacd97fc50936ac998663767d34b9f8
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az504287.exeFilesize
11KB
MD5fc3e7e0018bacde54ae70108c112ed7a
SHA16cd0d2dfeb5702f340957f7c70ebfb1dda231897
SHA2561c9ba9059630d1d525233c8a073ffc0e1e6e9bec68e916296e7b65d7e9dce4ad
SHA512853abac9576e336e30e344337757746169bc367489a45f919bd33619aacd5068728983abbf16eb4f1df4b4f0a65020f140b552107ed5db1c8c3f335a80175b02
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az504287.exeFilesize
11KB
MD5fc3e7e0018bacde54ae70108c112ed7a
SHA16cd0d2dfeb5702f340957f7c70ebfb1dda231897
SHA2561c9ba9059630d1d525233c8a073ffc0e1e6e9bec68e916296e7b65d7e9dce4ad
SHA512853abac9576e336e30e344337757746169bc367489a45f919bd33619aacd5068728983abbf16eb4f1df4b4f0a65020f140b552107ed5db1c8c3f335a80175b02
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu251664.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu251664.exeFilesize
231KB
MD55a531a1495614605383afe7a35731a7a
SHA1f00c58c5745c7adeb14b5b176fc0cd8d6d694bb6
SHA2562aa40e53a153a68c6fd28793fdd06fa3bcbe4658820261607f6f4f8ecd3b8c2d
SHA512906eb4afa865e09a68e5f40e48837bf576ced8218e8545daa25bd1ac0bea2087f77c9905d143c243cb3cbf04b3472c049620e2b51ccf243ac75f7134376e4aa3
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1632-224-0x00000000020E0000-0x00000000020F0000-memory.dmpFilesize
64KB
-
memory/1632-222-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1632-198-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-200-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-202-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-204-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-206-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-208-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-210-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-212-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-214-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-216-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-218-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-220-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-188-0x0000000004AA0000-0x0000000005044000-memory.dmpFilesize
5.6MB
-
memory/1632-196-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-223-0x00000000020E0000-0x00000000020F0000-memory.dmpFilesize
64KB
-
memory/1632-194-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-226-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1632-193-0x0000000002320000-0x0000000002332000-memory.dmpFilesize
72KB
-
memory/1632-192-0x00000000020E0000-0x00000000020F0000-memory.dmpFilesize
64KB
-
memory/1632-191-0x00000000020E0000-0x00000000020F0000-memory.dmpFilesize
64KB
-
memory/1632-190-0x00000000020E0000-0x00000000020F0000-memory.dmpFilesize
64KB
-
memory/1632-189-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB
-
memory/2196-221-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/3328-161-0x0000000000030000-0x000000000003A000-memory.dmpFilesize
40KB
-
memory/3612-183-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/3612-182-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/3612-167-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/4556-1165-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4556-1163-0x00000000002D0000-0x0000000000300000-memory.dmpFilesize
192KB
-
memory/5100-232-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-249-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-254-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/5100-256-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-253-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/5100-252-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-258-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-260-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-262-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-264-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-266-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-1141-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/5100-1142-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/5100-1143-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/5100-1144-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/5100-1145-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/5100-1147-0x0000000005CF0000-0x0000000005D82000-memory.dmpFilesize
584KB
-
memory/5100-1148-0x0000000005D90000-0x0000000005DF6000-memory.dmpFilesize
408KB
-
memory/5100-1150-0x00000000064A0000-0x0000000006516000-memory.dmpFilesize
472KB
-
memory/5100-1151-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/5100-1152-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/5100-1153-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/5100-1154-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/5100-1155-0x00000000067D0000-0x0000000006992000-memory.dmpFilesize
1.8MB
-
memory/5100-1156-0x00000000069F0000-0x0000000006F1C000-memory.dmpFilesize
5.2MB
-
memory/5100-1157-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/5100-251-0x00000000049D0000-0x00000000049E0000-memory.dmpFilesize
64KB
-
memory/5100-248-0x00000000008C0000-0x000000000090B000-memory.dmpFilesize
300KB
-
memory/5100-246-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-244-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-242-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-240-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-238-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-236-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-231-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB
-
memory/5100-234-0x0000000004960000-0x000000000499F000-memory.dmpFilesize
252KB