Analysis
-
max time kernel
142s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:40
Static task
static1
General
-
Target
361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exe
-
Size
1.0MB
-
MD5
60afb0d02e5b6966efdfd830193dd810
-
SHA1
f8d644fb6b2e5aaadf4b622a8a5b7aed558dfeab
-
SHA256
361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c
-
SHA512
9da0700f84097eec68190168a7d4d34ccce29c1537123ae9228ff469ec444fd231874138ef380c21e76fbec74b6ba751b506a5a5653fc9d02ebae42d0def3c2a
-
SSDEEP
24576:UylGD30llwqHX2puK/fYBrVGsQneyxfMCX99:jl2/qH6uKoqsQneyxECt
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
brat
176.113.115.145:4125
-
auth_value
1f9c658aed2f70f42f99a57a005561cf
Signatures
-
Processes:
az061186.execor9721.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az061186.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az061186.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cor9721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cor9721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cor9721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cor9721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cor9721.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az061186.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cor9721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az061186.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az061186.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az061186.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/4464-232-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-234-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-237-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-239-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-241-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-243-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-245-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-247-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-249-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-251-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-253-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-255-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-257-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-259-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-261-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-263-0x0000000002630000-0x000000000266F000-memory.dmp family_redline behavioral1/memory/4464-265-0x0000000002630000-0x000000000266F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
oneetx.exebu856869.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation bu856869.exe -
Executes dropped EXE 11 IoCs
Processes:
kina4119.exekina4805.exekina9673.exeaz061186.exebu856869.exeoneetx.execor9721.exedFZ32s77.exeoneetx.exeen778434.exeoneetx.exepid process 1292 kina4119.exe 2180 kina4805.exe 1568 kina9673.exe 1368 az061186.exe 1676 bu856869.exe 4140 oneetx.exe 1712 cor9721.exe 4464 dFZ32s77.exe 3740 oneetx.exe 440 en778434.exe 2344 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2168 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
az061186.execor9721.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az061186.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cor9721.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cor9721.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
kina4119.exekina4805.exekina9673.exe361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina4119.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina4805.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kina4805.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina9673.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kina9673.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina4119.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3464 1676 WerFault.exe bu856869.exe 3020 1676 WerFault.exe bu856869.exe 2256 1676 WerFault.exe bu856869.exe 5068 1676 WerFault.exe bu856869.exe 1420 1676 WerFault.exe bu856869.exe 3168 1676 WerFault.exe bu856869.exe 3856 1676 WerFault.exe bu856869.exe 5000 1676 WerFault.exe bu856869.exe 320 1676 WerFault.exe bu856869.exe 3784 1676 WerFault.exe bu856869.exe 2288 4140 WerFault.exe oneetx.exe 2620 4140 WerFault.exe oneetx.exe 2648 4140 WerFault.exe oneetx.exe 2156 4140 WerFault.exe oneetx.exe 2452 4140 WerFault.exe oneetx.exe 4400 4140 WerFault.exe oneetx.exe 3188 4140 WerFault.exe oneetx.exe 3700 4140 WerFault.exe oneetx.exe 2136 4140 WerFault.exe oneetx.exe 2176 4140 WerFault.exe oneetx.exe 2516 4140 WerFault.exe oneetx.exe 4684 4140 WerFault.exe oneetx.exe 2972 1712 WerFault.exe cor9721.exe 3348 3740 WerFault.exe oneetx.exe 3888 4464 WerFault.exe dFZ32s77.exe 2252 4140 WerFault.exe oneetx.exe 4864 4140 WerFault.exe oneetx.exe 2688 4140 WerFault.exe oneetx.exe 3036 2344 WerFault.exe oneetx.exe 264 4140 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
az061186.execor9721.exedFZ32s77.exeen778434.exepid process 1368 az061186.exe 1368 az061186.exe 1712 cor9721.exe 1712 cor9721.exe 4464 dFZ32s77.exe 4464 dFZ32s77.exe 440 en778434.exe 440 en778434.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
az061186.execor9721.exedFZ32s77.exeen778434.exedescription pid process Token: SeDebugPrivilege 1368 az061186.exe Token: SeDebugPrivilege 1712 cor9721.exe Token: SeDebugPrivilege 4464 dFZ32s77.exe Token: SeDebugPrivilege 440 en778434.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bu856869.exepid process 1676 bu856869.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exekina4119.exekina4805.exekina9673.exebu856869.exeoneetx.exedescription pid process target process PID 4284 wrote to memory of 1292 4284 361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exe kina4119.exe PID 4284 wrote to memory of 1292 4284 361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exe kina4119.exe PID 4284 wrote to memory of 1292 4284 361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exe kina4119.exe PID 1292 wrote to memory of 2180 1292 kina4119.exe kina4805.exe PID 1292 wrote to memory of 2180 1292 kina4119.exe kina4805.exe PID 1292 wrote to memory of 2180 1292 kina4119.exe kina4805.exe PID 2180 wrote to memory of 1568 2180 kina4805.exe kina9673.exe PID 2180 wrote to memory of 1568 2180 kina4805.exe kina9673.exe PID 2180 wrote to memory of 1568 2180 kina4805.exe kina9673.exe PID 1568 wrote to memory of 1368 1568 kina9673.exe az061186.exe PID 1568 wrote to memory of 1368 1568 kina9673.exe az061186.exe PID 1568 wrote to memory of 1676 1568 kina9673.exe bu856869.exe PID 1568 wrote to memory of 1676 1568 kina9673.exe bu856869.exe PID 1568 wrote to memory of 1676 1568 kina9673.exe bu856869.exe PID 1676 wrote to memory of 4140 1676 bu856869.exe oneetx.exe PID 1676 wrote to memory of 4140 1676 bu856869.exe oneetx.exe PID 1676 wrote to memory of 4140 1676 bu856869.exe oneetx.exe PID 2180 wrote to memory of 1712 2180 kina4805.exe cor9721.exe PID 2180 wrote to memory of 1712 2180 kina4805.exe cor9721.exe PID 2180 wrote to memory of 1712 2180 kina4805.exe cor9721.exe PID 4140 wrote to memory of 2428 4140 oneetx.exe schtasks.exe PID 4140 wrote to memory of 2428 4140 oneetx.exe schtasks.exe PID 4140 wrote to memory of 2428 4140 oneetx.exe schtasks.exe PID 1292 wrote to memory of 4464 1292 kina4119.exe dFZ32s77.exe PID 1292 wrote to memory of 4464 1292 kina4119.exe dFZ32s77.exe PID 1292 wrote to memory of 4464 1292 kina4119.exe dFZ32s77.exe PID 4284 wrote to memory of 440 4284 361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exe en778434.exe PID 4284 wrote to memory of 440 4284 361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exe en778434.exe PID 4284 wrote to memory of 440 4284 361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exe en778434.exe PID 4140 wrote to memory of 2168 4140 oneetx.exe rundll32.exe PID 4140 wrote to memory of 2168 4140 oneetx.exe rundll32.exe PID 4140 wrote to memory of 2168 4140 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exe"C:\Users\Admin\AppData\Local\Temp\361d951e822eca90ff0f898152bf6d10c9dd1566e47f560db3210755c1e5514c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4119.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4119.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4805.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4805.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9673.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9673.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az061186.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az061186.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu856869.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu856869.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 6966⤵
- Program crash
PID:3464 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 7806⤵
- Program crash
PID:3020 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 8566⤵
- Program crash
PID:2256 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 8646⤵
- Program crash
PID:5068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 9806⤵
- Program crash
PID:1420 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 9806⤵
- Program crash
PID:3168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 12206⤵
- Program crash
PID:3856 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 12526⤵
- Program crash
PID:5000 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 13206⤵
- Program crash
PID:320 -
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 6927⤵
- Program crash
PID:2288 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 8807⤵
- Program crash
PID:2620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 9887⤵
- Program crash
PID:2648 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 9847⤵
- Program crash
PID:2156 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 9927⤵
- Program crash
PID:2452 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 9927⤵
- Program crash
PID:4400 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 11087⤵
- Program crash
PID:3188 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F7⤵
- Creates scheduled task(s)
PID:2428 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 10207⤵
- Program crash
PID:3700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 6927⤵
- Program crash
PID:2136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 7807⤵
- Program crash
PID:2176 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 11847⤵
- Program crash
PID:2516 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 14407⤵
- Program crash
PID:4684 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 9207⤵
- Program crash
PID:2252 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 14447⤵
- Program crash
PID:4864 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
PID:2168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 15807⤵
- Program crash
PID:2688 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 16727⤵
- Program crash
PID:264 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1676 -s 7446⤵
- Program crash
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor9721.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor9721.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1712 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 10845⤵
- Program crash
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dFZ32s77.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dFZ32s77.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4464 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4464 -s 13484⤵
- Program crash
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en778434.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en778434.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1676 -ip 16761⤵PID:4408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1676 -ip 16761⤵PID:1140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1676 -ip 16761⤵PID:2684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1676 -ip 16761⤵PID:3144
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1676 -ip 16761⤵PID:2572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 1676 -ip 16761⤵PID:1752
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1676 -ip 16761⤵PID:2188
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 1676 -ip 16761⤵PID:2784
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1676 -ip 16761⤵PID:2120
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1676 -ip 16761⤵PID:4668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4140 -ip 41401⤵PID:448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4140 -ip 41401⤵PID:4944
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4140 -ip 41401⤵PID:2400
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4140 -ip 41401⤵PID:3096
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4140 -ip 41401⤵PID:4972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4140 -ip 41401⤵PID:2112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4140 -ip 41401⤵PID:440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4140 -ip 41401⤵PID:5092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4140 -ip 41401⤵PID:2880
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4140 -ip 41401⤵PID:1916
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4140 -ip 41401⤵PID:3360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4140 -ip 41401⤵PID:4824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1712 -ip 17121⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:3740 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3740 -s 3242⤵
- Program crash
PID:3348
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 3740 -ip 37401⤵PID:4440
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4464 -ip 44641⤵PID:2112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 4140 -ip 41401⤵PID:1028
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4140 -ip 41401⤵PID:4728
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4140 -ip 41401⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:2344 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 3122⤵
- Program crash
PID:3036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 2344 -ip 23441⤵PID:688
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 4140 -ip 41401⤵PID:3120
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en778434.exeFilesize
168KB
MD5b8fd2f37aa09a674eda3bf4765a4ce9d
SHA14032484a68eae8ee650a9d6e54acd8889c424ba1
SHA2564d9814cfd8d1e3fb174b431740cdad46bfdbe1623e203692ce3b0f4e1954dcd2
SHA512fd85146a927a219af8f03522911df4bb09c1e0a06d56ad310071c4bb03ddcfebe21708f550b13f402a9c711f381bd01f8274b34ebda435f7a199806764dbfb17
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en778434.exeFilesize
168KB
MD5b8fd2f37aa09a674eda3bf4765a4ce9d
SHA14032484a68eae8ee650a9d6e54acd8889c424ba1
SHA2564d9814cfd8d1e3fb174b431740cdad46bfdbe1623e203692ce3b0f4e1954dcd2
SHA512fd85146a927a219af8f03522911df4bb09c1e0a06d56ad310071c4bb03ddcfebe21708f550b13f402a9c711f381bd01f8274b34ebda435f7a199806764dbfb17
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4119.exeFilesize
921KB
MD5ad3f3af6eb51e2b8ae4c4d32b427e00a
SHA12068672baa6b4a0af5530ed7451b8b58f6691a3c
SHA256600ac514eff1a67baef403470231a97b0e278dd72e25f93e4da9150bf497ee00
SHA512bc2f4927c36532ce124502785126e8bd0347f760d73b255c8d11ea280a58fd51edead0b8137e507ace616339e1be5fc697d27793f04097d3d18dbaf86e877369
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina4119.exeFilesize
921KB
MD5ad3f3af6eb51e2b8ae4c4d32b427e00a
SHA12068672baa6b4a0af5530ed7451b8b58f6691a3c
SHA256600ac514eff1a67baef403470231a97b0e278dd72e25f93e4da9150bf497ee00
SHA512bc2f4927c36532ce124502785126e8bd0347f760d73b255c8d11ea280a58fd51edead0b8137e507ace616339e1be5fc697d27793f04097d3d18dbaf86e877369
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dFZ32s77.exeFilesize
297KB
MD5e8d02f0f8cfb9ed5a0efe318405db748
SHA185ec0890c1ef875ef43d5eaa031f0e013a957043
SHA256b3ee716fcae23dde4c6200c7901066814676ee1c1050ae2c8614d496ddc6271a
SHA5120f5cd5326cf32dc9743d672f7ddecdd90ad1e44adddcc6d3aa43f4b4e84a70874aafa816536b03cac2e1eb8b39450ef9e58355c48dcb7d2383df1aaf21d33e1c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dFZ32s77.exeFilesize
297KB
MD5e8d02f0f8cfb9ed5a0efe318405db748
SHA185ec0890c1ef875ef43d5eaa031f0e013a957043
SHA256b3ee716fcae23dde4c6200c7901066814676ee1c1050ae2c8614d496ddc6271a
SHA5120f5cd5326cf32dc9743d672f7ddecdd90ad1e44adddcc6d3aa43f4b4e84a70874aafa816536b03cac2e1eb8b39450ef9e58355c48dcb7d2383df1aaf21d33e1c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4805.exeFilesize
589KB
MD5d0662b6b779a290ccb0fdc0304975b42
SHA1b22f83031a53847232723a915ef45906dc7d764f
SHA2562439ed7e922fa792bbd853bbef70a5f21bc4b577c1fb0bef1f48eb5235b56150
SHA51210448caa705e80b5de62cfdc8717221d5958880f18bd5bfbc380344f7d1db3f94bebc7f29192e3fbd2ebbf884034a6206a77aed4dbebb0dc9312924edde0ca32
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina4805.exeFilesize
589KB
MD5d0662b6b779a290ccb0fdc0304975b42
SHA1b22f83031a53847232723a915ef45906dc7d764f
SHA2562439ed7e922fa792bbd853bbef70a5f21bc4b577c1fb0bef1f48eb5235b56150
SHA51210448caa705e80b5de62cfdc8717221d5958880f18bd5bfbc380344f7d1db3f94bebc7f29192e3fbd2ebbf884034a6206a77aed4dbebb0dc9312924edde0ca32
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor9721.exeFilesize
239KB
MD5bbac0160fb2ab035f35d50cc7e269295
SHA186bd555ba4150f146668d76fe99738d4abd49715
SHA2562015288d9af8c9685267313528f759295aeaa991f47b63e8a0e428c4fe7fdb34
SHA512a061d4d45fe40d9000195e92c7703aff6532a88cabe0e6670bc3ed035c584fda67916b47ba8e2ab5df4166ac725357d1c061727735155cb2b77cc35f88558011
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor9721.exeFilesize
239KB
MD5bbac0160fb2ab035f35d50cc7e269295
SHA186bd555ba4150f146668d76fe99738d4abd49715
SHA2562015288d9af8c9685267313528f759295aeaa991f47b63e8a0e428c4fe7fdb34
SHA512a061d4d45fe40d9000195e92c7703aff6532a88cabe0e6670bc3ed035c584fda67916b47ba8e2ab5df4166ac725357d1c061727735155cb2b77cc35f88558011
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9673.exeFilesize
316KB
MD57307eb353f0644700feeadac24f3808d
SHA161f46b0ab4a14258f5bc8e6db7280b89063bf190
SHA256022453f6329fdf4e393db0fc89bf7f0944f359669d1acebbcc7722f2d25c46aa
SHA51201086154c2e660062f8044639c6833f5b5f7728b936ac6d74001aa40833ef262eb1e9911dc53d079adb819cfe08378011d516579023cf600a93d51fbb82a08ff
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina9673.exeFilesize
316KB
MD57307eb353f0644700feeadac24f3808d
SHA161f46b0ab4a14258f5bc8e6db7280b89063bf190
SHA256022453f6329fdf4e393db0fc89bf7f0944f359669d1acebbcc7722f2d25c46aa
SHA51201086154c2e660062f8044639c6833f5b5f7728b936ac6d74001aa40833ef262eb1e9911dc53d079adb819cfe08378011d516579023cf600a93d51fbb82a08ff
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az061186.exeFilesize
11KB
MD596a700dfd78dbb89b4711adbeb104fc1
SHA1d0488c4ac63de2055e7c3cd651a1f99d38b36985
SHA256ceeeb0a9233114d46bd6a6de4b443bac362bee7c54352df096f8e4c901580ef3
SHA5122e100cf3a07f1dcd82dc5eca4013684a114b850812af8b803e8f663659cf3f710c0cf61cd041ab10b360d0b2dcd0c09db697798ab9604d70a1db9602f9a19abc
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az061186.exeFilesize
11KB
MD596a700dfd78dbb89b4711adbeb104fc1
SHA1d0488c4ac63de2055e7c3cd651a1f99d38b36985
SHA256ceeeb0a9233114d46bd6a6de4b443bac362bee7c54352df096f8e4c901580ef3
SHA5122e100cf3a07f1dcd82dc5eca4013684a114b850812af8b803e8f663659cf3f710c0cf61cd041ab10b360d0b2dcd0c09db697798ab9604d70a1db9602f9a19abc
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu856869.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu856869.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/440-1167-0x0000000005410000-0x0000000005420000-memory.dmpFilesize
64KB
-
memory/440-1166-0x0000000000B90000-0x0000000000BC0000-memory.dmpFilesize
192KB
-
memory/1368-161-0x0000000000CA0000-0x0000000000CAA000-memory.dmpFilesize
40KB
-
memory/1676-182-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/1676-167-0x00000000005E0000-0x000000000061B000-memory.dmpFilesize
236KB
-
memory/1712-192-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-191-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB
-
memory/1712-210-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-212-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-214-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-216-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-218-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-202-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-220-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1712-221-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/1712-222-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/1712-223-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/1712-225-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1712-206-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-204-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-187-0x0000000004DA0000-0x0000000005344000-memory.dmpFilesize
5.6MB
-
memory/1712-189-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-188-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-193-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/1712-208-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-194-0x0000000004D90000-0x0000000004DA0000-memory.dmpFilesize
64KB
-
memory/1712-196-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-198-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/1712-200-0x0000000002500000-0x0000000002512000-memory.dmpFilesize
72KB
-
memory/4140-219-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/4464-257-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-1148-0x0000000005C50000-0x0000000005CB6000-memory.dmpFilesize
408KB
-
memory/4464-249-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-251-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-253-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-255-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-245-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-259-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-261-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-263-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-265-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-1140-0x00000000051F0000-0x0000000005808000-memory.dmpFilesize
6.1MB
-
memory/4464-1141-0x0000000005810000-0x000000000591A000-memory.dmpFilesize
1.0MB
-
memory/4464-1142-0x0000000004BB0000-0x0000000004BC2000-memory.dmpFilesize
72KB
-
memory/4464-1143-0x0000000004BD0000-0x0000000004C0C000-memory.dmpFilesize
240KB
-
memory/4464-1144-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4464-1147-0x0000000005BB0000-0x0000000005C42000-memory.dmpFilesize
584KB
-
memory/4464-247-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-1150-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4464-1151-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4464-1149-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4464-243-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-1155-0x00000000065B0000-0x0000000006626000-memory.dmpFilesize
472KB
-
memory/4464-1156-0x0000000006640000-0x0000000006690000-memory.dmpFilesize
320KB
-
memory/4464-1157-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4464-1158-0x00000000066B0000-0x0000000006872000-memory.dmpFilesize
1.8MB
-
memory/4464-1159-0x0000000006880000-0x0000000006DAC000-memory.dmpFilesize
5.2MB
-
memory/4464-241-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-239-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-237-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-235-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4464-234-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-233-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4464-232-0x0000000002630000-0x000000000266F000-memory.dmpFilesize
252KB
-
memory/4464-231-0x0000000004C30000-0x0000000004C40000-memory.dmpFilesize
64KB
-
memory/4464-230-0x0000000000590000-0x00000000005DB000-memory.dmpFilesize
300KB