Analysis
-
max time kernel
146s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 20:55
Static task
static1
General
-
Target
31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exe
-
Size
1.0MB
-
MD5
efc3be6fd4ade0c3f2b6652ec214207f
-
SHA1
130eb572900723a55da86c51b96ff9c8352a21e0
-
SHA256
31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da
-
SHA512
13defa975b949c86e8423ebc7d740731b45ff0dceea22afd8be653537209c434995514b7e8e70bfb506d3bf171536fb95e552d5a686160bd772e433fa765777b
-
SSDEEP
24576:iyfrtMd/cbvgy/nxnsVMiOnblG2XaMfkYmLxfSJRA9Ns:Jfc0boEx/lnIMfgLxURAv
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
brat
176.113.115.145:4125
-
auth_value
1f9c658aed2f70f42f99a57a005561cf
Signatures
-
Processes:
az058631.execor2207.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az058631.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cor2207.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cor2207.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cor2207.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cor2207.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az058631.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az058631.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az058631.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cor2207.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cor2207.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az058631.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az058631.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 16 IoCs
Processes:
resource yara_rule behavioral1/memory/4816-234-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-235-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-237-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-239-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-241-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-243-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-245-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-247-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-249-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-251-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-253-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-255-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-257-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-263-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-261-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline behavioral1/memory/4816-259-0x0000000004AB0000-0x0000000004AEF000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bu925542.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation bu925542.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 12 IoCs
Processes:
kina6976.exekina3415.exekina2232.exeaz058631.exebu925542.exeoneetx.execor2207.exeoneetx.exedga15s64.exeen497461.exeoneetx.exeoneetx.exepid process 324 kina6976.exe 3560 kina3415.exe 1932 kina2232.exe 1372 az058631.exe 4388 bu925542.exe 3680 oneetx.exe 208 cor2207.exe 4720 oneetx.exe 4816 dga15s64.exe 3084 en497461.exe 1036 oneetx.exe 4496 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2136 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
az058631.execor2207.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az058631.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cor2207.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cor2207.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
kina6976.exekina3415.exekina2232.exe31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina6976.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina3415.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kina3415.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina2232.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kina2232.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina6976.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 31 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3484 4388 WerFault.exe bu925542.exe 4860 4388 WerFault.exe bu925542.exe 4332 4388 WerFault.exe bu925542.exe 2248 4388 WerFault.exe bu925542.exe 4692 4388 WerFault.exe bu925542.exe 4324 4388 WerFault.exe bu925542.exe 4732 4388 WerFault.exe bu925542.exe 3136 4388 WerFault.exe bu925542.exe 4448 4388 WerFault.exe bu925542.exe 2616 4388 WerFault.exe bu925542.exe 216 3680 WerFault.exe oneetx.exe 4820 3680 WerFault.exe oneetx.exe 4944 3680 WerFault.exe oneetx.exe 3472 3680 WerFault.exe oneetx.exe 1136 3680 WerFault.exe oneetx.exe 2456 3680 WerFault.exe oneetx.exe 4712 3680 WerFault.exe oneetx.exe 3332 3680 WerFault.exe oneetx.exe 4664 3680 WerFault.exe oneetx.exe 1120 3680 WerFault.exe oneetx.exe 5024 3680 WerFault.exe oneetx.exe 2740 3680 WerFault.exe oneetx.exe 4492 4720 WerFault.exe oneetx.exe 1368 208 WerFault.exe cor2207.exe 1936 4816 WerFault.exe dga15s64.exe 2912 3680 WerFault.exe oneetx.exe 4964 3680 WerFault.exe oneetx.exe 3948 3680 WerFault.exe oneetx.exe 544 1036 WerFault.exe oneetx.exe 2820 3680 WerFault.exe oneetx.exe 1816 4496 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
az058631.execor2207.exedga15s64.exeen497461.exepid process 1372 az058631.exe 1372 az058631.exe 208 cor2207.exe 208 cor2207.exe 4816 dga15s64.exe 4816 dga15s64.exe 3084 en497461.exe 3084 en497461.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
az058631.execor2207.exedga15s64.exeen497461.exedescription pid process Token: SeDebugPrivilege 1372 az058631.exe Token: SeDebugPrivilege 208 cor2207.exe Token: SeDebugPrivilege 4816 dga15s64.exe Token: SeDebugPrivilege 3084 en497461.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bu925542.exepid process 4388 bu925542.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exekina6976.exekina3415.exekina2232.exebu925542.exeoneetx.exedescription pid process target process PID 2772 wrote to memory of 324 2772 31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exe kina6976.exe PID 2772 wrote to memory of 324 2772 31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exe kina6976.exe PID 2772 wrote to memory of 324 2772 31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exe kina6976.exe PID 324 wrote to memory of 3560 324 kina6976.exe kina3415.exe PID 324 wrote to memory of 3560 324 kina6976.exe kina3415.exe PID 324 wrote to memory of 3560 324 kina6976.exe kina3415.exe PID 3560 wrote to memory of 1932 3560 kina3415.exe kina2232.exe PID 3560 wrote to memory of 1932 3560 kina3415.exe kina2232.exe PID 3560 wrote to memory of 1932 3560 kina3415.exe kina2232.exe PID 1932 wrote to memory of 1372 1932 kina2232.exe az058631.exe PID 1932 wrote to memory of 1372 1932 kina2232.exe az058631.exe PID 1932 wrote to memory of 4388 1932 kina2232.exe bu925542.exe PID 1932 wrote to memory of 4388 1932 kina2232.exe bu925542.exe PID 1932 wrote to memory of 4388 1932 kina2232.exe bu925542.exe PID 4388 wrote to memory of 3680 4388 bu925542.exe oneetx.exe PID 4388 wrote to memory of 3680 4388 bu925542.exe oneetx.exe PID 4388 wrote to memory of 3680 4388 bu925542.exe oneetx.exe PID 3560 wrote to memory of 208 3560 kina3415.exe cor2207.exe PID 3560 wrote to memory of 208 3560 kina3415.exe cor2207.exe PID 3560 wrote to memory of 208 3560 kina3415.exe cor2207.exe PID 3680 wrote to memory of 3484 3680 oneetx.exe schtasks.exe PID 3680 wrote to memory of 3484 3680 oneetx.exe schtasks.exe PID 3680 wrote to memory of 3484 3680 oneetx.exe schtasks.exe PID 324 wrote to memory of 4816 324 kina6976.exe dga15s64.exe PID 324 wrote to memory of 4816 324 kina6976.exe dga15s64.exe PID 324 wrote to memory of 4816 324 kina6976.exe dga15s64.exe PID 2772 wrote to memory of 3084 2772 31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exe en497461.exe PID 2772 wrote to memory of 3084 2772 31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exe en497461.exe PID 2772 wrote to memory of 3084 2772 31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exe en497461.exe PID 3680 wrote to memory of 2136 3680 oneetx.exe rundll32.exe PID 3680 wrote to memory of 2136 3680 oneetx.exe rundll32.exe PID 3680 wrote to memory of 2136 3680 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exe"C:\Users\Admin\AppData\Local\Temp\31f0b4860779db6d56ddb52e71c4f13c98ffc62a68b0afe44ff924a8ff4ff5da.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6976.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6976.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3415.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3415.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina2232.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina2232.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az058631.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az058631.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu925542.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu925542.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 6846⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 7206⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 8566⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 9766⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 9806⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 9806⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 12166⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 12086⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 13126⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 6927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 8847⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 10127⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 10207⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 10967⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 10967⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 11407⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 9967⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 9127⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 12527⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 12927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 14967⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 10767⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 16927⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 11047⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3680 -s 17087⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4388 -s 7806⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor2207.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor2207.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 208 -s 10125⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dga15s64.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dga15s64.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 13284⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en497461.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en497461.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4388 -ip 43881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 3680 -ip 36801⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 2162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4720 -ip 47201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 208 -ip 2081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4816 -ip 48161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3680 -ip 36801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3680 -ip 36801⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1036 -s 3122⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1036 -ip 10361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3680 -ip 36801⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 4496 -ip 44961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en497461.exeFilesize
168KB
MD5c50e599597c790445e55db1a0a946910
SHA17e816b1d404669dc7a2173f57a89d2a842c55e3f
SHA25624e891d79a0cca70ca2f868e5c1e37d74aaf9cb034bea150cd04d5e46d787172
SHA51241e37caea6c41447aae4b3f01e1a1eb1ec293fca7498c654957eac23038a2f15a59e8475a5a53295ec9ba218a27a4f05388fe784929586ada30a7dbfd6a61fb3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en497461.exeFilesize
168KB
MD5c50e599597c790445e55db1a0a946910
SHA17e816b1d404669dc7a2173f57a89d2a842c55e3f
SHA25624e891d79a0cca70ca2f868e5c1e37d74aaf9cb034bea150cd04d5e46d787172
SHA51241e37caea6c41447aae4b3f01e1a1eb1ec293fca7498c654957eac23038a2f15a59e8475a5a53295ec9ba218a27a4f05388fe784929586ada30a7dbfd6a61fb3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6976.exeFilesize
921KB
MD5d1083ec892d708ba42991a48c020a148
SHA12145aebb5cbacf6187f7d7bb0be747fcafff965c
SHA25641620ab95b0cea59632dfa18bfb775f27c1e9d58c0b3cd703c6380af2a1aa3d3
SHA512f7a1d1a85d4bf442d041fb07422ad6f31e36f5e3161dbe29d338b45656720885cd1a3be85c59939e007e86b98dc481f713a2f9bf0247334c9e503ba6203afd64
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina6976.exeFilesize
921KB
MD5d1083ec892d708ba42991a48c020a148
SHA12145aebb5cbacf6187f7d7bb0be747fcafff965c
SHA25641620ab95b0cea59632dfa18bfb775f27c1e9d58c0b3cd703c6380af2a1aa3d3
SHA512f7a1d1a85d4bf442d041fb07422ad6f31e36f5e3161dbe29d338b45656720885cd1a3be85c59939e007e86b98dc481f713a2f9bf0247334c9e503ba6203afd64
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dga15s64.exeFilesize
297KB
MD52e143c225fd6b9590b0b27db64d84912
SHA1409634a46bee0c6ff8e31e4988f234353e621318
SHA256902ca23d1e2f7f5827a7cfe237132705eb169bcf0272c01c25b9c20305ec29d3
SHA5125a9235867f1191f71120ac45a6d0740940274e5162e25c67805542b4db47c4555aa180deab72174ebd51a4edc1b4e0243d80005aec9ed919c7a6e6ba935e0da0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dga15s64.exeFilesize
297KB
MD52e143c225fd6b9590b0b27db64d84912
SHA1409634a46bee0c6ff8e31e4988f234353e621318
SHA256902ca23d1e2f7f5827a7cfe237132705eb169bcf0272c01c25b9c20305ec29d3
SHA5125a9235867f1191f71120ac45a6d0740940274e5162e25c67805542b4db47c4555aa180deab72174ebd51a4edc1b4e0243d80005aec9ed919c7a6e6ba935e0da0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3415.exeFilesize
589KB
MD5fe7e0428511f4b59fb85771e9e9d5571
SHA13170be12e7b8fca857e9d5a78a301ed05c1e6e7e
SHA2562b1eeef5136fa7f9e1abe2cdc58524a3e082647b24366a36f9291c6eae918680
SHA5122af7f1f82e8c39f6ff0b71dfc5132c553602d299bdde1145593f7322a59a3f24c3ffffbd38b137c95706dfdfa817f880aeb6ed8fb4cffae0f0bffbe14715cd7c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina3415.exeFilesize
589KB
MD5fe7e0428511f4b59fb85771e9e9d5571
SHA13170be12e7b8fca857e9d5a78a301ed05c1e6e7e
SHA2562b1eeef5136fa7f9e1abe2cdc58524a3e082647b24366a36f9291c6eae918680
SHA5122af7f1f82e8c39f6ff0b71dfc5132c553602d299bdde1145593f7322a59a3f24c3ffffbd38b137c95706dfdfa817f880aeb6ed8fb4cffae0f0bffbe14715cd7c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor2207.exeFilesize
239KB
MD578b0dab25c3c37eec4e67d06fd69b941
SHA1809f0721283c8dee3c7c7853d9852dac6fbfb579
SHA256a53303c77eb99b51ed275dbec6ca66c9adc0fab3d92e5ac314d9f49a0073412e
SHA51282b21109a414d4c29a7f302f6c1d02dc296577616bc4a78434bde77ab585979e8c247d8aee294fbeef38b5a012c71678f5893a5cc49717db375541238ce6c092
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor2207.exeFilesize
239KB
MD578b0dab25c3c37eec4e67d06fd69b941
SHA1809f0721283c8dee3c7c7853d9852dac6fbfb579
SHA256a53303c77eb99b51ed275dbec6ca66c9adc0fab3d92e5ac314d9f49a0073412e
SHA51282b21109a414d4c29a7f302f6c1d02dc296577616bc4a78434bde77ab585979e8c247d8aee294fbeef38b5a012c71678f5893a5cc49717db375541238ce6c092
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina2232.exeFilesize
316KB
MD567578403519df870af84d412169520d8
SHA1f69e784b539547dcb8389b628453bf1c8af6535f
SHA25625875715f9f84aaa8ba8c1865ecdf275290243ff132e8444b795ad16e9ae4ea6
SHA512338c92f410f67133a6d6c0e6dc9e6c9f6016bef48f4c0b59bd85d8785ae3624316d7e11e962dd2793283c528086e73f9f69c6a979a2cd3d3750cb715b4ad772a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina2232.exeFilesize
316KB
MD567578403519df870af84d412169520d8
SHA1f69e784b539547dcb8389b628453bf1c8af6535f
SHA25625875715f9f84aaa8ba8c1865ecdf275290243ff132e8444b795ad16e9ae4ea6
SHA512338c92f410f67133a6d6c0e6dc9e6c9f6016bef48f4c0b59bd85d8785ae3624316d7e11e962dd2793283c528086e73f9f69c6a979a2cd3d3750cb715b4ad772a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az058631.exeFilesize
11KB
MD50825fdc5fdac0ab4bdc3463180013898
SHA1efdfa93e549adc360db65eb77433d7b762425cc2
SHA256cbe8b8c20e3ef76e9fe7f0d9710c3c7c64d50d1e5163e22de8d7b7ba5ead53ee
SHA51255ef5a7678a225970065a5e544bdfdcf195cd2b7586a8cbb7a3f0aa086eb9f27f61580036ceb7851f79bd6b525488efa1a162b3457596e251741a58f7b78bbb8
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az058631.exeFilesize
11KB
MD50825fdc5fdac0ab4bdc3463180013898
SHA1efdfa93e549adc360db65eb77433d7b762425cc2
SHA256cbe8b8c20e3ef76e9fe7f0d9710c3c7c64d50d1e5163e22de8d7b7ba5ead53ee
SHA51255ef5a7678a225970065a5e544bdfdcf195cd2b7586a8cbb7a3f0aa086eb9f27f61580036ceb7851f79bd6b525488efa1a162b3457596e251741a58f7b78bbb8
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu925542.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu925542.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/208-190-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-224-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/208-204-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-206-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-208-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-210-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-212-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-215-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/208-214-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/208-216-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-219-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-218-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/208-200-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-192-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-194-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-202-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-226-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/208-228-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/208-227-0x0000000002530000-0x0000000002540000-memory.dmpFilesize
64KB
-
memory/208-229-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/208-198-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-189-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-196-0x00000000024D0000-0x00000000024E2000-memory.dmpFilesize
72KB
-
memory/208-188-0x0000000004BE0000-0x0000000005184000-memory.dmpFilesize
5.6MB
-
memory/208-187-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB
-
memory/1372-161-0x0000000000210000-0x000000000021A000-memory.dmpFilesize
40KB
-
memory/3084-1168-0x0000000004940000-0x0000000004950000-memory.dmpFilesize
64KB
-
memory/3084-1167-0x0000000000020000-0x0000000000050000-memory.dmpFilesize
192KB
-
memory/3680-223-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/4388-182-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/4388-167-0x00000000004B0000-0x00000000004EB000-memory.dmpFilesize
236KB
-
memory/4720-222-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/4816-255-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-1154-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4816-257-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-263-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-261-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-259-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-523-0x00000000004C0000-0x000000000050B000-memory.dmpFilesize
300KB
-
memory/4816-527-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4816-524-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4816-528-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4816-1144-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/4816-1145-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/4816-1146-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/4816-1147-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/4816-1148-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4816-1151-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/4816-1152-0x00000000063B0000-0x0000000006442000-memory.dmpFilesize
584KB
-
memory/4816-253-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-1153-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4816-1155-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4816-1156-0x00000000064A0000-0x0000000006516000-memory.dmpFilesize
472KB
-
memory/4816-1157-0x0000000006520000-0x0000000006570000-memory.dmpFilesize
320KB
-
memory/4816-1158-0x0000000006590000-0x0000000006752000-memory.dmpFilesize
1.8MB
-
memory/4816-1159-0x0000000006760000-0x0000000006C8C000-memory.dmpFilesize
5.2MB
-
memory/4816-1160-0x0000000004B00000-0x0000000004B10000-memory.dmpFilesize
64KB
-
memory/4816-251-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-249-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-247-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-245-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-243-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-241-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-239-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-237-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-235-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB
-
memory/4816-234-0x0000000004AB0000-0x0000000004AEF000-memory.dmpFilesize
252KB