Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10-04-2023 21:00
Static task
static1
General
-
Target
3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exe
-
Size
1.0MB
-
MD5
4affeb4c86086a511fed567f5f8383f9
-
SHA1
28f077b610e9ee91ce5c14b6c460ec8a40f524e4
-
SHA256
3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44
-
SHA512
7f3e05373c3867dc527ee4271e4e02c14b3de5e0234adbb31b4e2dbb26b6fc162251af46e34a33d94193e9d958681b34207a412cf045629db1d5926ce53c3704
-
SSDEEP
24576:hyPG6ky6iMwNM39kRDy4l8f6XGRx4FxfCyt1C:U0y6mNYAzXSx4Fxqc
Malware Config
Extracted
amadey
3.70
77.91.124.207/plays/chapter/index.php
Extracted
redline
rosn
176.113.115.145:4125
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Extracted
redline
brat
176.113.115.145:4125
-
auth_value
1f9c658aed2f70f42f99a57a005561cf
Signatures
-
Processes:
az638659.execor1503.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" az638659.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" az638659.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" cor1503.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" cor1503.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection az638659.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" az638659.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" az638659.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" az638659.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" cor1503.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection cor1503.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" cor1503.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" cor1503.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 17 IoCs
Processes:
resource yara_rule behavioral1/memory/1652-235-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-236-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-238-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-240-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-242-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-246-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-244-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-248-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-250-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-252-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-254-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-256-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-258-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-260-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-262-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-264-0x0000000002620000-0x000000000265F000-memory.dmp family_redline behavioral1/memory/1652-266-0x0000000002620000-0x000000000265F000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bu700267.exeoneetx.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation bu700267.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe -
Executes dropped EXE 11 IoCs
Processes:
kina3553.exekina6135.exekina6437.exeaz638659.exebu700267.exeoneetx.execor1503.exedBz68s07.exeen892688.exeoneetx.exeoneetx.exepid process 820 kina3553.exe 1636 kina6135.exe 3612 kina6437.exe 4392 az638659.exe 2632 bu700267.exe 4504 oneetx.exe 1860 cor1503.exe 1652 dBz68s07.exe 1460 en892688.exe 408 oneetx.exe 4728 oneetx.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1616 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
cor1503.exeaz638659.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features cor1503.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" cor1503.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" az638659.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
kina6437.exe3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exekina3553.exekina6135.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina6437.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" kina6437.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina3553.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" kina3553.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce kina6135.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" kina6135.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 30 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5020 2632 WerFault.exe bu700267.exe 4988 2632 WerFault.exe bu700267.exe 4884 2632 WerFault.exe bu700267.exe 4420 2632 WerFault.exe bu700267.exe 1576 2632 WerFault.exe bu700267.exe 1912 2632 WerFault.exe bu700267.exe 1120 2632 WerFault.exe bu700267.exe 3180 2632 WerFault.exe bu700267.exe 3680 2632 WerFault.exe bu700267.exe 4256 2632 WerFault.exe bu700267.exe 4308 4504 WerFault.exe oneetx.exe 2056 4504 WerFault.exe oneetx.exe 2228 4504 WerFault.exe oneetx.exe 4356 4504 WerFault.exe oneetx.exe 640 4504 WerFault.exe oneetx.exe 4400 4504 WerFault.exe oneetx.exe 3340 4504 WerFault.exe oneetx.exe 1440 4504 WerFault.exe oneetx.exe 5064 4504 WerFault.exe oneetx.exe 3920 4504 WerFault.exe oneetx.exe 436 4504 WerFault.exe oneetx.exe 4936 4504 WerFault.exe oneetx.exe 3420 1860 WerFault.exe cor1503.exe 4344 1652 WerFault.exe dBz68s07.exe 2504 4504 WerFault.exe oneetx.exe 5064 4504 WerFault.exe oneetx.exe 4336 4504 WerFault.exe oneetx.exe 952 408 WerFault.exe oneetx.exe 3820 4504 WerFault.exe oneetx.exe 4988 4728 WerFault.exe oneetx.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
az638659.execor1503.exedBz68s07.exeen892688.exepid process 4392 az638659.exe 4392 az638659.exe 1860 cor1503.exe 1860 cor1503.exe 1652 dBz68s07.exe 1652 dBz68s07.exe 1460 en892688.exe 1460 en892688.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
az638659.execor1503.exedBz68s07.exeen892688.exedescription pid process Token: SeDebugPrivilege 4392 az638659.exe Token: SeDebugPrivilege 1860 cor1503.exe Token: SeDebugPrivilege 1652 dBz68s07.exe Token: SeDebugPrivilege 1460 en892688.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
bu700267.exepid process 2632 bu700267.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exekina3553.exekina6135.exekina6437.exebu700267.exeoneetx.exedescription pid process target process PID 2036 wrote to memory of 820 2036 3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exe kina3553.exe PID 2036 wrote to memory of 820 2036 3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exe kina3553.exe PID 2036 wrote to memory of 820 2036 3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exe kina3553.exe PID 820 wrote to memory of 1636 820 kina3553.exe kina6135.exe PID 820 wrote to memory of 1636 820 kina3553.exe kina6135.exe PID 820 wrote to memory of 1636 820 kina3553.exe kina6135.exe PID 1636 wrote to memory of 3612 1636 kina6135.exe kina6437.exe PID 1636 wrote to memory of 3612 1636 kina6135.exe kina6437.exe PID 1636 wrote to memory of 3612 1636 kina6135.exe kina6437.exe PID 3612 wrote to memory of 4392 3612 kina6437.exe az638659.exe PID 3612 wrote to memory of 4392 3612 kina6437.exe az638659.exe PID 3612 wrote to memory of 2632 3612 kina6437.exe bu700267.exe PID 3612 wrote to memory of 2632 3612 kina6437.exe bu700267.exe PID 3612 wrote to memory of 2632 3612 kina6437.exe bu700267.exe PID 2632 wrote to memory of 4504 2632 bu700267.exe oneetx.exe PID 2632 wrote to memory of 4504 2632 bu700267.exe oneetx.exe PID 2632 wrote to memory of 4504 2632 bu700267.exe oneetx.exe PID 1636 wrote to memory of 1860 1636 kina6135.exe cor1503.exe PID 1636 wrote to memory of 1860 1636 kina6135.exe cor1503.exe PID 1636 wrote to memory of 1860 1636 kina6135.exe cor1503.exe PID 4504 wrote to memory of 3812 4504 oneetx.exe schtasks.exe PID 4504 wrote to memory of 3812 4504 oneetx.exe schtasks.exe PID 4504 wrote to memory of 3812 4504 oneetx.exe schtasks.exe PID 820 wrote to memory of 1652 820 kina3553.exe dBz68s07.exe PID 820 wrote to memory of 1652 820 kina3553.exe dBz68s07.exe PID 820 wrote to memory of 1652 820 kina3553.exe dBz68s07.exe PID 2036 wrote to memory of 1460 2036 3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exe en892688.exe PID 2036 wrote to memory of 1460 2036 3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exe en892688.exe PID 2036 wrote to memory of 1460 2036 3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exe en892688.exe PID 4504 wrote to memory of 1616 4504 oneetx.exe rundll32.exe PID 4504 wrote to memory of 1616 4504 oneetx.exe rundll32.exe PID 4504 wrote to memory of 1616 4504 oneetx.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exe"C:\Users\Admin\AppData\Local\Temp\3daa6fbc0279272cdaf6871b52c8befa1079129e9e1c2175889d362de22c0c44.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina3553.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina3553.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina6135.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina6135.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6437.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6437.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az638659.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az638659.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu700267.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu700267.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 6966⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 7126⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 8046⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 8126⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 9646⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 9646⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 12126⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 12526⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 13126⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 6927⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 8887⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 10127⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 10887⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 11047⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 10887⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 9207⤵
- Program crash
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F7⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 10007⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 7607⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 10007⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 7567⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 14367⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 11367⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 16367⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main7⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 11487⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4504 -s 16527⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 7726⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor1503.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor1503.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 10805⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dBz68s07.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dBz68s07.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 12084⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en892688.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en892688.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2632 -ip 26321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 2632 -ip 26321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2632 -ip 26321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2632 -ip 26321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2632 -ip 26321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2632 -ip 26321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2632 -ip 26321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2632 -ip 26321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2632 -ip 26321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2632 -ip 26321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1860 -ip 18601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1652 -ip 16521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4504 -ip 45041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4504 -ip 45041⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 408 -s 3162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 396 -p 408 -ip 4081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4504 -ip 45041⤵
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4728 -s 3202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4728 -ip 47281⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en892688.exeFilesize
168KB
MD55d6d261b0f29c61edbee95cf7fe895d9
SHA15dd16ea8819d327e81c461c7283324cc66e8b226
SHA25683300556b9766f4a77da4a32f676982c9d8a2b707e00f41a784733c5b466ae32
SHA51233300b52a2937c2c9d150c7fa38b54a88b64105332e5319756922eada0d98746902fe5377f78c9c6261107153e5b5915ab3bbe567bbdb88efd926d4bb0411bb3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\en892688.exeFilesize
168KB
MD55d6d261b0f29c61edbee95cf7fe895d9
SHA15dd16ea8819d327e81c461c7283324cc66e8b226
SHA25683300556b9766f4a77da4a32f676982c9d8a2b707e00f41a784733c5b466ae32
SHA51233300b52a2937c2c9d150c7fa38b54a88b64105332e5319756922eada0d98746902fe5377f78c9c6261107153e5b5915ab3bbe567bbdb88efd926d4bb0411bb3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina3553.exeFilesize
919KB
MD5c0eedb2ca1e76be79f9946efe8a6dc13
SHA1525c51dbd2ab016f86e367b542c7e8d6d11491a4
SHA25623acb7dc2290bd54008e88d81958eea28793acf186b0d137fea3304859aa73d6
SHA5127274c1f9a738f0d20324ce3cc6f59cf01d542f9025aff82bbc163d642d8ab0b15ae357646b8d5c2a50a914f1f076aad257ce8a11ddbf3be3666183b3aeabb45c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\kina3553.exeFilesize
919KB
MD5c0eedb2ca1e76be79f9946efe8a6dc13
SHA1525c51dbd2ab016f86e367b542c7e8d6d11491a4
SHA25623acb7dc2290bd54008e88d81958eea28793acf186b0d137fea3304859aa73d6
SHA5127274c1f9a738f0d20324ce3cc6f59cf01d542f9025aff82bbc163d642d8ab0b15ae357646b8d5c2a50a914f1f076aad257ce8a11ddbf3be3666183b3aeabb45c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dBz68s07.exeFilesize
297KB
MD57125c2224c2bf2ef35d2bc75b7c9db88
SHA1e3d6a8b650d643e75ec3b121b731e6e3dfc4e3a9
SHA2568d77ec09f31a5ec29932ec77dab41adc74f492a70468622f4e2d647873079703
SHA5129d8ab9025b2f40284dfaf348ec2b996e23183d9d038c20345f55cef0502f6043f5b3fe16cd99721b99745ee6d39985df8399b38b98d4df927dc8d3f63a4be6f0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\dBz68s07.exeFilesize
297KB
MD57125c2224c2bf2ef35d2bc75b7c9db88
SHA1e3d6a8b650d643e75ec3b121b731e6e3dfc4e3a9
SHA2568d77ec09f31a5ec29932ec77dab41adc74f492a70468622f4e2d647873079703
SHA5129d8ab9025b2f40284dfaf348ec2b996e23183d9d038c20345f55cef0502f6043f5b3fe16cd99721b99745ee6d39985df8399b38b98d4df927dc8d3f63a4be6f0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina6135.exeFilesize
588KB
MD5c19e7bb1eceaa816e5617a8e45aea918
SHA1ee86d7b6166632a46c4606fff6f5dee540b6032e
SHA256d8eab699262f4c637f5acaed4c0e9ed9c2f05dc8c994e097a30456e728aae55f
SHA51282f26f34da35cee33b970f396dd2a956f6c2e4df1be4ac734f8d418d6a41c21de2cd4118b7d82755c19558e5b6ee109d0487200331ae4d07095a4b2f0bc22cc4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\kina6135.exeFilesize
588KB
MD5c19e7bb1eceaa816e5617a8e45aea918
SHA1ee86d7b6166632a46c4606fff6f5dee540b6032e
SHA256d8eab699262f4c637f5acaed4c0e9ed9c2f05dc8c994e097a30456e728aae55f
SHA51282f26f34da35cee33b970f396dd2a956f6c2e4df1be4ac734f8d418d6a41c21de2cd4118b7d82755c19558e5b6ee109d0487200331ae4d07095a4b2f0bc22cc4
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor1503.exeFilesize
239KB
MD505bfea121de5182037cb551b7bc4fa17
SHA1b84ef81c3d212a0b6563242db8d9aa7391bf1e37
SHA256874cba1aa6d7517e8ad9eaaffd6e5e0b281ec060e6c713644850e992680f6bb7
SHA51282ca0159bcffae46cdacfde5ce4940dfdeed87a76c0cce3e285bada2d746425942209dbe90d077defc2a4a325d178983be366233463dcc5e6f65ccdc0c76ab90
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\cor1503.exeFilesize
239KB
MD505bfea121de5182037cb551b7bc4fa17
SHA1b84ef81c3d212a0b6563242db8d9aa7391bf1e37
SHA256874cba1aa6d7517e8ad9eaaffd6e5e0b281ec060e6c713644850e992680f6bb7
SHA51282ca0159bcffae46cdacfde5ce4940dfdeed87a76c0cce3e285bada2d746425942209dbe90d077defc2a4a325d178983be366233463dcc5e6f65ccdc0c76ab90
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6437.exeFilesize
316KB
MD514f8fe6052af5c87777eb57320128faf
SHA1b364134568d4be36d7a62ddfaac2d1a02dc59515
SHA256f97ec077102be2b41a2b8670f369fbcfb630096186aac3298577fc2703ff4b67
SHA51234e5026b832f21f8ff3156fd6af0650ee9ba54cd24e6f5ad5d5d1f200d6677bb03169d62f12d6f3eb31d896cf14345e7e79927023f7afcc2f5eb69c4d1752acd
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\kina6437.exeFilesize
316KB
MD514f8fe6052af5c87777eb57320128faf
SHA1b364134568d4be36d7a62ddfaac2d1a02dc59515
SHA256f97ec077102be2b41a2b8670f369fbcfb630096186aac3298577fc2703ff4b67
SHA51234e5026b832f21f8ff3156fd6af0650ee9ba54cd24e6f5ad5d5d1f200d6677bb03169d62f12d6f3eb31d896cf14345e7e79927023f7afcc2f5eb69c4d1752acd
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az638659.exeFilesize
11KB
MD500c6da6348594dfc14efbcc8b87c8f43
SHA1a3c292d6021d033cff73ce423ff7be21211ff775
SHA25657962ca255bc9f0c1a5997289f5895ac39c2edf23f51825f06d82e20f431d853
SHA512c0a21a2d5931497958127dd37761b7a70f6c2ab257f7c1e2a282be1ae111d48daf625d70bfefb1302aab0d2e4a67fddb071293e95ceba186dd84c412486d7644
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\az638659.exeFilesize
11KB
MD500c6da6348594dfc14efbcc8b87c8f43
SHA1a3c292d6021d033cff73ce423ff7be21211ff775
SHA25657962ca255bc9f0c1a5997289f5895ac39c2edf23f51825f06d82e20f431d853
SHA512c0a21a2d5931497958127dd37761b7a70f6c2ab257f7c1e2a282be1ae111d48daf625d70bfefb1302aab0d2e4a67fddb071293e95ceba186dd84c412486d7644
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu700267.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\bu700267.exeFilesize
231KB
MD5f8117f396c10315824172b564d08490e
SHA196c20a6f156aa6e75f75fa9038a8878d75401138
SHA2567f2db89b0b8c955144ab3138b179d30a3d7f5220b3752bdfad443bab0fc935ba
SHA51260606b0cf43e2c10d42f611c47463fcce8044faad9ebb366cc455641747b47c4c2844a5b7b56194cfca524d881fd3f9db3464b8307076a69bbf1c2bc04b43743
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD54061d8dd5006b99d06fa208c0063dfcf
SHA138e7df8d8e631f3e9b227df3b9326d187e18cce5
SHA256b380dd44db67571959bc5f04a5d9c1ec51e48c0617c59e7c4bcbf794a90320f0
SHA51271de12e3bcf0ff4996b71587d971f0b4e378397ffac22be28d4e41c7c865a85bbcff62cfa7bdfa6e18d19971205bf0021939ac49dec42daa749d4ac9f7e70314
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
memory/1460-1167-0x0000000005760000-0x0000000005770000-memory.dmpFilesize
64KB
-
memory/1460-1165-0x0000000005760000-0x0000000005770000-memory.dmpFilesize
64KB
-
memory/1460-1164-0x0000000000EB0000-0x0000000000EE0000-memory.dmpFilesize
192KB
-
memory/1652-1143-0x00000000059E0000-0x00000000059F2000-memory.dmpFilesize
72KB
-
memory/1652-1154-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/1652-1157-0x0000000008150000-0x00000000081A0000-memory.dmpFilesize
320KB
-
memory/1652-1156-0x00000000080C0000-0x0000000008136000-memory.dmpFilesize
472KB
-
memory/1652-1155-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/1652-1153-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/1652-1152-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/1652-1150-0x0000000006790000-0x0000000006CBC000-memory.dmpFilesize
5.2MB
-
memory/1652-1149-0x00000000065B0000-0x0000000006772000-memory.dmpFilesize
1.8MB
-
memory/1652-1148-0x00000000063C0000-0x0000000006452000-memory.dmpFilesize
584KB
-
memory/1652-1147-0x0000000005CF0000-0x0000000005D56000-memory.dmpFilesize
408KB
-
memory/1652-1145-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/1652-1144-0x0000000005A00000-0x0000000005A3C000-memory.dmpFilesize
240KB
-
memory/1652-1142-0x00000000058A0000-0x00000000059AA000-memory.dmpFilesize
1.0MB
-
memory/1652-1141-0x0000000005200000-0x0000000005818000-memory.dmpFilesize
6.1MB
-
memory/1652-266-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-264-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-262-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-231-0x0000000001E60000-0x0000000001EAB000-memory.dmpFilesize
300KB
-
memory/1652-233-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/1652-234-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/1652-232-0x0000000002350000-0x0000000002360000-memory.dmpFilesize
64KB
-
memory/1652-235-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-236-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-238-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-240-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-242-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-246-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-244-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-248-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-250-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-252-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-254-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-256-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-258-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1652-260-0x0000000002620000-0x000000000265F000-memory.dmpFilesize
252KB
-
memory/1860-213-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-191-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-203-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-225-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1860-212-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1860-201-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-223-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1860-221-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1860-187-0x0000000004BF0000-0x0000000005194000-memory.dmpFilesize
5.6MB
-
memory/1860-215-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1860-219-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-210-0x0000000000580000-0x00000000005AD000-memory.dmpFilesize
180KB
-
memory/1860-217-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1860-207-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-226-0x0000000000400000-0x00000000004AA000-memory.dmpFilesize
680KB
-
memory/1860-224-0x0000000004BE0000-0x0000000004BF0000-memory.dmpFilesize
64KB
-
memory/1860-216-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-209-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-199-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-197-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-195-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-193-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-205-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-189-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/1860-188-0x0000000004B60000-0x0000000004B72000-memory.dmpFilesize
72KB
-
memory/2632-182-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB
-
memory/2632-167-0x0000000000690000-0x00000000006CB000-memory.dmpFilesize
236KB
-
memory/4392-161-0x0000000000790000-0x000000000079A000-memory.dmpFilesize
40KB
-
memory/4504-220-0x0000000000400000-0x00000000004A8000-memory.dmpFilesize
672KB