Analysis
-
max time kernel
122s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
21-03-2023 13:00
Static task
static1
General
-
Target
0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exe
-
Size
1004KB
-
MD5
ddf32e6963039d0e83da4dfb0f14a452
-
SHA1
2656b861d18337c86e0ca291a68114c7dc95d0a9
-
SHA256
0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf
-
SHA512
afa34a04f718548b4755027a29dff66906bc6c0b2c756bfe2e90c4d514ec7fa065192992cc4ae35ea0b36b7a50cfe8f944f6c5a2272d3514dffdfd2be41b3063
-
SSDEEP
24576:RyDHFDmpDc8HuDgUFGJWB9o/yje3aLXOrPVBlK1AHWJ:EDHEJcjFGMY/ke3a7yPVW+H
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
vint
193.233.20.30:4125
-
auth_value
fb8811912f8370b3d23bffda092d88d0
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
redline
14
45.12.253.144:40145
-
auth_value
6528d0f243ad9e530a68f2a487521a80
Signatures
-
Processes:
v9633ms.exetz3402.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v9633ms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v9633ms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v9633ms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v9633ms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz3402.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz3402.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz3402.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz3402.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz3402.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v9633ms.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/3684-195-0x0000000004B20000-0x0000000004B66000-memory.dmp family_redline behavioral1/memory/3684-196-0x00000000051F0000-0x0000000005234000-memory.dmp family_redline behavioral1/memory/3684-197-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-198-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-200-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-202-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-204-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-206-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-210-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-216-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-214-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-218-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-220-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-222-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-224-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-226-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-228-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-230-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-232-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-234-0x00000000051F0000-0x000000000522E000-memory.dmp family_redline behavioral1/memory/3684-1117-0x0000000004BA0000-0x0000000004BB0000-memory.dmp family_redline -
Downloads MZ/PE file
-
.NET Reactor proctector 6 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe net_reactor C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe net_reactor C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe net_reactor behavioral1/memory/4912-1172-0x0000000000280000-0x00000000007F4000-memory.dmp net_reactor behavioral1/memory/4912-1173-0x0000000005130000-0x00000000051BE000-memory.dmp net_reactor C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe net_reactor -
Executes dropped EXE 14 IoCs
Processes:
zap4063.exezap7278.exezap3829.exetz3402.exev9633ms.exew38pw52.exexVWVG53.exey68qB91.exelegenda.exeworld.exeGood.exeGood.exelegenda.exelegenda.exepid process 1792 zap4063.exe 4132 zap7278.exe 2352 zap3829.exe 2344 tz3402.exe 4452 v9633ms.exe 3684 w38pw52.exe 4376 xVWVG53.exe 3832 y68qB91.exe 1860 legenda.exe 4960 world.exe 4912 Good.exe 4112 Good.exe 2112 legenda.exe 2272 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3920 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz3402.exev9633ms.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz3402.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v9633ms.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v9633ms.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 9 IoCs
Processes:
0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exezap4063.exezap7278.exezap3829.exeGood.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap4063.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap7278.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap7278.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap3829.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap3829.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap4063.exe Set value (str) \REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Software\Microsoft\Windows\CurrentVersion\Run\MyTestApplication = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1000112001\\Good.exe" Good.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 16 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Good.exedescription pid process target process PID 4912 set thread context of 4112 4912 Good.exe Good.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
tz3402.exev9633ms.exew38pw52.exexVWVG53.exeworld.exepid process 2344 tz3402.exe 2344 tz3402.exe 4452 v9633ms.exe 4452 v9633ms.exe 3684 w38pw52.exe 3684 w38pw52.exe 4376 xVWVG53.exe 4376 xVWVG53.exe 4960 world.exe 4960 world.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
tz3402.exev9633ms.exew38pw52.exexVWVG53.exeGood.exeworld.exeGood.exedescription pid process Token: SeDebugPrivilege 2344 tz3402.exe Token: SeDebugPrivilege 4452 v9633ms.exe Token: SeDebugPrivilege 3684 w38pw52.exe Token: SeDebugPrivilege 4376 xVWVG53.exe Token: SeDebugPrivilege 4912 Good.exe Token: SeDebugPrivilege 4960 world.exe Token: SeDebugPrivilege 4112 Good.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exezap4063.exezap7278.exezap3829.exey68qB91.exelegenda.execmd.exeGood.exedescription pid process target process PID 3904 wrote to memory of 1792 3904 0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exe zap4063.exe PID 3904 wrote to memory of 1792 3904 0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exe zap4063.exe PID 3904 wrote to memory of 1792 3904 0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exe zap4063.exe PID 1792 wrote to memory of 4132 1792 zap4063.exe zap7278.exe PID 1792 wrote to memory of 4132 1792 zap4063.exe zap7278.exe PID 1792 wrote to memory of 4132 1792 zap4063.exe zap7278.exe PID 4132 wrote to memory of 2352 4132 zap7278.exe zap3829.exe PID 4132 wrote to memory of 2352 4132 zap7278.exe zap3829.exe PID 4132 wrote to memory of 2352 4132 zap7278.exe zap3829.exe PID 2352 wrote to memory of 2344 2352 zap3829.exe tz3402.exe PID 2352 wrote to memory of 2344 2352 zap3829.exe tz3402.exe PID 2352 wrote to memory of 4452 2352 zap3829.exe v9633ms.exe PID 2352 wrote to memory of 4452 2352 zap3829.exe v9633ms.exe PID 2352 wrote to memory of 4452 2352 zap3829.exe v9633ms.exe PID 4132 wrote to memory of 3684 4132 zap7278.exe w38pw52.exe PID 4132 wrote to memory of 3684 4132 zap7278.exe w38pw52.exe PID 4132 wrote to memory of 3684 4132 zap7278.exe w38pw52.exe PID 1792 wrote to memory of 4376 1792 zap4063.exe xVWVG53.exe PID 1792 wrote to memory of 4376 1792 zap4063.exe xVWVG53.exe PID 1792 wrote to memory of 4376 1792 zap4063.exe xVWVG53.exe PID 3904 wrote to memory of 3832 3904 0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exe y68qB91.exe PID 3904 wrote to memory of 3832 3904 0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exe y68qB91.exe PID 3904 wrote to memory of 3832 3904 0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exe y68qB91.exe PID 3832 wrote to memory of 1860 3832 y68qB91.exe legenda.exe PID 3832 wrote to memory of 1860 3832 y68qB91.exe legenda.exe PID 3832 wrote to memory of 1860 3832 y68qB91.exe legenda.exe PID 1860 wrote to memory of 4248 1860 legenda.exe schtasks.exe PID 1860 wrote to memory of 4248 1860 legenda.exe schtasks.exe PID 1860 wrote to memory of 4248 1860 legenda.exe schtasks.exe PID 1860 wrote to memory of 4872 1860 legenda.exe cmd.exe PID 1860 wrote to memory of 4872 1860 legenda.exe cmd.exe PID 1860 wrote to memory of 4872 1860 legenda.exe cmd.exe PID 4872 wrote to memory of 4260 4872 cmd.exe cmd.exe PID 4872 wrote to memory of 4260 4872 cmd.exe cmd.exe PID 4872 wrote to memory of 4260 4872 cmd.exe cmd.exe PID 4872 wrote to memory of 3848 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 3848 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 3848 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 4272 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 4272 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 4272 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 2936 4872 cmd.exe cmd.exe PID 4872 wrote to memory of 2936 4872 cmd.exe cmd.exe PID 4872 wrote to memory of 2936 4872 cmd.exe cmd.exe PID 4872 wrote to memory of 4216 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 4216 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 4216 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 5108 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 5108 4872 cmd.exe cacls.exe PID 4872 wrote to memory of 5108 4872 cmd.exe cacls.exe PID 1860 wrote to memory of 4960 1860 legenda.exe world.exe PID 1860 wrote to memory of 4960 1860 legenda.exe world.exe PID 1860 wrote to memory of 4960 1860 legenda.exe world.exe PID 1860 wrote to memory of 4912 1860 legenda.exe Good.exe PID 1860 wrote to memory of 4912 1860 legenda.exe Good.exe PID 1860 wrote to memory of 4912 1860 legenda.exe Good.exe PID 4912 wrote to memory of 4112 4912 Good.exe Good.exe PID 4912 wrote to memory of 4112 4912 Good.exe Good.exe PID 4912 wrote to memory of 4112 4912 Good.exe Good.exe PID 4912 wrote to memory of 4112 4912 Good.exe Good.exe PID 4912 wrote to memory of 4112 4912 Good.exe Good.exe PID 4912 wrote to memory of 4112 4912 Good.exe Good.exe PID 4912 wrote to memory of 4112 4912 Good.exe Good.exe PID 4912 wrote to memory of 4112 4912 Good.exe Good.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exe"C:\Users\Admin\AppData\Local\Temp\0c4a1c05d2548eef6395983cec16d07e6a58f36220739f915cfaeb8d521cfcbf.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4063.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4063.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7278.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7278.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3829.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3829.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3402.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3402.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9633ms.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9633ms.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w38pw52.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w38pw52.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xVWVG53.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xVWVG53.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y68qB91.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y68qB91.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000097001\world.exe"C:\Users\Admin\AppData\Local\Temp\1000097001\world.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe"C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe"C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exe"6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.17⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Good.exe.logFilesize
321B
MD5076d7c48064de4effadfe36d1857322d
SHA1273f4d3f67c4ec0a637317ce2a536e52cc1c2090
SHA2567cdcfb48cb249895caa7d3b5ce9ad53c7185d426f0f5669fe79bc5e047ff29ed
SHA512e540c14a5093a1607dd47b0cdf96e21957d1b70aae24dcd99cdb3e3292451222760e8106b1e6e6091928b9998a6d307709e39081565a5e49d85c64e03bc55abf
-
C:\Users\Admin\AppData\Local\Temp\1000097001\world.exeFilesize
336KB
MD5f8e0e6946af017037e8bb4d5455d4e99
SHA16691a0d551c3991fbe5f18147711e829616099bb
SHA2564f8e88f1d2bf0817faa0627fa1c9b92715b13015bf7f38d7fcc6d27a4e511d6e
SHA512f2fa94c86c400ae894abc3d9fa7316ad47cf1bf4b039dd162cab13c1e4c29c68646919c2076804b885863dd15e79053ef378bdf996b030c6764c144eb36c6e93
-
C:\Users\Admin\AppData\Local\Temp\1000097001\world.exeFilesize
336KB
MD5f8e0e6946af017037e8bb4d5455d4e99
SHA16691a0d551c3991fbe5f18147711e829616099bb
SHA2564f8e88f1d2bf0817faa0627fa1c9b92715b13015bf7f38d7fcc6d27a4e511d6e
SHA512f2fa94c86c400ae894abc3d9fa7316ad47cf1bf4b039dd162cab13c1e4c29c68646919c2076804b885863dd15e79053ef378bdf996b030c6764c144eb36c6e93
-
C:\Users\Admin\AppData\Local\Temp\1000097001\world.exeFilesize
336KB
MD5f8e0e6946af017037e8bb4d5455d4e99
SHA16691a0d551c3991fbe5f18147711e829616099bb
SHA2564f8e88f1d2bf0817faa0627fa1c9b92715b13015bf7f38d7fcc6d27a4e511d6e
SHA512f2fa94c86c400ae894abc3d9fa7316ad47cf1bf4b039dd162cab13c1e4c29c68646919c2076804b885863dd15e79053ef378bdf996b030c6764c144eb36c6e93
-
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exeFilesize
5.4MB
MD59086ff963ae98510ea0eb9abad045939
SHA1e9999c73e07daf9ba223fbf796d56ae762b748fa
SHA256138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f
SHA512f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee
-
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exeFilesize
5.4MB
MD59086ff963ae98510ea0eb9abad045939
SHA1e9999c73e07daf9ba223fbf796d56ae762b748fa
SHA256138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f
SHA512f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee
-
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exeFilesize
5.4MB
MD59086ff963ae98510ea0eb9abad045939
SHA1e9999c73e07daf9ba223fbf796d56ae762b748fa
SHA256138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f
SHA512f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee
-
C:\Users\Admin\AppData\Local\Temp\1000112001\Good.exeFilesize
5.4MB
MD59086ff963ae98510ea0eb9abad045939
SHA1e9999c73e07daf9ba223fbf796d56ae762b748fa
SHA256138c7f0a55344e824bfd3cba1ddae87b237500005fd09a22cbde021ec017454f
SHA512f1baace8518ebc24bf71e7e7612427eacd44ef51b5f499ae58764a74a6813ca0eb27974855a7d7d58144cd4ee211fbc3f39ce1c49415e977e057c0078f5c1fee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y68qB91.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y68qB91.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4063.exeFilesize
820KB
MD5996af0add478c16bb8ea74a7bbe42b43
SHA194fdf4e8e89140b080a739981e99b83de55f31ea
SHA25614a8ca963d9ef33fa258458176083410073a5cd433bbc5bfd29dedfc37131c5f
SHA5123e7fb99c9c8257de8d7b3e13010fb50e8b7f6af288b01842a98060efaa7e7d4e4a85b113362de31851e92ca2d56456d888c48ef280e43680cdeba7ce72912a54
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4063.exeFilesize
820KB
MD5996af0add478c16bb8ea74a7bbe42b43
SHA194fdf4e8e89140b080a739981e99b83de55f31ea
SHA25614a8ca963d9ef33fa258458176083410073a5cd433bbc5bfd29dedfc37131c5f
SHA5123e7fb99c9c8257de8d7b3e13010fb50e8b7f6af288b01842a98060efaa7e7d4e4a85b113362de31851e92ca2d56456d888c48ef280e43680cdeba7ce72912a54
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xVWVG53.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xVWVG53.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7278.exeFilesize
678KB
MD5ed30934e83b835dac1234143ed60a268
SHA1f697c1a5ade1c43ca77a36e8bc5805a4d7904aa3
SHA256f2c09998b8c76159a92d54c920a7ccd25e9884bead31f7d8b56fc00fd746b9d1
SHA51280e28afa4028cc5d017a70934d8c68381ab08936e9a3be879817c6f8ee93a2c4a2cae78113c2ef3e515c1f052495867d3c64bbabeb45478cc9a0f638adea9ad6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7278.exeFilesize
678KB
MD5ed30934e83b835dac1234143ed60a268
SHA1f697c1a5ade1c43ca77a36e8bc5805a4d7904aa3
SHA256f2c09998b8c76159a92d54c920a7ccd25e9884bead31f7d8b56fc00fd746b9d1
SHA51280e28afa4028cc5d017a70934d8c68381ab08936e9a3be879817c6f8ee93a2c4a2cae78113c2ef3e515c1f052495867d3c64bbabeb45478cc9a0f638adea9ad6
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w38pw52.exeFilesize
332KB
MD59a4783748221d8d539a67b12182a3253
SHA10b7d525609e0e18f8df746d4daec685c188a5789
SHA25630362d829e457cdfe1faaec85aac9465f2b7c15269cf60e333753909e5b2e11a
SHA5129c95e17a279ab61de48ace37103949b34d062b61256cf415083bfb9c06d3a5cd642024a50669093ec36baba4c750620015e01d72718ab35495cd83829ec4d10a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w38pw52.exeFilesize
332KB
MD59a4783748221d8d539a67b12182a3253
SHA10b7d525609e0e18f8df746d4daec685c188a5789
SHA25630362d829e457cdfe1faaec85aac9465f2b7c15269cf60e333753909e5b2e11a
SHA5129c95e17a279ab61de48ace37103949b34d062b61256cf415083bfb9c06d3a5cd642024a50669093ec36baba4c750620015e01d72718ab35495cd83829ec4d10a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3829.exeFilesize
335KB
MD579612a4e35499925ce015b25a1c9e094
SHA156a23ae2ccbaf4fd0d7955edaeb23a8aafd4399c
SHA25654abe587a4a6afe758916360e428a89ecce94bc02974dbabe5d7f0abcd10b706
SHA512124a723d141f4e412009854b11eb070ed89d7aaf66c4f03d815ae548923d39f926304fbd5ded18a71f257c0f6e23196c5001cf6f03396e31cdf00dfa37634242
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap3829.exeFilesize
335KB
MD579612a4e35499925ce015b25a1c9e094
SHA156a23ae2ccbaf4fd0d7955edaeb23a8aafd4399c
SHA25654abe587a4a6afe758916360e428a89ecce94bc02974dbabe5d7f0abcd10b706
SHA512124a723d141f4e412009854b11eb070ed89d7aaf66c4f03d815ae548923d39f926304fbd5ded18a71f257c0f6e23196c5001cf6f03396e31cdf00dfa37634242
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3402.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz3402.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9633ms.exeFilesize
274KB
MD5c38417474c54c96254f41398294011cd
SHA1b0e75d70b9f9283a37d7baba2d7147487b67f42d
SHA25696c0bfd5157d17bda3d67957bb5e2bba4840fe2d022071b96f0f50b998e26359
SHA512427b8ea9c22efec3a5fefca6c8c473d0412b1e7fe2bb6581a7d82c8fef5ea32c1d8ca3002dda24c11fe38dfe2c7454d8dd41f7dfef4998ae38998ed2ee4af514
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v9633ms.exeFilesize
274KB
MD5c38417474c54c96254f41398294011cd
SHA1b0e75d70b9f9283a37d7baba2d7147487b67f42d
SHA25696c0bfd5157d17bda3d67957bb5e2bba4840fe2d022071b96f0f50b998e26359
SHA512427b8ea9c22efec3a5fefca6c8c473d0412b1e7fe2bb6581a7d82c8fef5ea32c1d8ca3002dda24c11fe38dfe2c7454d8dd41f7dfef4998ae38998ed2ee4af514
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
memory/2344-145-0x0000000000270000-0x000000000027A000-memory.dmpFilesize
40KB
-
memory/3684-222-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-1118-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3684-1122-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3684-1123-0x0000000006C30000-0x000000000715C000-memory.dmpFilesize
5.2MB
-
memory/3684-1121-0x0000000006A60000-0x0000000006C22000-memory.dmpFilesize
1.8MB
-
memory/3684-195-0x0000000004B20000-0x0000000004B66000-memory.dmpFilesize
280KB
-
memory/3684-196-0x00000000051F0000-0x0000000005234000-memory.dmpFilesize
272KB
-
memory/3684-197-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-198-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-200-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-202-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-204-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-207-0x0000000000800000-0x000000000084B000-memory.dmpFilesize
300KB
-
memory/3684-206-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-209-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3684-210-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-211-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3684-213-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3684-216-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-214-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-218-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-220-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-1120-0x00000000067B0000-0x0000000006800000-memory.dmpFilesize
320KB
-
memory/3684-224-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-226-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-228-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-230-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-232-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-234-0x00000000051F0000-0x000000000522E000-memory.dmpFilesize
248KB
-
memory/3684-1107-0x0000000005370000-0x0000000005976000-memory.dmpFilesize
6.0MB
-
memory/3684-1108-0x0000000005A00000-0x0000000005B0A000-memory.dmpFilesize
1.0MB
-
memory/3684-1109-0x0000000005B40000-0x0000000005B52000-memory.dmpFilesize
72KB
-
memory/3684-1110-0x0000000005B60000-0x0000000005B9E000-memory.dmpFilesize
248KB
-
memory/3684-1111-0x0000000005CB0000-0x0000000005CFB000-memory.dmpFilesize
300KB
-
memory/3684-1112-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3684-1113-0x0000000005E40000-0x0000000005ED2000-memory.dmpFilesize
584KB
-
memory/3684-1114-0x0000000005EE0000-0x0000000005F46000-memory.dmpFilesize
408KB
-
memory/3684-1116-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3684-1117-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/3684-1119-0x0000000006720000-0x0000000006796000-memory.dmpFilesize
472KB
-
memory/4112-2646-0x0000000005E20000-0x0000000005E30000-memory.dmpFilesize
64KB
-
memory/4112-2645-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4376-1129-0x0000000000090000-0x00000000000C2000-memory.dmpFilesize
200KB
-
memory/4376-1131-0x0000000004920000-0x0000000004930000-memory.dmpFilesize
64KB
-
memory/4376-1130-0x0000000004AD0000-0x0000000004B1B000-memory.dmpFilesize
300KB
-
memory/4452-171-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-151-0x0000000004B90000-0x0000000004BAA000-memory.dmpFilesize
104KB
-
memory/4452-183-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-190-0x0000000000400000-0x0000000000708000-memory.dmpFilesize
3.0MB
-
memory/4452-187-0x0000000004D40000-0x0000000004D50000-memory.dmpFilesize
64KB
-
memory/4452-177-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-179-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-181-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-173-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-186-0x0000000000400000-0x0000000000708000-memory.dmpFilesize
3.0MB
-
memory/4452-169-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-167-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-165-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-175-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-152-0x0000000004D50000-0x000000000524E000-memory.dmpFilesize
5.0MB
-
memory/4452-153-0x0000000004C30000-0x0000000004C48000-memory.dmpFilesize
96KB
-
memory/4452-154-0x00000000007E0000-0x000000000080D000-memory.dmpFilesize
180KB
-
memory/4452-163-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-161-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-159-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-155-0x0000000004D40000-0x0000000004D50000-memory.dmpFilesize
64KB
-
memory/4452-156-0x0000000004D40000-0x0000000004D50000-memory.dmpFilesize
64KB
-
memory/4452-188-0x0000000004D40000-0x0000000004D50000-memory.dmpFilesize
64KB
-
memory/4452-185-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-158-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/4452-157-0x0000000004D40000-0x0000000004D50000-memory.dmpFilesize
64KB
-
memory/4912-1215-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/4912-1217-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/4912-1173-0x0000000005130000-0x00000000051BE000-memory.dmpFilesize
568KB
-
memory/4912-1172-0x0000000000280000-0x00000000007F4000-memory.dmpFilesize
5.5MB
-
memory/4960-1158-0x0000000005100000-0x0000000005110000-memory.dmpFilesize
64KB
-
memory/4960-1157-0x00000000050A0000-0x00000000050EB000-memory.dmpFilesize
300KB
-
memory/4960-1156-0x00000000027C0000-0x00000000027C6000-memory.dmpFilesize
24KB
-
memory/4960-1155-0x00000000006C0000-0x000000000071A000-memory.dmpFilesize
360KB