Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
21-03-2023 16:11
Static task
static1
Behavioral task
behavioral1
Sample
8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exe
Resource
win10-20230220-en
General
-
Target
8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exe
-
Size
1.0MB
-
MD5
87c69c536af17f8d4a9e0d57750cc6f2
-
SHA1
dda5c3b4850568178277ba7870b555e1499f780d
-
SHA256
8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97
-
SHA512
2a554cebffa04db15aa92a1193cb8e3f5f24cb6673691435f59cb29a7ac76f12c60ea757d1f0d091c3213044f9ca05062769c1364146b4f25d13fcd76b35b023
-
SSDEEP
24576:9yIFZnTLDCfLWNJ4kmtEwydOmX/zAFUmq/XFdJA:YcnGTWNJ38JY/zAFqXFdJ
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
vint
193.233.20.30:4125
-
auth_value
fb8811912f8370b3d23bffda092d88d0
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
aurora
212.87.204.93:8081
Signatures
-
Detect rhadamanthys stealer shellcode 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3392-1208-0x00000000008F0000-0x000000000090C000-memory.dmp family_rhadamanthys behavioral1/memory/3392-1213-0x00000000008F0000-0x000000000090C000-memory.dmp family_rhadamanthys -
Processes:
tz1052.exev7675cQ.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz1052.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz1052.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v7675cQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v7675cQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v7675cQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v7675cQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v7675cQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz1052.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz1052.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz1052.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/1528-196-0x0000000000A00000-0x0000000000A46000-memory.dmp family_redline behavioral1/memory/1528-197-0x0000000002560000-0x00000000025A4000-memory.dmp family_redline behavioral1/memory/1528-198-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-199-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-201-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-203-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-205-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-207-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-209-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-211-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-213-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-215-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-217-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-219-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-221-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-223-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-225-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-227-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-229-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-231-0x0000000002560000-0x000000000259E000-memory.dmp family_redline behavioral1/memory/1528-1119-0x0000000005090000-0x00000000050A0000-memory.dmp family_redline -
Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
-
Downloads MZ/PE file
-
Executes dropped EXE 13 IoCs
Processes:
zap7009.exezap1669.exezap2042.exetz1052.exev7675cQ.exew95cJ58.exexzvTZ25.exey81ev36.exelegenda.exelegenda.exeserv.exesvchost.exelegenda.exepid process 4624 zap7009.exe 4376 zap1669.exe 1608 zap2042.exe 992 tz1052.exe 2832 v7675cQ.exe 1528 w95cJ58.exe 4840 xzvTZ25.exe 3512 y81ev36.exe 5080 legenda.exe 520 legenda.exe 3392 serv.exe 880 svchost.exe 1500 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2584 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz1052.exev7675cQ.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz1052.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v7675cQ.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v7675cQ.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
zap1669.exezap2042.exe8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exezap7009.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap1669.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap2042.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap2042.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap7009.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap7009.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap1669.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
serv.exepid process 3392 serv.exe 3392 serv.exe 3392 serv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
serv.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID serv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI serv.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI serv.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI serv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 serv.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
tz1052.exev7675cQ.exew95cJ58.exexzvTZ25.exepid process 992 tz1052.exe 992 tz1052.exe 2832 v7675cQ.exe 2832 v7675cQ.exe 1528 w95cJ58.exe 1528 w95cJ58.exe 4840 xzvTZ25.exe 4840 xzvTZ25.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tz1052.exev7675cQ.exew95cJ58.exexzvTZ25.exewmic.exeWMIC.exedescription pid process Token: SeDebugPrivilege 992 tz1052.exe Token: SeDebugPrivilege 2832 v7675cQ.exe Token: SeDebugPrivilege 1528 w95cJ58.exe Token: SeDebugPrivilege 4840 xzvTZ25.exe Token: SeIncreaseQuotaPrivilege 1236 wmic.exe Token: SeSecurityPrivilege 1236 wmic.exe Token: SeTakeOwnershipPrivilege 1236 wmic.exe Token: SeLoadDriverPrivilege 1236 wmic.exe Token: SeSystemProfilePrivilege 1236 wmic.exe Token: SeSystemtimePrivilege 1236 wmic.exe Token: SeProfSingleProcessPrivilege 1236 wmic.exe Token: SeIncBasePriorityPrivilege 1236 wmic.exe Token: SeCreatePagefilePrivilege 1236 wmic.exe Token: SeBackupPrivilege 1236 wmic.exe Token: SeRestorePrivilege 1236 wmic.exe Token: SeShutdownPrivilege 1236 wmic.exe Token: SeDebugPrivilege 1236 wmic.exe Token: SeSystemEnvironmentPrivilege 1236 wmic.exe Token: SeRemoteShutdownPrivilege 1236 wmic.exe Token: SeUndockPrivilege 1236 wmic.exe Token: SeManageVolumePrivilege 1236 wmic.exe Token: 33 1236 wmic.exe Token: 34 1236 wmic.exe Token: 35 1236 wmic.exe Token: 36 1236 wmic.exe Token: SeIncreaseQuotaPrivilege 1236 wmic.exe Token: SeSecurityPrivilege 1236 wmic.exe Token: SeTakeOwnershipPrivilege 1236 wmic.exe Token: SeLoadDriverPrivilege 1236 wmic.exe Token: SeSystemProfilePrivilege 1236 wmic.exe Token: SeSystemtimePrivilege 1236 wmic.exe Token: SeProfSingleProcessPrivilege 1236 wmic.exe Token: SeIncBasePriorityPrivilege 1236 wmic.exe Token: SeCreatePagefilePrivilege 1236 wmic.exe Token: SeBackupPrivilege 1236 wmic.exe Token: SeRestorePrivilege 1236 wmic.exe Token: SeShutdownPrivilege 1236 wmic.exe Token: SeDebugPrivilege 1236 wmic.exe Token: SeSystemEnvironmentPrivilege 1236 wmic.exe Token: SeRemoteShutdownPrivilege 1236 wmic.exe Token: SeUndockPrivilege 1236 wmic.exe Token: SeManageVolumePrivilege 1236 wmic.exe Token: 33 1236 wmic.exe Token: 34 1236 wmic.exe Token: 35 1236 wmic.exe Token: 36 1236 wmic.exe Token: SeIncreaseQuotaPrivilege 1196 WMIC.exe Token: SeSecurityPrivilege 1196 WMIC.exe Token: SeTakeOwnershipPrivilege 1196 WMIC.exe Token: SeLoadDriverPrivilege 1196 WMIC.exe Token: SeSystemProfilePrivilege 1196 WMIC.exe Token: SeSystemtimePrivilege 1196 WMIC.exe Token: SeProfSingleProcessPrivilege 1196 WMIC.exe Token: SeIncBasePriorityPrivilege 1196 WMIC.exe Token: SeCreatePagefilePrivilege 1196 WMIC.exe Token: SeBackupPrivilege 1196 WMIC.exe Token: SeRestorePrivilege 1196 WMIC.exe Token: SeShutdownPrivilege 1196 WMIC.exe Token: SeDebugPrivilege 1196 WMIC.exe Token: SeSystemEnvironmentPrivilege 1196 WMIC.exe Token: SeRemoteShutdownPrivilege 1196 WMIC.exe Token: SeUndockPrivilege 1196 WMIC.exe Token: SeManageVolumePrivilege 1196 WMIC.exe Token: 33 1196 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exezap7009.exezap1669.exezap2042.exey81ev36.exelegenda.execmd.exesvchost.execmd.exedescription pid process target process PID 4144 wrote to memory of 4624 4144 8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exe zap7009.exe PID 4144 wrote to memory of 4624 4144 8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exe zap7009.exe PID 4144 wrote to memory of 4624 4144 8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exe zap7009.exe PID 4624 wrote to memory of 4376 4624 zap7009.exe zap1669.exe PID 4624 wrote to memory of 4376 4624 zap7009.exe zap1669.exe PID 4624 wrote to memory of 4376 4624 zap7009.exe zap1669.exe PID 4376 wrote to memory of 1608 4376 zap1669.exe zap2042.exe PID 4376 wrote to memory of 1608 4376 zap1669.exe zap2042.exe PID 4376 wrote to memory of 1608 4376 zap1669.exe zap2042.exe PID 1608 wrote to memory of 992 1608 zap2042.exe tz1052.exe PID 1608 wrote to memory of 992 1608 zap2042.exe tz1052.exe PID 1608 wrote to memory of 2832 1608 zap2042.exe v7675cQ.exe PID 1608 wrote to memory of 2832 1608 zap2042.exe v7675cQ.exe PID 1608 wrote to memory of 2832 1608 zap2042.exe v7675cQ.exe PID 4376 wrote to memory of 1528 4376 zap1669.exe w95cJ58.exe PID 4376 wrote to memory of 1528 4376 zap1669.exe w95cJ58.exe PID 4376 wrote to memory of 1528 4376 zap1669.exe w95cJ58.exe PID 4624 wrote to memory of 4840 4624 zap7009.exe xzvTZ25.exe PID 4624 wrote to memory of 4840 4624 zap7009.exe xzvTZ25.exe PID 4624 wrote to memory of 4840 4624 zap7009.exe xzvTZ25.exe PID 4144 wrote to memory of 3512 4144 8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exe y81ev36.exe PID 4144 wrote to memory of 3512 4144 8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exe y81ev36.exe PID 4144 wrote to memory of 3512 4144 8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exe y81ev36.exe PID 3512 wrote to memory of 5080 3512 y81ev36.exe legenda.exe PID 3512 wrote to memory of 5080 3512 y81ev36.exe legenda.exe PID 3512 wrote to memory of 5080 3512 y81ev36.exe legenda.exe PID 5080 wrote to memory of 5040 5080 legenda.exe schtasks.exe PID 5080 wrote to memory of 5040 5080 legenda.exe schtasks.exe PID 5080 wrote to memory of 5040 5080 legenda.exe schtasks.exe PID 5080 wrote to memory of 3404 5080 legenda.exe cmd.exe PID 5080 wrote to memory of 3404 5080 legenda.exe cmd.exe PID 5080 wrote to memory of 3404 5080 legenda.exe cmd.exe PID 3404 wrote to memory of 4924 3404 cmd.exe cmd.exe PID 3404 wrote to memory of 4924 3404 cmd.exe cmd.exe PID 3404 wrote to memory of 4924 3404 cmd.exe cmd.exe PID 3404 wrote to memory of 4948 3404 cmd.exe cacls.exe PID 3404 wrote to memory of 4948 3404 cmd.exe cacls.exe PID 3404 wrote to memory of 4948 3404 cmd.exe cacls.exe PID 3404 wrote to memory of 4968 3404 cmd.exe cacls.exe PID 3404 wrote to memory of 4968 3404 cmd.exe cacls.exe PID 3404 wrote to memory of 4968 3404 cmd.exe cacls.exe PID 3404 wrote to memory of 4908 3404 cmd.exe cmd.exe PID 3404 wrote to memory of 4908 3404 cmd.exe cmd.exe PID 3404 wrote to memory of 4908 3404 cmd.exe cmd.exe PID 3404 wrote to memory of 4976 3404 cmd.exe cacls.exe PID 3404 wrote to memory of 4976 3404 cmd.exe cacls.exe PID 3404 wrote to memory of 4976 3404 cmd.exe cacls.exe PID 3404 wrote to memory of 4880 3404 cmd.exe cacls.exe PID 3404 wrote to memory of 4880 3404 cmd.exe cacls.exe PID 3404 wrote to memory of 4880 3404 cmd.exe cacls.exe PID 5080 wrote to memory of 3392 5080 legenda.exe serv.exe PID 5080 wrote to memory of 3392 5080 legenda.exe serv.exe PID 5080 wrote to memory of 3392 5080 legenda.exe serv.exe PID 5080 wrote to memory of 880 5080 legenda.exe svchost.exe PID 5080 wrote to memory of 880 5080 legenda.exe svchost.exe PID 5080 wrote to memory of 880 5080 legenda.exe svchost.exe PID 880 wrote to memory of 1236 880 svchost.exe wmic.exe PID 880 wrote to memory of 1236 880 svchost.exe wmic.exe PID 880 wrote to memory of 1236 880 svchost.exe wmic.exe PID 880 wrote to memory of 1932 880 svchost.exe cmd.exe PID 880 wrote to memory of 1932 880 svchost.exe cmd.exe PID 880 wrote to memory of 1932 880 svchost.exe cmd.exe PID 1932 wrote to memory of 1196 1932 cmd.exe WMIC.exe PID 1932 wrote to memory of 1196 1932 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exe"C:\Users\Admin\AppData\Local\Temp\8ac88ae271259846109827c9d51c495c6400e29df34fcb26693560ec6ebf2e97.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7009.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7009.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1669.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1669.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2042.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2042.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1052.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1052.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7675cQ.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7675cQ.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w95cJ58.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w95cJ58.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xzvTZ25.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xzvTZ25.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y81ev36.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y81ev36.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe"C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exe"4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exeFilesize
4.4MB
MD5166d22ed93c723326a6d5fead162fdd3
SHA117cfd9649a4f68ef90c72689820876dbe4ca22d1
SHA256e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7
SHA512c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4
-
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exeFilesize
4.4MB
MD5166d22ed93c723326a6d5fead162fdd3
SHA117cfd9649a4f68ef90c72689820876dbe4ca22d1
SHA256e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7
SHA512c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4
-
C:\Users\Admin\AppData\Local\Temp\1000116001\serv.exeFilesize
4.4MB
MD5166d22ed93c723326a6d5fead162fdd3
SHA117cfd9649a4f68ef90c72689820876dbe4ca22d1
SHA256e9879548658614428c01bc7c4878bc87d0e2ad57b3621a7aa614e89c32c388e7
SHA512c871182afed08bcbd73ea86d058973afd2602481497f752d7da46aad4d9a09ea39911010832e3bf4b68f5cf7ac73300169efeeeefe82a68a897f543f7dfc96f4
-
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exeFilesize
3.0MB
MD5a8a106555b9e1f92569d623c66ee8c12
SHA1a5080c26b5f5911c10d80654c84239a226fc75d1
SHA25684aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA5129b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26
-
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exeFilesize
3.0MB
MD5a8a106555b9e1f92569d623c66ee8c12
SHA1a5080c26b5f5911c10d80654c84239a226fc75d1
SHA25684aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA5129b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26
-
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exeFilesize
3.0MB
MD5a8a106555b9e1f92569d623c66ee8c12
SHA1a5080c26b5f5911c10d80654c84239a226fc75d1
SHA25684aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA5129b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y81ev36.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y81ev36.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7009.exeFilesize
876KB
MD5c1825a6d84364b8930a9555bcffbe3fa
SHA11755b5725ce2673a881ea22d7eb49b93b013e257
SHA256d0e06835ccba4ff54406baaba7766f047d40f275712839dd3b88ba8b573fd7b4
SHA512ad4d3bfa7dcc8b08b88786777b7b0b4f66667023c3995347ac1df78059603f4a8bd04b58f6f5c18fae5c1fa3886778cbad1247e072e22637e8cc8d7184769b45
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7009.exeFilesize
876KB
MD5c1825a6d84364b8930a9555bcffbe3fa
SHA11755b5725ce2673a881ea22d7eb49b93b013e257
SHA256d0e06835ccba4ff54406baaba7766f047d40f275712839dd3b88ba8b573fd7b4
SHA512ad4d3bfa7dcc8b08b88786777b7b0b4f66667023c3995347ac1df78059603f4a8bd04b58f6f5c18fae5c1fa3886778cbad1247e072e22637e8cc8d7184769b45
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xzvTZ25.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xzvTZ25.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1669.exeFilesize
735KB
MD5b38d654d62860dc514500f5885d0152e
SHA1bba9de5a7b47a12442b5f338c512c347913bcc19
SHA25623dea44b382ea1f5552f6e623341f32838bb6bdc222c2a3bf784018af93b2e96
SHA512a199fec82898117a8dd3b6190023bcca094ce41f033b8c8afb8f2b5b2e17d1e258da8daa73c492abed8132264048cc82a5ec3be523d3be65d4e00e1715481cc9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1669.exeFilesize
735KB
MD5b38d654d62860dc514500f5885d0152e
SHA1bba9de5a7b47a12442b5f338c512c347913bcc19
SHA25623dea44b382ea1f5552f6e623341f32838bb6bdc222c2a3bf784018af93b2e96
SHA512a199fec82898117a8dd3b6190023bcca094ce41f033b8c8afb8f2b5b2e17d1e258da8daa73c492abed8132264048cc82a5ec3be523d3be65d4e00e1715481cc9
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w95cJ58.exeFilesize
420KB
MD54b5004beae0f188ade8547cb09c7ba92
SHA1c002f7d95b2825aa9f7e7e967bff036d33b9f392
SHA25648eca4b0f5fe4828d2f9d64d08344b5a4725e15766fc2755392bd9ab8634f6d1
SHA512e2e67a427f434ac7d7bfe3cbefd6040f2a0afdd723c3fcf61153ef6799bb0344ab86aeb643961b76ba587ab2cdb5e3209c4b35c0b831e4bee5857ddf94459d5e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w95cJ58.exeFilesize
420KB
MD54b5004beae0f188ade8547cb09c7ba92
SHA1c002f7d95b2825aa9f7e7e967bff036d33b9f392
SHA25648eca4b0f5fe4828d2f9d64d08344b5a4725e15766fc2755392bd9ab8634f6d1
SHA512e2e67a427f434ac7d7bfe3cbefd6040f2a0afdd723c3fcf61153ef6799bb0344ab86aeb643961b76ba587ab2cdb5e3209c4b35c0b831e4bee5857ddf94459d5e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2042.exeFilesize
364KB
MD5e39c10fbf21bd0d89d23f07abf3643ac
SHA11013c61b6d4da2b453f8b0813157add4ee9aa646
SHA2566fbef9ba7caae6514149d24b0a4294b8c87e86311ec55435d4daf1d3c3320bec
SHA51261db540037b32319e5442e325c1ccae38e8e6710806231837089a34320fe6cef71adce5049546f466194689e1c658f93feb135577c8f2ed25f29339e6e8a7997
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap2042.exeFilesize
364KB
MD5e39c10fbf21bd0d89d23f07abf3643ac
SHA11013c61b6d4da2b453f8b0813157add4ee9aa646
SHA2566fbef9ba7caae6514149d24b0a4294b8c87e86311ec55435d4daf1d3c3320bec
SHA51261db540037b32319e5442e325c1ccae38e8e6710806231837089a34320fe6cef71adce5049546f466194689e1c658f93feb135577c8f2ed25f29339e6e8a7997
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1052.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1052.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7675cQ.exeFilesize
363KB
MD5bccdc93fa6818977f9a080d7ff197c79
SHA1ca7e355ef290fe9c07617e69e4873681b4a21e92
SHA256fb49a92fc87cb9fe98b54afc34994fd2219a72cc36258e363de690f19e1d8181
SHA512799354bd23dfb544f47259a9c69b9d3250550dd15886a1b06cae66a016105b1e25f57c3ec28fad5f4cbd07f08783c38abddcc6493f5064ecaf99243b39c5c512
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7675cQ.exeFilesize
363KB
MD5bccdc93fa6818977f9a080d7ff197c79
SHA1ca7e355ef290fe9c07617e69e4873681b4a21e92
SHA256fb49a92fc87cb9fe98b54afc34994fd2219a72cc36258e363de690f19e1d8181
SHA512799354bd23dfb544f47259a9c69b9d3250550dd15886a1b06cae66a016105b1e25f57c3ec28fad5f4cbd07f08783c38abddcc6493f5064ecaf99243b39c5c512
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPjFilesize
72KB
MD52b8e1b75b4d4fdf0c640838191ac3946
SHA1dfac012ccaa015f6a9ec5bd1c55ffa7b8074fb7f
SHA25617a69481ffd684f025b0fe6b0f22529bd8454c49915e580da43fcb08a0c56e4e
SHA5123c4de03250813dc78b772cc7e3246ac2726c37fae00844bfceda683e05506b53ba7ea95a06e2929e8ec736ccd50a9138e9f6e3c80980ebde5ed7ac66f06cc038
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
memory/992-148-0x00000000009C0000-0x00000000009CA000-memory.dmpFilesize
40KB
-
memory/1528-223-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-1115-0x0000000005EF0000-0x0000000005F56000-memory.dmpFilesize
408KB
-
memory/1528-1124-0x0000000005090000-0x00000000050A0000-memory.dmpFilesize
64KB
-
memory/1528-1123-0x0000000007100000-0x0000000007150000-memory.dmpFilesize
320KB
-
memory/1528-196-0x0000000000A00000-0x0000000000A46000-memory.dmpFilesize
280KB
-
memory/1528-197-0x0000000002560000-0x00000000025A4000-memory.dmpFilesize
272KB
-
memory/1528-198-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-199-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-201-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-203-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-205-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-207-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-209-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-211-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-213-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-215-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-217-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-219-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-221-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-1122-0x0000000007070000-0x00000000070E6000-memory.dmpFilesize
472KB
-
memory/1528-225-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-227-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-229-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-231-0x0000000002560000-0x000000000259E000-memory.dmpFilesize
248KB
-
memory/1528-485-0x0000000000800000-0x000000000084B000-memory.dmpFilesize
300KB
-
memory/1528-486-0x0000000005090000-0x00000000050A0000-memory.dmpFilesize
64KB
-
memory/1528-491-0x0000000005090000-0x00000000050A0000-memory.dmpFilesize
64KB
-
memory/1528-489-0x0000000005090000-0x00000000050A0000-memory.dmpFilesize
64KB
-
memory/1528-1108-0x00000000055A0000-0x0000000005BA6000-memory.dmpFilesize
6.0MB
-
memory/1528-1109-0x0000000005BB0000-0x0000000005CBA000-memory.dmpFilesize
1.0MB
-
memory/1528-1110-0x00000000029D0000-0x00000000029E2000-memory.dmpFilesize
72KB
-
memory/1528-1111-0x00000000029F0000-0x0000000002A2E000-memory.dmpFilesize
248KB
-
memory/1528-1112-0x0000000005090000-0x00000000050A0000-memory.dmpFilesize
64KB
-
memory/1528-1113-0x0000000004FD0000-0x000000000501B000-memory.dmpFilesize
300KB
-
memory/1528-1114-0x0000000005E50000-0x0000000005EE2000-memory.dmpFilesize
584KB
-
memory/1528-1121-0x00000000068E0000-0x0000000006E0C000-memory.dmpFilesize
5.2MB
-
memory/1528-1117-0x0000000005090000-0x00000000050A0000-memory.dmpFilesize
64KB
-
memory/1528-1118-0x0000000005090000-0x00000000050A0000-memory.dmpFilesize
64KB
-
memory/1528-1119-0x0000000005090000-0x00000000050A0000-memory.dmpFilesize
64KB
-
memory/1528-1120-0x00000000066F0000-0x00000000068B2000-memory.dmpFilesize
1.8MB
-
memory/2832-177-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-161-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-188-0x0000000002240000-0x0000000002250000-memory.dmpFilesize
64KB
-
memory/2832-189-0x0000000000400000-0x000000000071D000-memory.dmpFilesize
3.1MB
-
memory/2832-186-0x0000000002240000-0x0000000002250000-memory.dmpFilesize
64KB
-
memory/2832-185-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-154-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2832-155-0x0000000002450000-0x000000000246A000-memory.dmpFilesize
104KB
-
memory/2832-156-0x0000000004CA0000-0x000000000519E000-memory.dmpFilesize
5.0MB
-
memory/2832-183-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-158-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-187-0x0000000002240000-0x0000000002250000-memory.dmpFilesize
64KB
-
memory/2832-173-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-175-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-191-0x0000000000400000-0x000000000071D000-memory.dmpFilesize
3.1MB
-
memory/2832-171-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-169-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-167-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-165-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-157-0x0000000002810000-0x0000000002828000-memory.dmpFilesize
96KB
-
memory/2832-163-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-179-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-159-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/2832-181-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/3392-1208-0x00000000008F0000-0x000000000090C000-memory.dmpFilesize
112KB
-
memory/3392-1210-0x0000000000800000-0x0000000000803000-memory.dmpFilesize
12KB
-
memory/3392-1213-0x00000000008F0000-0x000000000090C000-memory.dmpFilesize
112KB
-
memory/3392-1209-0x0000000000800000-0x0000000000802000-memory.dmpFilesize
8KB
-
memory/3392-1168-0x00000000001D0000-0x00000000001FE000-memory.dmpFilesize
184KB
-
memory/4840-1132-0x00000000055B0000-0x00000000055C0000-memory.dmpFilesize
64KB
-
memory/4840-1131-0x00000000053F0000-0x000000000543B000-memory.dmpFilesize
300KB
-
memory/4840-1130-0x00000000009B0000-0x00000000009E2000-memory.dmpFilesize
200KB