Analysis
-
max time kernel
126s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 17:08
Static task
static1
General
-
Target
ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exe
-
Size
1.1MB
-
MD5
41b24e468efaf252fcb410c0b3c4f183
-
SHA1
e3d56a957f06d8c52bec246c6ab458d55feb7120
-
SHA256
ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc
-
SHA512
b28166705f88f5785a432605f291bdc80d7fb154c977e50404d9154b38d8bf60d76f97b63255a9bf20a55e7fcd8937693a6d3059d89170e6483d91b5506d1a55
-
SSDEEP
24576:HyaygU4gy2eUSNInjdHknVO5UF3z07LwsIHl:Sa/gy2zSKjdeO5KKw
Malware Config
Extracted
redline
gena
193.233.20.30:4125
-
auth_value
93c20961cb6b06b2d5781c212db6201e
Extracted
redline
vint
193.233.20.30:4125
-
auth_value
fb8811912f8370b3d23bffda092d88d0
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
aurora
212.87.204.93:8081
Signatures
-
Processes:
tz6299.exev7056ZK.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz6299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz6299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v7056ZK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v7056ZK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz6299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz6299.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz6299.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v7056ZK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v7056ZK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v7056ZK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v7056ZK.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz6299.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4800-207-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-208-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-210-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-212-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-214-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-216-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-218-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-220-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-222-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-224-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-226-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-228-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-230-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-232-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-234-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-236-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-238-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-240-0x00000000028A0000-0x00000000028DE000-memory.dmp family_redline behavioral1/memory/4800-554-0x0000000000B10000-0x0000000000B20000-memory.dmp family_redline -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
y21EN96.exelegenda.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation y21EN96.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation legenda.exe -
Executes dropped EXE 12 IoCs
Processes:
zap7923.exezap1552.exezap6482.exetz6299.exev7056ZK.exew22NY54.exexbqUH26.exey21EN96.exelegenda.exesvchost.exelegenda.exelegenda.exepid process 988 zap7923.exe 2568 zap1552.exe 3400 zap6482.exe 952 tz6299.exe 552 v7056ZK.exe 4800 w22NY54.exe 2012 xbqUH26.exe 1296 y21EN96.exe 4216 legenda.exe 1244 svchost.exe 4680 legenda.exe 624 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 3856 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
v7056ZK.exetz6299.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v7056ZK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz6299.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v7056ZK.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exezap7923.exezap1552.exezap6482.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap7923.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap7923.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap1552.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap1552.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap6482.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap6482.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4112 4800 WerFault.exe w22NY54.exe 2420 4800 WerFault.exe w22NY54.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
tz6299.exev7056ZK.exew22NY54.exexbqUH26.exepid process 952 tz6299.exe 952 tz6299.exe 552 v7056ZK.exe 552 v7056ZK.exe 4800 w22NY54.exe 4800 w22NY54.exe 2012 xbqUH26.exe 2012 xbqUH26.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tz6299.exev7056ZK.exew22NY54.exexbqUH26.exewmic.exeWMIC.exedescription pid process Token: SeDebugPrivilege 952 tz6299.exe Token: SeDebugPrivilege 552 v7056ZK.exe Token: SeDebugPrivilege 4800 w22NY54.exe Token: SeDebugPrivilege 2012 xbqUH26.exe Token: SeIncreaseQuotaPrivilege 2660 wmic.exe Token: SeSecurityPrivilege 2660 wmic.exe Token: SeTakeOwnershipPrivilege 2660 wmic.exe Token: SeLoadDriverPrivilege 2660 wmic.exe Token: SeSystemProfilePrivilege 2660 wmic.exe Token: SeSystemtimePrivilege 2660 wmic.exe Token: SeProfSingleProcessPrivilege 2660 wmic.exe Token: SeIncBasePriorityPrivilege 2660 wmic.exe Token: SeCreatePagefilePrivilege 2660 wmic.exe Token: SeBackupPrivilege 2660 wmic.exe Token: SeRestorePrivilege 2660 wmic.exe Token: SeShutdownPrivilege 2660 wmic.exe Token: SeDebugPrivilege 2660 wmic.exe Token: SeSystemEnvironmentPrivilege 2660 wmic.exe Token: SeRemoteShutdownPrivilege 2660 wmic.exe Token: SeUndockPrivilege 2660 wmic.exe Token: SeManageVolumePrivilege 2660 wmic.exe Token: 33 2660 wmic.exe Token: 34 2660 wmic.exe Token: 35 2660 wmic.exe Token: 36 2660 wmic.exe Token: SeIncreaseQuotaPrivilege 2660 wmic.exe Token: SeSecurityPrivilege 2660 wmic.exe Token: SeTakeOwnershipPrivilege 2660 wmic.exe Token: SeLoadDriverPrivilege 2660 wmic.exe Token: SeSystemProfilePrivilege 2660 wmic.exe Token: SeSystemtimePrivilege 2660 wmic.exe Token: SeProfSingleProcessPrivilege 2660 wmic.exe Token: SeIncBasePriorityPrivilege 2660 wmic.exe Token: SeCreatePagefilePrivilege 2660 wmic.exe Token: SeBackupPrivilege 2660 wmic.exe Token: SeRestorePrivilege 2660 wmic.exe Token: SeShutdownPrivilege 2660 wmic.exe Token: SeDebugPrivilege 2660 wmic.exe Token: SeSystemEnvironmentPrivilege 2660 wmic.exe Token: SeRemoteShutdownPrivilege 2660 wmic.exe Token: SeUndockPrivilege 2660 wmic.exe Token: SeManageVolumePrivilege 2660 wmic.exe Token: 33 2660 wmic.exe Token: 34 2660 wmic.exe Token: 35 2660 wmic.exe Token: 36 2660 wmic.exe Token: SeIncreaseQuotaPrivilege 1736 WMIC.exe Token: SeSecurityPrivilege 1736 WMIC.exe Token: SeTakeOwnershipPrivilege 1736 WMIC.exe Token: SeLoadDriverPrivilege 1736 WMIC.exe Token: SeSystemProfilePrivilege 1736 WMIC.exe Token: SeSystemtimePrivilege 1736 WMIC.exe Token: SeProfSingleProcessPrivilege 1736 WMIC.exe Token: SeIncBasePriorityPrivilege 1736 WMIC.exe Token: SeCreatePagefilePrivilege 1736 WMIC.exe Token: SeBackupPrivilege 1736 WMIC.exe Token: SeRestorePrivilege 1736 WMIC.exe Token: SeShutdownPrivilege 1736 WMIC.exe Token: SeDebugPrivilege 1736 WMIC.exe Token: SeSystemEnvironmentPrivilege 1736 WMIC.exe Token: SeRemoteShutdownPrivilege 1736 WMIC.exe Token: SeUndockPrivilege 1736 WMIC.exe Token: SeManageVolumePrivilege 1736 WMIC.exe Token: 33 1736 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exezap7923.exezap1552.exezap6482.exey21EN96.exelegenda.execmd.exesvchost.execmd.exedescription pid process target process PID 1444 wrote to memory of 988 1444 ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exe zap7923.exe PID 1444 wrote to memory of 988 1444 ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exe zap7923.exe PID 1444 wrote to memory of 988 1444 ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exe zap7923.exe PID 988 wrote to memory of 2568 988 zap7923.exe zap1552.exe PID 988 wrote to memory of 2568 988 zap7923.exe zap1552.exe PID 988 wrote to memory of 2568 988 zap7923.exe zap1552.exe PID 2568 wrote to memory of 3400 2568 zap1552.exe zap6482.exe PID 2568 wrote to memory of 3400 2568 zap1552.exe zap6482.exe PID 2568 wrote to memory of 3400 2568 zap1552.exe zap6482.exe PID 3400 wrote to memory of 952 3400 zap6482.exe tz6299.exe PID 3400 wrote to memory of 952 3400 zap6482.exe tz6299.exe PID 3400 wrote to memory of 552 3400 zap6482.exe v7056ZK.exe PID 3400 wrote to memory of 552 3400 zap6482.exe v7056ZK.exe PID 3400 wrote to memory of 552 3400 zap6482.exe v7056ZK.exe PID 2568 wrote to memory of 4800 2568 zap1552.exe w22NY54.exe PID 2568 wrote to memory of 4800 2568 zap1552.exe w22NY54.exe PID 2568 wrote to memory of 4800 2568 zap1552.exe w22NY54.exe PID 988 wrote to memory of 2012 988 zap7923.exe xbqUH26.exe PID 988 wrote to memory of 2012 988 zap7923.exe xbqUH26.exe PID 988 wrote to memory of 2012 988 zap7923.exe xbqUH26.exe PID 1444 wrote to memory of 1296 1444 ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exe y21EN96.exe PID 1444 wrote to memory of 1296 1444 ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exe y21EN96.exe PID 1444 wrote to memory of 1296 1444 ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exe y21EN96.exe PID 1296 wrote to memory of 4216 1296 y21EN96.exe legenda.exe PID 1296 wrote to memory of 4216 1296 y21EN96.exe legenda.exe PID 1296 wrote to memory of 4216 1296 y21EN96.exe legenda.exe PID 4216 wrote to memory of 4736 4216 legenda.exe schtasks.exe PID 4216 wrote to memory of 4736 4216 legenda.exe schtasks.exe PID 4216 wrote to memory of 4736 4216 legenda.exe schtasks.exe PID 4216 wrote to memory of 4616 4216 legenda.exe cmd.exe PID 4216 wrote to memory of 4616 4216 legenda.exe cmd.exe PID 4216 wrote to memory of 4616 4216 legenda.exe cmd.exe PID 4616 wrote to memory of 4100 4616 cmd.exe cmd.exe PID 4616 wrote to memory of 4100 4616 cmd.exe cmd.exe PID 4616 wrote to memory of 4100 4616 cmd.exe cmd.exe PID 4616 wrote to memory of 444 4616 cmd.exe cacls.exe PID 4616 wrote to memory of 444 4616 cmd.exe cacls.exe PID 4616 wrote to memory of 444 4616 cmd.exe cacls.exe PID 4616 wrote to memory of 1580 4616 cmd.exe cacls.exe PID 4616 wrote to memory of 1580 4616 cmd.exe cacls.exe PID 4616 wrote to memory of 1580 4616 cmd.exe cacls.exe PID 4616 wrote to memory of 428 4616 cmd.exe cmd.exe PID 4616 wrote to memory of 428 4616 cmd.exe cmd.exe PID 4616 wrote to memory of 428 4616 cmd.exe cmd.exe PID 4616 wrote to memory of 1304 4616 cmd.exe cacls.exe PID 4616 wrote to memory of 1304 4616 cmd.exe cacls.exe PID 4616 wrote to memory of 1304 4616 cmd.exe cacls.exe PID 4616 wrote to memory of 624 4616 cmd.exe cacls.exe PID 4616 wrote to memory of 624 4616 cmd.exe cacls.exe PID 4616 wrote to memory of 624 4616 cmd.exe cacls.exe PID 4216 wrote to memory of 1244 4216 legenda.exe svchost.exe PID 4216 wrote to memory of 1244 4216 legenda.exe svchost.exe PID 4216 wrote to memory of 1244 4216 legenda.exe svchost.exe PID 1244 wrote to memory of 2660 1244 svchost.exe wmic.exe PID 1244 wrote to memory of 2660 1244 svchost.exe wmic.exe PID 1244 wrote to memory of 2660 1244 svchost.exe wmic.exe PID 1244 wrote to memory of 2784 1244 svchost.exe cmd.exe PID 1244 wrote to memory of 2784 1244 svchost.exe cmd.exe PID 1244 wrote to memory of 2784 1244 svchost.exe cmd.exe PID 2784 wrote to memory of 1736 2784 cmd.exe WMIC.exe PID 2784 wrote to memory of 1736 2784 cmd.exe WMIC.exe PID 2784 wrote to memory of 1736 2784 cmd.exe WMIC.exe PID 1244 wrote to memory of 2476 1244 svchost.exe cmd.exe PID 1244 wrote to memory of 2476 1244 svchost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exe"C:\Users\Admin\AppData\Local\Temp\ff536ca4a26e8707141eadce9b6fbec029d9f247866d9281dfd2a6a1de1077cc.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7923.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7923.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1552.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1552.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6482.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6482.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6299.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6299.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7056ZK.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7056ZK.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w22NY54.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w22NY54.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 9565⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 9205⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbqUH26.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbqUH26.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y21EN96.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y21EN96.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4800 -ip 48001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4800 -ip 48001⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exeFilesize
3.0MB
MD5a8a106555b9e1f92569d623c66ee8c12
SHA1a5080c26b5f5911c10d80654c84239a226fc75d1
SHA25684aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA5129b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26
-
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exeFilesize
3.0MB
MD5a8a106555b9e1f92569d623c66ee8c12
SHA1a5080c26b5f5911c10d80654c84239a226fc75d1
SHA25684aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA5129b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26
-
C:\Users\Admin\AppData\Local\Temp\1000118001\svchost.exeFilesize
3.0MB
MD5a8a106555b9e1f92569d623c66ee8c12
SHA1a5080c26b5f5911c10d80654c84239a226fc75d1
SHA25684aac7290471d6aa883962c2e739b44adcea7f533cc0317e8d0d6f847def1f7a
SHA5129b9813b0b47e84523fc96cc427aa234d4533e77483ddf28dae35449570373370fdde4380877870aca634a9746b58743ea3c1d9ea31d7162d61d645ca58f60b26
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y21EN96.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y21EN96.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7923.exeFilesize
905KB
MD51a704eed31c535af05e9cf594d7a6fb5
SHA12093abe99725d9586b43d2e944617137d329eaa7
SHA256582466f8082f6d673d1fc89ac9da2f174b21c06090c6352c6d3e2d102e862045
SHA51274439a4c11f62d035dc5548337985fa08c7bb1933bf6afc9047a38bb0724041533a567ff0d9311342a2bef3997f552014a93e20aa7870124fd4cf6c7f288d7e5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap7923.exeFilesize
905KB
MD51a704eed31c535af05e9cf594d7a6fb5
SHA12093abe99725d9586b43d2e944617137d329eaa7
SHA256582466f8082f6d673d1fc89ac9da2f174b21c06090c6352c6d3e2d102e862045
SHA51274439a4c11f62d035dc5548337985fa08c7bb1933bf6afc9047a38bb0724041533a567ff0d9311342a2bef3997f552014a93e20aa7870124fd4cf6c7f288d7e5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbqUH26.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xbqUH26.exeFilesize
175KB
MD53389637c0d072121bf1b127629736d37
SHA1300e915efdf2479bfd0d3699c0a6bc51260f9655
SHA2562b74c4ce2674a8fc0c78fffa39c5de5e43ae28b8bf425349a5f97c6a61135153
SHA512a32cc060d2600f6ca94ffdce07c95ea5e2f56c0b418260456b568cb41e5f55db0c4fc97c35ca4103c674e61a17300d834d2c0da5a78b7084b6bc342fd23a7fb4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1552.exeFilesize
763KB
MD50da6f5e29fc6e1bcd34c636460d25f46
SHA133030fa9164cbae2b829caac87921a9a6b6b0303
SHA25681edf6c31fea274f126f43b7b2df9bfd85b10bbff3276dcb327c97de86024701
SHA51230df9d4f778615093b81aaad73e65d39490aa39b55760d79261cf4b4d99013ec5e721e3ea2f20f658307918fa3e4fbdc11a586ddc20b4821360cdcfeca45127a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap1552.exeFilesize
763KB
MD50da6f5e29fc6e1bcd34c636460d25f46
SHA133030fa9164cbae2b829caac87921a9a6b6b0303
SHA25681edf6c31fea274f126f43b7b2df9bfd85b10bbff3276dcb327c97de86024701
SHA51230df9d4f778615093b81aaad73e65d39490aa39b55760d79261cf4b4d99013ec5e721e3ea2f20f658307918fa3e4fbdc11a586ddc20b4821360cdcfeca45127a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w22NY54.exeFilesize
456KB
MD5b5c7157a2a2e521b0bc9dd2de3fb810e
SHA12e3160ce72e5a67f11a65471ed346ace966e14b9
SHA25658185af4ec3e8ebfbd77603cd494fa99d8dc4338fb6e70cd8720d8869365b292
SHA512a6494b3aa1f81e19781f5128f87287f98ab8d07d05296a37db9bf18d8a1f034ea7ded09fcaed9bd13a81dd13baf5484c99236271f6badf062c6f16e8464b9d0a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w22NY54.exeFilesize
456KB
MD5b5c7157a2a2e521b0bc9dd2de3fb810e
SHA12e3160ce72e5a67f11a65471ed346ace966e14b9
SHA25658185af4ec3e8ebfbd77603cd494fa99d8dc4338fb6e70cd8720d8869365b292
SHA512a6494b3aa1f81e19781f5128f87287f98ab8d07d05296a37db9bf18d8a1f034ea7ded09fcaed9bd13a81dd13baf5484c99236271f6badf062c6f16e8464b9d0a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6482.exeFilesize
378KB
MD5da4224e40479c326ab3756ffc03ec2dd
SHA13cae5febaedf3e80afa5098d6384cb8e9e8f3fbd
SHA25619ae19253bcc12a5bd19914e4a69558117687a76875a41002ae05b7678223d9f
SHA512919e32609014504d9cd9f8fe1b905f04900b062d4c1e342a6513e34e3fd2c67ff446ba78b9383a7e3e68c2a13500968f5b3dfccec4271c7b760fcd7be6f4aced
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6482.exeFilesize
378KB
MD5da4224e40479c326ab3756ffc03ec2dd
SHA13cae5febaedf3e80afa5098d6384cb8e9e8f3fbd
SHA25619ae19253bcc12a5bd19914e4a69558117687a76875a41002ae05b7678223d9f
SHA512919e32609014504d9cd9f8fe1b905f04900b062d4c1e342a6513e34e3fd2c67ff446ba78b9383a7e3e68c2a13500968f5b3dfccec4271c7b760fcd7be6f4aced
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6299.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6299.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7056ZK.exeFilesize
398KB
MD55e126c5e78683024780f4f991ea6ad44
SHA185a5540dbdcb1967fbb35976af049be1a55f3d9e
SHA256403f76da1f7968d2c7af854e697b3a9d114e7c78406ca3c8536377b463892476
SHA5125822389752788602ae2d60eac47d57cad958f8d340a750b51b824ee8fd770f147621a0431be147e2d229c96018606a900e120d9a4cfca2fad8aec2990611f531
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7056ZK.exeFilesize
398KB
MD55e126c5e78683024780f4f991ea6ad44
SHA185a5540dbdcb1967fbb35976af049be1a55f3d9e
SHA256403f76da1f7968d2c7af854e697b3a9d114e7c78406ca3c8536377b463892476
SHA5125822389752788602ae2d60eac47d57cad958f8d340a750b51b824ee8fd770f147621a0431be147e2d229c96018606a900e120d9a4cfca2fad8aec2990611f531
-
C:\Users\Admin\AppData\Local\Temp\RzLNTXYeUCWKsXbGyRAOmBTvKSJfjzaLFilesize
2KB
MD5dd7a4110e2dc0760efdd47ee918c0deb
SHA15ed5efe128e521023e0caf4fff9af747522c8166
SHA256550ad8794d9ec26bc7e09225cb1cbe648ee7c1c2349aabec8172f08bdec26084
SHA512c928725e5f010d371727aadcc057da91378a0b24c66b2848217e9186dd319b6bf09c0859d7bf523ff1736fc41591eb25662a900fbe3977b63132a0c40dcd35dc
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\nJObCsNVlgTeMaPEZQleQYhYzRyWJjPjFilesize
71KB
MD5dc2b0f48d8f547d5ff7d67b371d850f0
SHA184d02ddbf478bf7cfe9ccb466362860ee18b3839
SHA2560434c46910f48821a0a442b510260a3faea9404d7e6a8edd2cf44cc7dfea3890
SHA5123470ae3db7053a7e606a221f97f8cadf58500a746daaa4c763d714fe99df026d1c7858aaaf6d34ec1bbaa5305f8eead00101b6a7ac6f4d457425d04bcf92e8d7
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
memory/552-167-0x0000000000820000-0x000000000084D000-memory.dmpFilesize
180KB
-
memory/552-184-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-199-0x0000000004E50000-0x0000000004E60000-memory.dmpFilesize
64KB
-
memory/552-200-0x0000000000400000-0x0000000000726000-memory.dmpFilesize
3.1MB
-
memory/552-202-0x0000000000400000-0x0000000000726000-memory.dmpFilesize
3.1MB
-
memory/552-168-0x0000000004E60000-0x0000000005404000-memory.dmpFilesize
5.6MB
-
memory/552-197-0x0000000004E50000-0x0000000004E60000-memory.dmpFilesize
64KB
-
memory/552-196-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-194-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-192-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-190-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-188-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-186-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-198-0x0000000004E50000-0x0000000004E60000-memory.dmpFilesize
64KB
-
memory/552-182-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-180-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-178-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-176-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-174-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-172-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-170-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/552-169-0x00000000026F0000-0x0000000002702000-memory.dmpFilesize
72KB
-
memory/952-161-0x0000000000B00000-0x0000000000B0A000-memory.dmpFilesize
40KB
-
memory/2012-1139-0x0000000005570000-0x0000000005580000-memory.dmpFilesize
64KB
-
memory/2012-1138-0x00000000009A0000-0x00000000009D2000-memory.dmpFilesize
200KB
-
memory/4800-226-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-551-0x0000000000B10000-0x0000000000B20000-memory.dmpFilesize
64KB
-
memory/4800-554-0x0000000000B10000-0x0000000000B20000-memory.dmpFilesize
64KB
-
memory/4800-1117-0x0000000005480000-0x0000000005A98000-memory.dmpFilesize
6.1MB
-
memory/4800-1118-0x0000000005B20000-0x0000000005C2A000-memory.dmpFilesize
1.0MB
-
memory/4800-1119-0x0000000005C60000-0x0000000005C72000-memory.dmpFilesize
72KB
-
memory/4800-1120-0x0000000005C80000-0x0000000005CBC000-memory.dmpFilesize
240KB
-
memory/4800-1121-0x0000000000B10000-0x0000000000B20000-memory.dmpFilesize
64KB
-
memory/4800-1122-0x0000000005F70000-0x0000000005FD6000-memory.dmpFilesize
408KB
-
memory/4800-1123-0x0000000006630000-0x00000000066C2000-memory.dmpFilesize
584KB
-
memory/4800-1125-0x0000000000B10000-0x0000000000B20000-memory.dmpFilesize
64KB
-
memory/4800-1126-0x0000000000B10000-0x0000000000B20000-memory.dmpFilesize
64KB
-
memory/4800-1127-0x0000000000B10000-0x0000000000B20000-memory.dmpFilesize
64KB
-
memory/4800-1128-0x0000000006830000-0x00000000068A6000-memory.dmpFilesize
472KB
-
memory/4800-1129-0x00000000068D0000-0x0000000006920000-memory.dmpFilesize
320KB
-
memory/4800-1130-0x0000000006950000-0x0000000006B12000-memory.dmpFilesize
1.8MB
-
memory/4800-1131-0x0000000000B10000-0x0000000000B20000-memory.dmpFilesize
64KB
-
memory/4800-553-0x0000000000B10000-0x0000000000B20000-memory.dmpFilesize
64KB
-
memory/4800-549-0x0000000000740000-0x000000000078B000-memory.dmpFilesize
300KB
-
memory/4800-240-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-238-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-236-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-234-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-232-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-230-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-228-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-224-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-222-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-220-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-218-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-216-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-214-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-212-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-210-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-208-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-207-0x00000000028A0000-0x00000000028DE000-memory.dmpFilesize
248KB
-
memory/4800-1132-0x0000000006B20000-0x000000000704C000-memory.dmpFilesize
5.2MB