Analysis
-
max time kernel
151s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 22:52
Static task
static1
Behavioral task
behavioral1
Sample
a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exe
Resource
win10v2004-20230220-en
General
-
Target
a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exe
-
Size
1020KB
-
MD5
ce94654dc092706a2ddb8150f606bf56
-
SHA1
1e461d751a32a6be933e93e7a5479fec8d655a04
-
SHA256
a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f
-
SHA512
838cdbf294630d320ad68bc23aed5bad24c8034b2c1dba65b2ebbe40442183459a2398e23112526cc7bcc4d2a69acb9c9af4e9f696c783bfb04f6724bbed009a
-
SSDEEP
24576:6yGjyafDPUlr5xbmAv4sICAHV2R07Mt9ExuTuuJ:BGjyezuXmG+CQ2G7xETuu
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
lown
193.233.20.31:4125
-
auth_value
4cf836e062bcdc2a4fdbf410f5747ec7
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Signatures
-
Processes:
tz1386.exev7990el.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz1386.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz1386.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v7990el.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v7990el.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v7990el.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v7990el.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v7990el.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz1386.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz1386.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz1386.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz1386.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v7990el.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/1872-210-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-211-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-213-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-215-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-217-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-219-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-221-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-223-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-225-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-227-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-229-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-231-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-233-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-235-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-237-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-239-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-241-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-243-0x0000000004D20000-0x0000000004D5E000-memory.dmp family_redline behavioral1/memory/1872-1125-0x0000000004E50000-0x0000000004E60000-memory.dmp family_redline -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
y30Sm41.exelegenda.exerc.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation y30Sm41.exe Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation legenda.exe Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation rc.exe -
Executes dropped EXE 13 IoCs
Processes:
zap8879.exezap8688.exezap6950.exetz1386.exev7990el.exew57kA34.exexObsY35.exey30Sm41.exelegenda.exerc.exendt5tk.exelegenda.exelegenda.exepid process 3956 zap8879.exe 2372 zap8688.exe 1620 zap6950.exe 4268 tz1386.exe 656 v7990el.exe 1872 w57kA34.exe 208 xObsY35.exe 4408 y30Sm41.exe 1632 legenda.exe 4188 rc.exe 4668 ndt5tk.exe 1560 legenda.exe 4988 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 1932 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
v7990el.exetz1386.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v7990el.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz1386.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v7990el.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 10 IoCs
Processes:
chrome.exea81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exezap6950.exezap8688.exezap8879.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleChromeAutoLaunch_A5B343D047FD8BD2F268B0EA0F8DBD7C = "\"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe\" --no-startup-window /prefetch:5" chrome.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap6950.exe Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap8688.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap8688.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap6950.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap8879.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap8879.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 39 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ndt5tk.exedescription pid process target process PID 4668 set thread context of 2684 4668 ndt5tk.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 560 656 WerFault.exe v7990el.exe 548 1872 WerFault.exe w57kA34.exe 1248 4668 WerFault.exe ndt5tk.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 RegSvcs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier RegSvcs.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4636 taskkill.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133240892506344262" chrome.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
tz1386.exev7990el.exew57kA34.exexObsY35.exeRegSvcs.exechrome.exepid process 4268 tz1386.exe 4268 tz1386.exe 656 v7990el.exe 656 v7990el.exe 1872 w57kA34.exe 1872 w57kA34.exe 208 xObsY35.exe 208 xObsY35.exe 2684 RegSvcs.exe 2492 chrome.exe 2492 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
Processes:
chrome.exepid process 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tz1386.exev7990el.exew57kA34.exexObsY35.exeRegSvcs.exetaskkill.exechrome.exedescription pid process Token: SeDebugPrivilege 4268 tz1386.exe Token: SeDebugPrivilege 656 v7990el.exe Token: SeDebugPrivilege 1872 w57kA34.exe Token: SeDebugPrivilege 208 xObsY35.exe Token: SeDebugPrivilege 2684 RegSvcs.exe Token: SeDebugPrivilege 4636 taskkill.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
Processes:
chrome.exepid process 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe -
Suspicious use of SendNotifyMessage 27 IoCs
Processes:
chrome.exepid process 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exezap8879.exezap8688.exezap6950.exey30Sm41.exelegenda.execmd.exerc.exendt5tk.exedescription pid process target process PID 2256 wrote to memory of 3956 2256 a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exe zap8879.exe PID 2256 wrote to memory of 3956 2256 a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exe zap8879.exe PID 2256 wrote to memory of 3956 2256 a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exe zap8879.exe PID 3956 wrote to memory of 2372 3956 zap8879.exe zap8688.exe PID 3956 wrote to memory of 2372 3956 zap8879.exe zap8688.exe PID 3956 wrote to memory of 2372 3956 zap8879.exe zap8688.exe PID 2372 wrote to memory of 1620 2372 zap8688.exe zap6950.exe PID 2372 wrote to memory of 1620 2372 zap8688.exe zap6950.exe PID 2372 wrote to memory of 1620 2372 zap8688.exe zap6950.exe PID 1620 wrote to memory of 4268 1620 zap6950.exe tz1386.exe PID 1620 wrote to memory of 4268 1620 zap6950.exe tz1386.exe PID 1620 wrote to memory of 656 1620 zap6950.exe v7990el.exe PID 1620 wrote to memory of 656 1620 zap6950.exe v7990el.exe PID 1620 wrote to memory of 656 1620 zap6950.exe v7990el.exe PID 2372 wrote to memory of 1872 2372 zap8688.exe w57kA34.exe PID 2372 wrote to memory of 1872 2372 zap8688.exe w57kA34.exe PID 2372 wrote to memory of 1872 2372 zap8688.exe w57kA34.exe PID 3956 wrote to memory of 208 3956 zap8879.exe xObsY35.exe PID 3956 wrote to memory of 208 3956 zap8879.exe xObsY35.exe PID 3956 wrote to memory of 208 3956 zap8879.exe xObsY35.exe PID 2256 wrote to memory of 4408 2256 a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exe y30Sm41.exe PID 2256 wrote to memory of 4408 2256 a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exe y30Sm41.exe PID 2256 wrote to memory of 4408 2256 a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exe y30Sm41.exe PID 4408 wrote to memory of 1632 4408 y30Sm41.exe legenda.exe PID 4408 wrote to memory of 1632 4408 y30Sm41.exe legenda.exe PID 4408 wrote to memory of 1632 4408 y30Sm41.exe legenda.exe PID 1632 wrote to memory of 3332 1632 legenda.exe schtasks.exe PID 1632 wrote to memory of 3332 1632 legenda.exe schtasks.exe PID 1632 wrote to memory of 3332 1632 legenda.exe schtasks.exe PID 1632 wrote to memory of 3296 1632 legenda.exe cmd.exe PID 1632 wrote to memory of 3296 1632 legenda.exe cmd.exe PID 1632 wrote to memory of 3296 1632 legenda.exe cmd.exe PID 3296 wrote to memory of 572 3296 cmd.exe cmd.exe PID 3296 wrote to memory of 572 3296 cmd.exe cmd.exe PID 3296 wrote to memory of 572 3296 cmd.exe cmd.exe PID 3296 wrote to memory of 4796 3296 cmd.exe cacls.exe PID 3296 wrote to memory of 4796 3296 cmd.exe cacls.exe PID 3296 wrote to memory of 4796 3296 cmd.exe cacls.exe PID 3296 wrote to memory of 3240 3296 cmd.exe cacls.exe PID 3296 wrote to memory of 3240 3296 cmd.exe cacls.exe PID 3296 wrote to memory of 3240 3296 cmd.exe cacls.exe PID 3296 wrote to memory of 3224 3296 cmd.exe cmd.exe PID 3296 wrote to memory of 3224 3296 cmd.exe cmd.exe PID 3296 wrote to memory of 3224 3296 cmd.exe cmd.exe PID 3296 wrote to memory of 4788 3296 cmd.exe cacls.exe PID 3296 wrote to memory of 4788 3296 cmd.exe cacls.exe PID 3296 wrote to memory of 4788 3296 cmd.exe cacls.exe PID 3296 wrote to memory of 5016 3296 cmd.exe cacls.exe PID 3296 wrote to memory of 5016 3296 cmd.exe cacls.exe PID 3296 wrote to memory of 5016 3296 cmd.exe cacls.exe PID 1632 wrote to memory of 4188 1632 legenda.exe rc.exe PID 1632 wrote to memory of 4188 1632 legenda.exe rc.exe PID 1632 wrote to memory of 4188 1632 legenda.exe rc.exe PID 1632 wrote to memory of 4668 1632 legenda.exe ndt5tk.exe PID 1632 wrote to memory of 4668 1632 legenda.exe ndt5tk.exe PID 1632 wrote to memory of 4668 1632 legenda.exe ndt5tk.exe PID 4188 wrote to memory of 1392 4188 rc.exe cmd.exe PID 4188 wrote to memory of 1392 4188 rc.exe cmd.exe PID 4188 wrote to memory of 1392 4188 rc.exe cmd.exe PID 4668 wrote to memory of 2684 4668 ndt5tk.exe RegSvcs.exe PID 4668 wrote to memory of 2684 4668 ndt5tk.exe RegSvcs.exe PID 4668 wrote to memory of 2684 4668 ndt5tk.exe RegSvcs.exe PID 4668 wrote to memory of 2684 4668 ndt5tk.exe RegSvcs.exe PID 4668 wrote to memory of 2684 4668 ndt5tk.exe RegSvcs.exe -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exe"C:\Users\Admin\AppData\Local\Temp\a81378091b48579833fb99554f8fdb086ad799c20670f46cf4c8e1aedef6251f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8879.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8879.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8688.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8688.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6950.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6950.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1386.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1386.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7990el.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7990el.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 656 -s 10886⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w57kA34.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w57kA34.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 13365⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xObsY35.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xObsY35.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y30Sm41.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y30Sm41.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000142001\rc.exe"C:\Users\Admin\AppData\Local\Temp\1000142001\rc.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c TASKKILL /IM chrome.exe /F5⤵
-
C:\Windows\SysWOW64\taskkill.exeTASKKILL /IM chrome.exe /F6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --load-extension="C:\Users\Admin\AppData\Roaming\extension_chrome"5⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x164,0x168,0x16c,0x140,0x170,0x7ffa5f9f9758,0x7ffa5f9f9768,0x7ffa5f9f97786⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 --field-trial-handle=1848,i,9523612368400156524,16675567871013673831,131072 /prefetch:26⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 --field-trial-handle=1848,i,9523612368400156524,16675567871013673831,131072 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2300 --field-trial-handle=1848,i,9523612368400156524,16675567871013673831,131072 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3256 --field-trial-handle=1848,i,9523612368400156524,16675567871013673831,131072 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3280 --field-trial-handle=1848,i,9523612368400156524,16675567871013673831,131072 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3912 --field-trial-handle=1848,i,9523612368400156524,16675567871013673831,131072 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4852 --field-trial-handle=1848,i,9523612368400156524,16675567871013673831,131072 /prefetch:16⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4972 --field-trial-handle=1848,i,9523612368400156524,16675567871013673831,131072 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5140 --field-trial-handle=1848,i,9523612368400156524,16675567871013673831,131072 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 --field-trial-handle=1848,i,9523612368400156524,16675567871013673831,131072 /prefetch:86⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 --field-trial-handle=1848,i,9523612368400156524,16675567871013673831,131072 /prefetch:86⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\1000142001\rc.exe"5⤵
-
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 30006⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\1000145001\ndt5tk.exe"C:\Users\Admin\AppData\Local\Temp\1000145001\ndt5tk.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile7⤵
-
C:\Windows\SysWOW64\findstr.exefindstr All7⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile name="65001" key=clear7⤵
-
C:\Windows\SysWOW64\findstr.exefindstr Key7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4668 -s 5685⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 656 -ip 6561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1872 -ip 18721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4668 -ip 46681⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnkFilesize
2KB
MD55e123f76bd27997d346e507d1f1439ef
SHA182aaf6e6e2aee323461af8c256d081bd60b10e46
SHA256893d0c2397d90245a335758c10285c5cc8fcdd0f24ad4b701ba917bdfc548cdd
SHA51250d5d24cf909ae9b6feb3cd518e470d3929c3d04fe704a7a6bab71719d18ebcf2ffef66a158b06b704a12856f75536200d55c534bbab8555d576bf34482bea07
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\04c0da0f-ee25-43ff-8963-e043b6fe121c.tmpFilesize
4KB
MD55c08e194e120ab01c8257e24b69a89dd
SHA1995cbb7bc9668bad4e4ca619f8b7bdda1b57d72f
SHA2565f68e9c92bf78335f978bcb58990c85e6b32f614bfe79ecdc831c16f01115593
SHA512d9da26d7ac6f1f29e21ef66941be879147446e7e0fc05e4a27205c371de97b2ed1412f853f2f6f7b39b24d1d6fbc61c57f8274adab06c29893492ce2ce845aeb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
1015B
MD5659b3bb61e7a9e20a560410fc9418922
SHA124dc43915e210516f0263b0dcc4f3b651f555dab
SHA2566f66a73655851fbcf35c916a8101250f635237d1ca34de141393756011c49858
SHA5125932f37583f05ccffae7f437402ff5d03305e38919738755813cf70385d89602d2202f935d277aaa0bd2e0a12e717d1d0ac3eea5f2f1de7743dcefc26f3c1e48
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
371B
MD52c058e25d200f41521a06ccaf0ca4fb2
SHA106e35374b93393f473c3ba80e63fd30638f4420f
SHA256e90425cf9b3ce1f36c6fbc3d741a8423fa301dbe6c2f8d3cf5f0200bf0acf061
SHA5126e562ea6bbdf501780673e3763781d699a978ac2ba81dd8acf8ac8780aa9da8c8befbd9f987ca6537c9fa3ca5f2d9d54ce10cfda8e3a6ec4350263e658657d1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD587861d3e3914e1de1a5589e03f304f7e
SHA15aad9d1697ad6a89737c0d1babfe7eb7a2eefcce
SHA2562990068568d1caa36c91b56242b9d280e3c8c9009ff78b4745f14b76e62dcb38
SHA51247816fadffb9b155ae94fe35d384b8ffeb72b600a1361c49e6a35ef7a3c0b88791f28ee24ab0d5be06266ff1c371248d853723e5101dc283f780ba079f731eba
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
4KB
MD50b601a2d1a8c6664fe9681d1de677100
SHA10f8e39aa4ad4782cdb367187e421c580f1bf5ab0
SHA25685ac6728193c9f9df84d479500b80b37fbb0785fd3ce0c08f10c46c3c2c7f956
SHA512d1a3be62696e4d85891845b6716e5e9b0667dfc750ace4ab4f1a8972615d743c57012e532f4bb2b8d95e1b227fc080e01e17fd93e51ec8e158cc4845a6740568
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
11KB
MD5c32fd7b6d2921f15c7166d0f20ab6390
SHA119498974384af2ae50bc87430d6eb0c80b533cf4
SHA2564c841367887b1b88e6e319544d28db28038a442b05b8246f06753d911ef94a75
SHA51272765a233c01f1eee5d907cfa5fe2ea527f8c90afbf9b9edba15116f657a8d90f99709a5eb6d6e3ed7df51b9ec7212749e05e10fc06c7f11c5e1304b959519b6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
145KB
MD56329a5a30ceaa09a3f19ac7a52968f6d
SHA110598672a26d4a55b753ab81fc4b6a2c74d4d6e3
SHA2565ade80f796070b4f846c50a972f61dfac39325489a90a105d94e2b3c684af252
SHA512f5ef4f55e684e3f31f9bf8e2d25ed2604912dbb5fd4389f148f4ce91a80f5a3da4298116e84510d0f060924e81eadc5f36da5d7f2f2b179727d85604aafd95a0
-
C:\Users\Admin\AppData\Local\Temp\1000142001\rc.exeFilesize
141KB
MD550e9958bb2a5b6ae6ed8da1b1d97a5bb
SHA1afd7485b1313cc54c321cc18c4b1c19e5ae415af
SHA256f24438de391eac0b538c0f2f19697daeace979bf8657a8bcc74db6cb4ecb52c5
SHA51249d079459c3f6f40b62fe60e599f0cc85624a1f9151320811f12bd8bc84378571e23b98144289c6ff61625d939cfec627223b0fa9299159803df486d98feba49
-
C:\Users\Admin\AppData\Local\Temp\1000142001\rc.exeFilesize
141KB
MD550e9958bb2a5b6ae6ed8da1b1d97a5bb
SHA1afd7485b1313cc54c321cc18c4b1c19e5ae415af
SHA256f24438de391eac0b538c0f2f19697daeace979bf8657a8bcc74db6cb4ecb52c5
SHA51249d079459c3f6f40b62fe60e599f0cc85624a1f9151320811f12bd8bc84378571e23b98144289c6ff61625d939cfec627223b0fa9299159803df486d98feba49
-
C:\Users\Admin\AppData\Local\Temp\1000142001\rc.exeFilesize
141KB
MD550e9958bb2a5b6ae6ed8da1b1d97a5bb
SHA1afd7485b1313cc54c321cc18c4b1c19e5ae415af
SHA256f24438de391eac0b538c0f2f19697daeace979bf8657a8bcc74db6cb4ecb52c5
SHA51249d079459c3f6f40b62fe60e599f0cc85624a1f9151320811f12bd8bc84378571e23b98144289c6ff61625d939cfec627223b0fa9299159803df486d98feba49
-
C:\Users\Admin\AppData\Local\Temp\1000145001\ndt5tk.exeFilesize
1.3MB
MD59ce5895cf7087cd578519a76e9eadb7c
SHA143b4d21c0386158c18aa931ce35e99634be7f2e5
SHA256d07f46238c95ae64bb95021846ae77c20bf7c8e4a6e4f02357f6d18382965989
SHA51271c361470f6fc52d3a56085f28e63aa18baaccae3852f17507cd0c03ca1c18bb1d866379dd778469214d262026726d1d4bc8f08088bec1ed61060ebb14d05402
-
C:\Users\Admin\AppData\Local\Temp\1000145001\ndt5tk.exeFilesize
1.3MB
MD59ce5895cf7087cd578519a76e9eadb7c
SHA143b4d21c0386158c18aa931ce35e99634be7f2e5
SHA256d07f46238c95ae64bb95021846ae77c20bf7c8e4a6e4f02357f6d18382965989
SHA51271c361470f6fc52d3a56085f28e63aa18baaccae3852f17507cd0c03ca1c18bb1d866379dd778469214d262026726d1d4bc8f08088bec1ed61060ebb14d05402
-
C:\Users\Admin\AppData\Local\Temp\1000145001\ndt5tk.exeFilesize
1.3MB
MD59ce5895cf7087cd578519a76e9eadb7c
SHA143b4d21c0386158c18aa931ce35e99634be7f2e5
SHA256d07f46238c95ae64bb95021846ae77c20bf7c8e4a6e4f02357f6d18382965989
SHA51271c361470f6fc52d3a56085f28e63aa18baaccae3852f17507cd0c03ca1c18bb1d866379dd778469214d262026726d1d4bc8f08088bec1ed61060ebb14d05402
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y30Sm41.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y30Sm41.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8879.exeFilesize
837KB
MD5529b2c2dd79b5d72dffe5a1aa162b021
SHA149906c7f0e2dc5ce0f2dd300de3aef3103f049c5
SHA2561e1f17b5474f815e211f8c3ce3cee9f14af8ba5cfdee8cee8d84f67ea3768a28
SHA5121367582b2b54a7d21a44d02a0bb8c1f0ab85fd3043b860350e7ae19ebc454a0ed9d7f2e9fd7d438d7e8f208d1a4ba273e28a7bf7d41e988198585974ccd259a5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8879.exeFilesize
837KB
MD5529b2c2dd79b5d72dffe5a1aa162b021
SHA149906c7f0e2dc5ce0f2dd300de3aef3103f049c5
SHA2561e1f17b5474f815e211f8c3ce3cee9f14af8ba5cfdee8cee8d84f67ea3768a28
SHA5121367582b2b54a7d21a44d02a0bb8c1f0ab85fd3043b860350e7ae19ebc454a0ed9d7f2e9fd7d438d7e8f208d1a4ba273e28a7bf7d41e988198585974ccd259a5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xObsY35.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xObsY35.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8688.exeFilesize
695KB
MD5ff2a629e77464f69267e731a96375a01
SHA19dd4c0d06a707257017b29ef8cbc264ea0b7d163
SHA25697e27f4bf420b2ae2ba7d2e9131e8b2ae692ec4a1f9f772e3045a22d4cca8568
SHA5127f6f4b44cc6374e0c2935eab9200accb970e0531db58c85c5def52c8eca4b52b743f32ef7939decd3c910bcf6cd736cba1f02d0ba61f3fff67d30dc3bab542a5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap8688.exeFilesize
695KB
MD5ff2a629e77464f69267e731a96375a01
SHA19dd4c0d06a707257017b29ef8cbc264ea0b7d163
SHA25697e27f4bf420b2ae2ba7d2e9131e8b2ae692ec4a1f9f772e3045a22d4cca8568
SHA5127f6f4b44cc6374e0c2935eab9200accb970e0531db58c85c5def52c8eca4b52b743f32ef7939decd3c910bcf6cd736cba1f02d0ba61f3fff67d30dc3bab542a5
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w57kA34.exeFilesize
349KB
MD5071f1911d2ad66dee447c5c2653cc0e9
SHA14ea173d172e9a40fa5856775c2f8ec04eddaf077
SHA256bdc16794e2ef62f7b942f746646b1587231effe19161d66e3ba75e05ae4092ce
SHA512051f089a1cddc5b621caa132ded6bbfb3e0d1a9e6ace5c76c40df56b8a2f4f4bf5124c32863782caf2f468923bd846450f4c4339d70124bf9cc24d5b0e1830e9
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w57kA34.exeFilesize
349KB
MD5071f1911d2ad66dee447c5c2653cc0e9
SHA14ea173d172e9a40fa5856775c2f8ec04eddaf077
SHA256bdc16794e2ef62f7b942f746646b1587231effe19161d66e3ba75e05ae4092ce
SHA512051f089a1cddc5b621caa132ded6bbfb3e0d1a9e6ace5c76c40df56b8a2f4f4bf5124c32863782caf2f468923bd846450f4c4339d70124bf9cc24d5b0e1830e9
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6950.exeFilesize
344KB
MD5a39ecbb5cce4a8a4ed8730002d96a730
SHA1dfc4d71c998635236d55938ff1cdbc0d5f4268fb
SHA256663b2583fe6a7b32a1d706eaa6dc753e57906f686775966323f179939f70fbc5
SHA512cd232b5739f00c394fb80464b8fbb90f804eb5a293be4ec60cfcd9e50c0bb52a1f2ec5216545dd429fa6ac397f813401b055d7ccfb476ac0a801380701bf2332
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap6950.exeFilesize
344KB
MD5a39ecbb5cce4a8a4ed8730002d96a730
SHA1dfc4d71c998635236d55938ff1cdbc0d5f4268fb
SHA256663b2583fe6a7b32a1d706eaa6dc753e57906f686775966323f179939f70fbc5
SHA512cd232b5739f00c394fb80464b8fbb90f804eb5a293be4ec60cfcd9e50c0bb52a1f2ec5216545dd429fa6ac397f813401b055d7ccfb476ac0a801380701bf2332
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1386.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1386.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7990el.exeFilesize
291KB
MD54e4e05f558b353e60f7df458094a4557
SHA16993cfa9a48a1aa0bc796293cbf5463dd1f011a8
SHA256d29cc015c51634a787a4a1f3957230ab502e82c708a95fbbc0efbb02bcf9070d
SHA512f4fc6f73a5cad7b561128859d144d72ee2446b4b6ae06b456cd44e52532186522db41f2f156c88cbad849f6716283e57fe322868280dc4db8c927c8559aa21eb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7990el.exeFilesize
291KB
MD54e4e05f558b353e60f7df458094a4557
SHA16993cfa9a48a1aa0bc796293cbf5463dd1f011a8
SHA256d29cc015c51634a787a4a1f3957230ab502e82c708a95fbbc0efbb02bcf9070d
SHA512f4fc6f73a5cad7b561128859d144d72ee2446b4b6ae06b456cd44e52532186522db41f2f156c88cbad849f6716283e57fe322868280dc4db8c927c8559aa21eb
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
C:\Users\Admin\AppData\Roaming\extension_chrome\background.jsFilesize
2KB
MD56200ca0889334cfb6aec68e0d16ec1ae
SHA1484b2db1bccfcd5a683faf4d4fe9bc4a26b669fd
SHA256a7929366648541bdbc0770e2e46c396c1febabab88fb6f9399706f7faceef18a
SHA51284f906a51c9c3e04acff4dd8e3a3e54994d435dcc1ea925b61bed6ed6ca82719d070332126ec901d906d475835532a03c2516e5c524940c1144ea2a8fc17a567
-
C:\Users\Admin\AppData\Roaming\extension_chrome\main.jsFilesize
174B
MD5101da414c759e49091ed4c7c393e4b88
SHA1ca66105564379ea52890b55364f61d6d967facce
SHA256a36f1ac32942455f7f16f3ac4ce90b91c504a82c22f9d529e0ba7bf64a24b757
SHA512504b7b35a83b135aec79322cf9e8b296f42552040ec6d630e008fff395e5120af88e8b2118641b58fb3de7d6ac7466f621f604d2824c2d688a4aefb444ce7f44
-
C:\Users\Admin\AppData\Roaming\extension_chrome\manifest.jsonFilesize
614B
MD50688a45c7472ba90c4acbd8a4fbc928a
SHA10f6f86ebac77f35cf2b8f3bb2595597bc786de6b
SHA25652e7a136a4f39bb826f30f5c89c6fa28ca9945acefc775068a39d21328e47275
SHA512d8c32b1fe52060ffa020ab640dd78afda51ab1ea86a467ffbc308bf1c540f93485c73a71a1226b48835b2eb9e073d508c93ba94a3d571ba84af5d2a1784b951d
-
\??\pipe\crashpad_2492_VAVFQIWZTECWRKYEMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/208-1141-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/208-1140-0x00000000005C0000-0x00000000005F2000-memory.dmpFilesize
200KB
-
memory/656-193-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-205-0x0000000000400000-0x000000000070C000-memory.dmpFilesize
3.0MB
-
memory/656-167-0x0000000000890000-0x00000000008BD000-memory.dmpFilesize
180KB
-
memory/656-169-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/656-168-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/656-170-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/656-171-0x0000000004CE0000-0x0000000005284000-memory.dmpFilesize
5.6MB
-
memory/656-172-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-177-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-175-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-181-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-179-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-187-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-185-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-191-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-189-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-197-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-199-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-195-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-183-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-173-0x0000000002840000-0x0000000002852000-memory.dmpFilesize
72KB
-
memory/656-200-0x0000000000400000-0x000000000070C000-memory.dmpFilesize
3.0MB
-
memory/656-201-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/656-202-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/656-203-0x00000000027F0000-0x0000000002800000-memory.dmpFilesize
64KB
-
memory/1872-1123-0x0000000004E50000-0x0000000004E60000-memory.dmpFilesize
64KB
-
memory/1872-1126-0x0000000004E50000-0x0000000004E60000-memory.dmpFilesize
64KB
-
memory/1872-1134-0x0000000004E50000-0x0000000004E60000-memory.dmpFilesize
64KB
-
memory/1872-225-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-223-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-221-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-219-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-217-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-215-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-213-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-211-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-210-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-1132-0x0000000007060000-0x00000000070D6000-memory.dmpFilesize
472KB
-
memory/1872-1131-0x00000000069E0000-0x0000000006F0C000-memory.dmpFilesize
5.2MB
-
memory/1872-1130-0x0000000006810000-0x00000000069D2000-memory.dmpFilesize
1.8MB
-
memory/1872-1129-0x0000000005EB0000-0x0000000005F16000-memory.dmpFilesize
408KB
-
memory/1872-1128-0x0000000005E10000-0x0000000005EA2000-memory.dmpFilesize
584KB
-
memory/1872-1127-0x0000000004E50000-0x0000000004E60000-memory.dmpFilesize
64KB
-
memory/1872-229-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-231-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-233-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-1133-0x00000000070E0000-0x0000000007130000-memory.dmpFilesize
320KB
-
memory/1872-1125-0x0000000004E50000-0x0000000004E60000-memory.dmpFilesize
64KB
-
memory/1872-227-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-1122-0x0000000005B40000-0x0000000005B7C000-memory.dmpFilesize
240KB
-
memory/1872-1121-0x0000000004E10000-0x0000000004E22000-memory.dmpFilesize
72KB
-
memory/1872-1120-0x0000000005A30000-0x0000000005B3A000-memory.dmpFilesize
1.0MB
-
memory/1872-235-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-1119-0x0000000005410000-0x0000000005A28000-memory.dmpFilesize
6.1MB
-
memory/1872-412-0x0000000004E50000-0x0000000004E60000-memory.dmpFilesize
64KB
-
memory/1872-410-0x0000000004E50000-0x0000000004E60000-memory.dmpFilesize
64KB
-
memory/1872-409-0x0000000000CA0000-0x0000000000CEB000-memory.dmpFilesize
300KB
-
memory/1872-243-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-241-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-239-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/1872-237-0x0000000004D20000-0x0000000004D5E000-memory.dmpFilesize
248KB
-
memory/2684-1220-0x0000000005440000-0x0000000005450000-memory.dmpFilesize
64KB
-
memory/2684-1201-0x0000000006200000-0x000000000629C000-memory.dmpFilesize
624KB
-
memory/2684-1196-0x0000000005440000-0x0000000005450000-memory.dmpFilesize
64KB
-
memory/2684-1195-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4268-161-0x00000000000B0000-0x00000000000BA000-memory.dmpFilesize
40KB