Analysis
-
max time kernel
126s -
max time network
119s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
23-03-2023 22:56
Static task
static1
Behavioral task
behavioral1
Sample
8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exe
Resource
win10-20230220-en
General
-
Target
8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exe
-
Size
1021KB
-
MD5
55395f8faa218c6ad356ad58ae90a037
-
SHA1
08997dd1bdaa5b5759e6df343e831c43d1f8ccba
-
SHA256
8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84
-
SHA512
80b64df375f3f8488a5b35155fa0eaedbcc9044bf0e6d1cca51f640e6c28852b8ace5c29ebf202c5cc6f8bf43ebc5c4b1242c76689aae5940f82c2f334e087d0
-
SSDEEP
24576:7yWAybo0UzGOvtres3IuVacHMUjuiM6aGc2KckZn7o:uRyboBDN/bH8iMHz1Z
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
lown
193.233.20.31:4125
-
auth_value
4cf836e062bcdc2a4fdbf410f5747ec7
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Signatures
-
Processes:
tz1026.exev3051fw.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz1026.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v3051fw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v3051fw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v3051fw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz1026.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz1026.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz1026.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v3051fw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v3051fw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz1026.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 21 IoCs
Processes:
resource yara_rule behavioral1/memory/4624-196-0x00000000023A0000-0x00000000023E6000-memory.dmp family_redline behavioral1/memory/4624-197-0x0000000002830000-0x0000000002874000-memory.dmp family_redline behavioral1/memory/4624-199-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-198-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-201-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-203-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-207-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-209-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-205-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-211-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-213-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-215-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-217-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-219-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-221-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-223-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-225-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-227-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-229-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-231-0x0000000002830000-0x000000000286E000-memory.dmp family_redline behavioral1/memory/4624-461-0x0000000004E30000-0x0000000004E40000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 12 IoCs
Processes:
zap0676.exezap6908.exezap7332.exetz1026.exev3051fw.exew88NM01.exexJfBI38.exey60Mt80.exelegenda.exendt5tk.exelegenda.exelegenda.exepid process 364 zap0676.exe 3504 zap6908.exe 4036 zap7332.exe 2536 tz1026.exe 2572 v3051fw.exe 4624 w88NM01.exe 4344 xJfBI38.exe 4312 y60Mt80.exe 3768 legenda.exe 4996 ndt5tk.exe 2180 legenda.exe 64 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 980 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz1026.exev3051fw.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz1026.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v3051fw.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v3051fw.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
zap7332.exe8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exezap0676.exezap6908.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap7332.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap7332.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap0676.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap0676.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap6908.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap6908.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 13 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ndt5tk.exedescription pid process target process PID 4996 set thread context of 4160 4996 ndt5tk.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3964 4996 WerFault.exe ndt5tk.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0 RegSvcs.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier RegSvcs.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
tz1026.exev3051fw.exew88NM01.exexJfBI38.exeRegSvcs.exepid process 2536 tz1026.exe 2536 tz1026.exe 2572 v3051fw.exe 2572 v3051fw.exe 4624 w88NM01.exe 4624 w88NM01.exe 4344 xJfBI38.exe 4344 xJfBI38.exe 4160 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
tz1026.exev3051fw.exew88NM01.exexJfBI38.exeRegSvcs.exedescription pid process Token: SeDebugPrivilege 2536 tz1026.exe Token: SeDebugPrivilege 2572 v3051fw.exe Token: SeDebugPrivilege 4624 w88NM01.exe Token: SeDebugPrivilege 4344 xJfBI38.exe Token: SeDebugPrivilege 4160 RegSvcs.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exezap0676.exezap6908.exezap7332.exey60Mt80.exelegenda.execmd.exendt5tk.exeRegSvcs.execmd.exedescription pid process target process PID 1596 wrote to memory of 364 1596 8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exe zap0676.exe PID 1596 wrote to memory of 364 1596 8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exe zap0676.exe PID 1596 wrote to memory of 364 1596 8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exe zap0676.exe PID 364 wrote to memory of 3504 364 zap0676.exe zap6908.exe PID 364 wrote to memory of 3504 364 zap0676.exe zap6908.exe PID 364 wrote to memory of 3504 364 zap0676.exe zap6908.exe PID 3504 wrote to memory of 4036 3504 zap6908.exe zap7332.exe PID 3504 wrote to memory of 4036 3504 zap6908.exe zap7332.exe PID 3504 wrote to memory of 4036 3504 zap6908.exe zap7332.exe PID 4036 wrote to memory of 2536 4036 zap7332.exe tz1026.exe PID 4036 wrote to memory of 2536 4036 zap7332.exe tz1026.exe PID 4036 wrote to memory of 2572 4036 zap7332.exe v3051fw.exe PID 4036 wrote to memory of 2572 4036 zap7332.exe v3051fw.exe PID 4036 wrote to memory of 2572 4036 zap7332.exe v3051fw.exe PID 3504 wrote to memory of 4624 3504 zap6908.exe w88NM01.exe PID 3504 wrote to memory of 4624 3504 zap6908.exe w88NM01.exe PID 3504 wrote to memory of 4624 3504 zap6908.exe w88NM01.exe PID 364 wrote to memory of 4344 364 zap0676.exe xJfBI38.exe PID 364 wrote to memory of 4344 364 zap0676.exe xJfBI38.exe PID 364 wrote to memory of 4344 364 zap0676.exe xJfBI38.exe PID 1596 wrote to memory of 4312 1596 8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exe y60Mt80.exe PID 1596 wrote to memory of 4312 1596 8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exe y60Mt80.exe PID 1596 wrote to memory of 4312 1596 8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exe y60Mt80.exe PID 4312 wrote to memory of 3768 4312 y60Mt80.exe legenda.exe PID 4312 wrote to memory of 3768 4312 y60Mt80.exe legenda.exe PID 4312 wrote to memory of 3768 4312 y60Mt80.exe legenda.exe PID 3768 wrote to memory of 5028 3768 legenda.exe schtasks.exe PID 3768 wrote to memory of 5028 3768 legenda.exe schtasks.exe PID 3768 wrote to memory of 5028 3768 legenda.exe schtasks.exe PID 3768 wrote to memory of 4664 3768 legenda.exe cmd.exe PID 3768 wrote to memory of 4664 3768 legenda.exe cmd.exe PID 3768 wrote to memory of 4664 3768 legenda.exe cmd.exe PID 4664 wrote to memory of 3320 4664 cmd.exe cmd.exe PID 4664 wrote to memory of 3320 4664 cmd.exe cmd.exe PID 4664 wrote to memory of 3320 4664 cmd.exe cmd.exe PID 4664 wrote to memory of 4992 4664 cmd.exe cacls.exe PID 4664 wrote to memory of 4992 4664 cmd.exe cacls.exe PID 4664 wrote to memory of 4992 4664 cmd.exe cacls.exe PID 4664 wrote to memory of 3472 4664 cmd.exe cacls.exe PID 4664 wrote to memory of 3472 4664 cmd.exe cacls.exe PID 4664 wrote to memory of 3472 4664 cmd.exe cacls.exe PID 4664 wrote to memory of 4968 4664 cmd.exe cmd.exe PID 4664 wrote to memory of 4968 4664 cmd.exe cmd.exe PID 4664 wrote to memory of 4968 4664 cmd.exe cmd.exe PID 4664 wrote to memory of 4976 4664 cmd.exe cacls.exe PID 4664 wrote to memory of 4976 4664 cmd.exe cacls.exe PID 4664 wrote to memory of 4976 4664 cmd.exe cacls.exe PID 4664 wrote to memory of 4884 4664 cmd.exe cacls.exe PID 4664 wrote to memory of 4884 4664 cmd.exe cacls.exe PID 4664 wrote to memory of 4884 4664 cmd.exe cacls.exe PID 3768 wrote to memory of 4996 3768 legenda.exe ndt5tk.exe PID 3768 wrote to memory of 4996 3768 legenda.exe ndt5tk.exe PID 3768 wrote to memory of 4996 3768 legenda.exe ndt5tk.exe PID 4996 wrote to memory of 4160 4996 ndt5tk.exe RegSvcs.exe PID 4996 wrote to memory of 4160 4996 ndt5tk.exe RegSvcs.exe PID 4996 wrote to memory of 4160 4996 ndt5tk.exe RegSvcs.exe PID 4996 wrote to memory of 4160 4996 ndt5tk.exe RegSvcs.exe PID 4996 wrote to memory of 4160 4996 ndt5tk.exe RegSvcs.exe PID 4160 wrote to memory of 772 4160 RegSvcs.exe cmd.exe PID 4160 wrote to memory of 772 4160 RegSvcs.exe cmd.exe PID 4160 wrote to memory of 772 4160 RegSvcs.exe cmd.exe PID 772 wrote to memory of 1368 772 cmd.exe chcp.com PID 772 wrote to memory of 1368 772 cmd.exe chcp.com PID 772 wrote to memory of 1368 772 cmd.exe chcp.com -
outlook_office_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
Processes:
RegSvcs.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3853465373-1718857667-1861325682-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exe"C:\Users\Admin\AppData\Local\Temp\8078c3eb8f965b9af5d6c0a9478b9b15c0791d7ac2f8d73fd9c0082954975c84.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0676.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0676.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6908.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6908.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7332.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7332.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1026.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1026.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3051fw.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3051fw.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w88NM01.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w88NM01.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xJfBI38.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xJfBI38.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y60Mt80.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y60Mt80.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000145001\ndt5tk.exe"C:\Users\Admin\AppData\Local\Temp\1000145001\ndt5tk.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"5⤵
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile7⤵
-
C:\Windows\SysWOW64\findstr.exefindstr All7⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C chcp 65001 && netsh wlan show profile name="65001" key=clear | findstr Key6⤵
-
C:\Windows\SysWOW64\chcp.comchcp 650017⤵
-
C:\Windows\SysWOW64\netsh.exenetsh wlan show profile name="65001" key=clear7⤵
-
C:\Windows\SysWOW64\findstr.exefindstr Key7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 5805⤵
- Program crash
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000145001\ndt5tk.exeFilesize
1.3MB
MD59ce5895cf7087cd578519a76e9eadb7c
SHA143b4d21c0386158c18aa931ce35e99634be7f2e5
SHA256d07f46238c95ae64bb95021846ae77c20bf7c8e4a6e4f02357f6d18382965989
SHA51271c361470f6fc52d3a56085f28e63aa18baaccae3852f17507cd0c03ca1c18bb1d866379dd778469214d262026726d1d4bc8f08088bec1ed61060ebb14d05402
-
C:\Users\Admin\AppData\Local\Temp\1000145001\ndt5tk.exeFilesize
1.3MB
MD59ce5895cf7087cd578519a76e9eadb7c
SHA143b4d21c0386158c18aa931ce35e99634be7f2e5
SHA256d07f46238c95ae64bb95021846ae77c20bf7c8e4a6e4f02357f6d18382965989
SHA51271c361470f6fc52d3a56085f28e63aa18baaccae3852f17507cd0c03ca1c18bb1d866379dd778469214d262026726d1d4bc8f08088bec1ed61060ebb14d05402
-
C:\Users\Admin\AppData\Local\Temp\1000145001\ndt5tk.exeFilesize
1.3MB
MD59ce5895cf7087cd578519a76e9eadb7c
SHA143b4d21c0386158c18aa931ce35e99634be7f2e5
SHA256d07f46238c95ae64bb95021846ae77c20bf7c8e4a6e4f02357f6d18382965989
SHA51271c361470f6fc52d3a56085f28e63aa18baaccae3852f17507cd0c03ca1c18bb1d866379dd778469214d262026726d1d4bc8f08088bec1ed61060ebb14d05402
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y60Mt80.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y60Mt80.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0676.exeFilesize
836KB
MD5f83cd16cf5f890ba4c772ef624547496
SHA1af2d9412fe32698204ed3b87a15240e03ccbda54
SHA2564c98804cca642267038eadbb6e30a77a6e745dd657460ca787f6a4accb860090
SHA512c2185694354f187356e4a76761ffbcfb9338befc60dce56814bbb1ffd69edf7e0636669683b7cf81cd3ac8545095171ddac81206ae8b78d93ac43ac7bcbc1b1c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0676.exeFilesize
836KB
MD5f83cd16cf5f890ba4c772ef624547496
SHA1af2d9412fe32698204ed3b87a15240e03ccbda54
SHA2564c98804cca642267038eadbb6e30a77a6e745dd657460ca787f6a4accb860090
SHA512c2185694354f187356e4a76761ffbcfb9338befc60dce56814bbb1ffd69edf7e0636669683b7cf81cd3ac8545095171ddac81206ae8b78d93ac43ac7bcbc1b1c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xJfBI38.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xJfBI38.exeFilesize
175KB
MD550809fe16d7c482c1f4a2ea19fdcbc0a
SHA111b6f69c06a724da15183b16039c5cbc86016158
SHA25609917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1
SHA512c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6908.exeFilesize
694KB
MD52d7ea16d9950df7d5fb30b7522dc47ca
SHA1ca10ac9830def3f553e44ea415f099fb0f5749ea
SHA256587e4370e19919fb1ae2b9411f605a4b09ae70805598f2f98ae96d99a96a79f8
SHA5128842555d678f7ec32c85c0e4c9128770251aa6d33794d88c7af5d62ac4cefe1e751cb85e3488b339af69ca807fd1763e4d65a3c55a1ffb6f35dbd43e6be99456
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap6908.exeFilesize
694KB
MD52d7ea16d9950df7d5fb30b7522dc47ca
SHA1ca10ac9830def3f553e44ea415f099fb0f5749ea
SHA256587e4370e19919fb1ae2b9411f605a4b09ae70805598f2f98ae96d99a96a79f8
SHA5128842555d678f7ec32c85c0e4c9128770251aa6d33794d88c7af5d62ac4cefe1e751cb85e3488b339af69ca807fd1763e4d65a3c55a1ffb6f35dbd43e6be99456
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w88NM01.exeFilesize
349KB
MD560889158930eb557e0ba95c51d5b3268
SHA192a9e77e1128e62c38015191dde779ca8e9d1cb1
SHA2560815fcabec7a4e85e981be95d4c4d0221383ce3e52b88642f30fe7d7bcdc7575
SHA5125c9b19bf8b660a4e2e02a61c83094c4e5d58c6ba3eabcfaa27f9deb3ea5e8e5ebb869d3f7da05b31b2f605d8c0d9cc45cba2f627189bcbbd39f2742507cf7024
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w88NM01.exeFilesize
349KB
MD560889158930eb557e0ba95c51d5b3268
SHA192a9e77e1128e62c38015191dde779ca8e9d1cb1
SHA2560815fcabec7a4e85e981be95d4c4d0221383ce3e52b88642f30fe7d7bcdc7575
SHA5125c9b19bf8b660a4e2e02a61c83094c4e5d58c6ba3eabcfaa27f9deb3ea5e8e5ebb869d3f7da05b31b2f605d8c0d9cc45cba2f627189bcbbd39f2742507cf7024
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7332.exeFilesize
344KB
MD5c8a6ee4e49ad6817b53e6785d5fc5e71
SHA117a7dd4589822141b2103dc90437eb2a53ef51ee
SHA256c4209793b2621281b5d2f65664252317cfbb40c2ba373866ca17310f41cf24b0
SHA5123407c9674cbb9ea576638804c9a3e5e685c027c456e8860d3680bfb58c7c62c72409c6e696b30e16d18e8561e4cd949dd98c2c9293f851e7638de804d2a5e44e
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap7332.exeFilesize
344KB
MD5c8a6ee4e49ad6817b53e6785d5fc5e71
SHA117a7dd4589822141b2103dc90437eb2a53ef51ee
SHA256c4209793b2621281b5d2f65664252317cfbb40c2ba373866ca17310f41cf24b0
SHA5123407c9674cbb9ea576638804c9a3e5e685c027c456e8860d3680bfb58c7c62c72409c6e696b30e16d18e8561e4cd949dd98c2c9293f851e7638de804d2a5e44e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1026.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz1026.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3051fw.exeFilesize
291KB
MD51d348377852ee9368b8f964c00be078a
SHA1500c98e0bb6a84bace4066045a3ac7d6988d953c
SHA256e2c39bf1119121b4bb794f04dad7b815450a82f9afb07040e367c260e3210133
SHA512d75b6a3ccc9019f6999f8e33ec410e3e6cf5cd9f91feb9f3b633d3ac811a61cd7951fa05d6a110dd513bde1f2430ab3aeac33671c9a4bacf624ad2b71fefc20b
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3051fw.exeFilesize
291KB
MD51d348377852ee9368b8f964c00be078a
SHA1500c98e0bb6a84bace4066045a3ac7d6988d953c
SHA256e2c39bf1119121b4bb794f04dad7b815450a82f9afb07040e367c260e3210133
SHA512d75b6a3ccc9019f6999f8e33ec410e3e6cf5cd9f91feb9f3b633d3ac811a61cd7951fa05d6a110dd513bde1f2430ab3aeac33671c9a4bacf624ad2b71fefc20b
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
memory/2536-147-0x00000000006C0000-0x00000000006CA000-memory.dmpFilesize
40KB
-
memory/2572-154-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/2572-167-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-179-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-181-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-183-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-185-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-186-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/2572-187-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/2572-188-0x0000000000400000-0x000000000070C000-memory.dmpFilesize
3.0MB
-
memory/2572-189-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/2572-191-0x0000000000400000-0x000000000070C000-memory.dmpFilesize
3.0MB
-
memory/2572-175-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-173-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-171-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-169-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-177-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-165-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-153-0x00000000024A0000-0x00000000024BA000-memory.dmpFilesize
104KB
-
memory/2572-155-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/2572-156-0x0000000004CE0000-0x00000000051DE000-memory.dmpFilesize
5.0MB
-
memory/2572-163-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-161-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-159-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-158-0x0000000002730000-0x0000000002742000-memory.dmpFilesize
72KB
-
memory/2572-157-0x0000000002730000-0x0000000002748000-memory.dmpFilesize
96KB
-
memory/4160-1161-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/4160-1162-0x00000000063B0000-0x000000000644C000-memory.dmpFilesize
624KB
-
memory/4160-1163-0x0000000002B50000-0x0000000002B60000-memory.dmpFilesize
64KB
-
memory/4344-1130-0x0000000000870000-0x00000000008A2000-memory.dmpFilesize
200KB
-
memory/4344-1132-0x00000000052B0000-0x00000000052FB000-memory.dmpFilesize
300KB
-
memory/4344-1131-0x0000000005460000-0x0000000005470000-memory.dmpFilesize
64KB
-
memory/4624-213-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-461-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/4624-465-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/4624-463-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/4624-1108-0x0000000005340000-0x0000000005946000-memory.dmpFilesize
6.0MB
-
memory/4624-1109-0x0000000005950000-0x0000000005A5A000-memory.dmpFilesize
1.0MB
-
memory/4624-1110-0x0000000004DD0000-0x0000000004DE2000-memory.dmpFilesize
72KB
-
memory/4624-1111-0x0000000004DF0000-0x0000000004E2E000-memory.dmpFilesize
248KB
-
memory/4624-1112-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/4624-1113-0x0000000005B70000-0x0000000005BBB000-memory.dmpFilesize
300KB
-
memory/4624-1114-0x0000000005D00000-0x0000000005D92000-memory.dmpFilesize
584KB
-
memory/4624-1115-0x0000000005DA0000-0x0000000005E06000-memory.dmpFilesize
408KB
-
memory/4624-1116-0x0000000006480000-0x00000000064F6000-memory.dmpFilesize
472KB
-
memory/4624-1117-0x0000000006510000-0x0000000006560000-memory.dmpFilesize
320KB
-
memory/4624-1119-0x0000000006590000-0x0000000006752000-memory.dmpFilesize
1.8MB
-
memory/4624-1120-0x0000000006760000-0x0000000006C8C000-memory.dmpFilesize
5.2MB
-
memory/4624-1121-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/4624-1122-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/4624-459-0x0000000000720000-0x000000000076B000-memory.dmpFilesize
300KB
-
memory/4624-231-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-229-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-227-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-225-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-223-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-221-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-219-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-217-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-215-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-211-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-205-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-209-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-207-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-203-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-201-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-198-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-199-0x0000000002830000-0x000000000286E000-memory.dmpFilesize
248KB
-
memory/4624-197-0x0000000002830000-0x0000000002874000-memory.dmpFilesize
272KB
-
memory/4624-196-0x00000000023A0000-0x00000000023E6000-memory.dmpFilesize
280KB
-
memory/4624-1123-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB
-
memory/4624-1124-0x0000000004E30000-0x0000000004E40000-memory.dmpFilesize
64KB