Analysis
-
max time kernel
136s -
max time network
125s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
24-03-2023 05:16
Static task
static1
General
-
Target
1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exe
-
Size
1.0MB
-
MD5
3dda82e0f25ddea88cbc3d28de334393
-
SHA1
cbfa78673f66c25759a7d767a2e93bc468d4927e
-
SHA256
1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4
-
SHA512
a3883d1a7188307739e2e0227fabf46940f2853e521cc7f1fb64025141de28233296c9cb8c50f1321d18c68f826fb6415923ee925742ad04e902ce7871ea750c
-
SSDEEP
24576:5yCSYJm9TUqjI+XIOe5lkhwaSSV3DmnFfj5DSS7mW:sCJmu+XIOwlSwUVqnFfpd
Malware Config
Extracted
redline
down
193.233.20.31:4125
-
auth_value
12c31a90c72f5efae8c053a0bd339381
Extracted
redline
bolt
193.233.20.31:4125
-
auth_value
29540c7bf0277243e2faf6601e15a754
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
aurora
212.87.204.93:8081
Extracted
redline
USA
65.108.152.34:37345
-
auth_value
01ecb56953469aaed8efad25c0f68a64
Signatures
-
Processes:
tz9192.exev3189cX.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz9192.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v3189cX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v3189cX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz9192.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v3189cX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v3189cX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v3189cX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz9192.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz9192.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz9192.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 20 IoCs
Processes:
resource yara_rule behavioral1/memory/1116-199-0x00000000024B0000-0x00000000024F6000-memory.dmp family_redline behavioral1/memory/1116-200-0x0000000004CA0000-0x0000000004CE4000-memory.dmp family_redline behavioral1/memory/1116-202-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-201-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-206-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-204-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-210-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-208-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-214-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-212-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-216-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-220-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-222-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-218-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-226-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-224-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-234-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-232-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-230-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline behavioral1/memory/1116-228-0x0000000004CA0000-0x0000000004CDE000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
Processes:
zap5683.exezap5381.exezap4177.exetz9192.exev3189cX.exew69Em02.exexAQIe33.exey73hy95.exelegenda.exe1.exe1.exeusa.exelegenda.exelegenda.exepid process 4044 zap5683.exe 3348 zap5381.exe 4128 zap4177.exe 1500 tz9192.exe 4388 v3189cX.exe 1116 w69Em02.exe 3808 xAQIe33.exe 4696 y73hy95.exe 2032 legenda.exe 4992 1.exe 4896 1.exe 1112 usa.exe 3340 legenda.exe 2996 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 2948 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz9192.exev3189cX.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz9192.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v3189cX.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v3189cX.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
zap5381.exezap4177.exe1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exezap5683.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap5381.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap5381.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap4177.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap4177.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap5683.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap5683.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
tz9192.exev3189cX.exew69Em02.exexAQIe33.exeusa.exepid process 1500 tz9192.exe 1500 tz9192.exe 4388 v3189cX.exe 4388 v3189cX.exe 1116 w69Em02.exe 1116 w69Em02.exe 3808 xAQIe33.exe 3808 xAQIe33.exe 1112 usa.exe 1112 usa.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tz9192.exev3189cX.exew69Em02.exexAQIe33.exeWMIC.exewmic.exedescription pid process Token: SeDebugPrivilege 1500 tz9192.exe Token: SeDebugPrivilege 4388 v3189cX.exe Token: SeDebugPrivilege 1116 w69Em02.exe Token: SeDebugPrivilege 3808 xAQIe33.exe Token: SeIncreaseQuotaPrivilege 1492 WMIC.exe Token: SeSecurityPrivilege 1492 WMIC.exe Token: SeTakeOwnershipPrivilege 1492 WMIC.exe Token: SeLoadDriverPrivilege 1492 WMIC.exe Token: SeSystemProfilePrivilege 1492 WMIC.exe Token: SeSystemtimePrivilege 1492 WMIC.exe Token: SeProfSingleProcessPrivilege 1492 WMIC.exe Token: SeIncBasePriorityPrivilege 1492 WMIC.exe Token: SeCreatePagefilePrivilege 1492 WMIC.exe Token: SeBackupPrivilege 1492 WMIC.exe Token: SeRestorePrivilege 1492 WMIC.exe Token: SeShutdownPrivilege 1492 WMIC.exe Token: SeDebugPrivilege 1492 WMIC.exe Token: SeSystemEnvironmentPrivilege 1492 WMIC.exe Token: SeRemoteShutdownPrivilege 1492 WMIC.exe Token: SeUndockPrivilege 1492 WMIC.exe Token: SeManageVolumePrivilege 1492 WMIC.exe Token: 33 1492 WMIC.exe Token: 34 1492 WMIC.exe Token: 35 1492 WMIC.exe Token: 36 1492 WMIC.exe Token: SeIncreaseQuotaPrivilege 1492 WMIC.exe Token: SeSecurityPrivilege 1492 WMIC.exe Token: SeTakeOwnershipPrivilege 1492 WMIC.exe Token: SeLoadDriverPrivilege 1492 WMIC.exe Token: SeSystemProfilePrivilege 1492 WMIC.exe Token: SeSystemtimePrivilege 1492 WMIC.exe Token: SeProfSingleProcessPrivilege 1492 WMIC.exe Token: SeIncBasePriorityPrivilege 1492 WMIC.exe Token: SeCreatePagefilePrivilege 1492 WMIC.exe Token: SeBackupPrivilege 1492 WMIC.exe Token: SeRestorePrivilege 1492 WMIC.exe Token: SeShutdownPrivilege 1492 WMIC.exe Token: SeDebugPrivilege 1492 WMIC.exe Token: SeSystemEnvironmentPrivilege 1492 WMIC.exe Token: SeRemoteShutdownPrivilege 1492 WMIC.exe Token: SeUndockPrivilege 1492 WMIC.exe Token: SeManageVolumePrivilege 1492 WMIC.exe Token: 33 1492 WMIC.exe Token: 34 1492 WMIC.exe Token: 35 1492 WMIC.exe Token: 36 1492 WMIC.exe Token: SeIncreaseQuotaPrivilege 204 wmic.exe Token: SeSecurityPrivilege 204 wmic.exe Token: SeTakeOwnershipPrivilege 204 wmic.exe Token: SeLoadDriverPrivilege 204 wmic.exe Token: SeSystemProfilePrivilege 204 wmic.exe Token: SeSystemtimePrivilege 204 wmic.exe Token: SeProfSingleProcessPrivilege 204 wmic.exe Token: SeIncBasePriorityPrivilege 204 wmic.exe Token: SeCreatePagefilePrivilege 204 wmic.exe Token: SeBackupPrivilege 204 wmic.exe Token: SeRestorePrivilege 204 wmic.exe Token: SeShutdownPrivilege 204 wmic.exe Token: SeDebugPrivilege 204 wmic.exe Token: SeSystemEnvironmentPrivilege 204 wmic.exe Token: SeRemoteShutdownPrivilege 204 wmic.exe Token: SeUndockPrivilege 204 wmic.exe Token: SeManageVolumePrivilege 204 wmic.exe Token: 33 204 wmic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exezap5683.exezap5381.exezap4177.exey73hy95.exelegenda.execmd.exe1.execmd.exedescription pid process target process PID 2580 wrote to memory of 4044 2580 1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exe zap5683.exe PID 2580 wrote to memory of 4044 2580 1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exe zap5683.exe PID 2580 wrote to memory of 4044 2580 1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exe zap5683.exe PID 4044 wrote to memory of 3348 4044 zap5683.exe zap5381.exe PID 4044 wrote to memory of 3348 4044 zap5683.exe zap5381.exe PID 4044 wrote to memory of 3348 4044 zap5683.exe zap5381.exe PID 3348 wrote to memory of 4128 3348 zap5381.exe zap4177.exe PID 3348 wrote to memory of 4128 3348 zap5381.exe zap4177.exe PID 3348 wrote to memory of 4128 3348 zap5381.exe zap4177.exe PID 4128 wrote to memory of 1500 4128 zap4177.exe tz9192.exe PID 4128 wrote to memory of 1500 4128 zap4177.exe tz9192.exe PID 4128 wrote to memory of 4388 4128 zap4177.exe v3189cX.exe PID 4128 wrote to memory of 4388 4128 zap4177.exe v3189cX.exe PID 4128 wrote to memory of 4388 4128 zap4177.exe v3189cX.exe PID 3348 wrote to memory of 1116 3348 zap5381.exe w69Em02.exe PID 3348 wrote to memory of 1116 3348 zap5381.exe w69Em02.exe PID 3348 wrote to memory of 1116 3348 zap5381.exe w69Em02.exe PID 4044 wrote to memory of 3808 4044 zap5683.exe xAQIe33.exe PID 4044 wrote to memory of 3808 4044 zap5683.exe xAQIe33.exe PID 4044 wrote to memory of 3808 4044 zap5683.exe xAQIe33.exe PID 2580 wrote to memory of 4696 2580 1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exe y73hy95.exe PID 2580 wrote to memory of 4696 2580 1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exe y73hy95.exe PID 2580 wrote to memory of 4696 2580 1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exe y73hy95.exe PID 4696 wrote to memory of 2032 4696 y73hy95.exe legenda.exe PID 4696 wrote to memory of 2032 4696 y73hy95.exe legenda.exe PID 4696 wrote to memory of 2032 4696 y73hy95.exe legenda.exe PID 2032 wrote to memory of 4400 2032 legenda.exe schtasks.exe PID 2032 wrote to memory of 4400 2032 legenda.exe schtasks.exe PID 2032 wrote to memory of 4400 2032 legenda.exe schtasks.exe PID 2032 wrote to memory of 4912 2032 legenda.exe cmd.exe PID 2032 wrote to memory of 4912 2032 legenda.exe cmd.exe PID 2032 wrote to memory of 4912 2032 legenda.exe cmd.exe PID 4912 wrote to memory of 4456 4912 cmd.exe cmd.exe PID 4912 wrote to memory of 4456 4912 cmd.exe cmd.exe PID 4912 wrote to memory of 4456 4912 cmd.exe cmd.exe PID 4912 wrote to memory of 5008 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 5008 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 5008 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 4988 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 4988 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 4988 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 5012 4912 cmd.exe cmd.exe PID 4912 wrote to memory of 5012 4912 cmd.exe cmd.exe PID 4912 wrote to memory of 5012 4912 cmd.exe cmd.exe PID 4912 wrote to memory of 5032 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 5032 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 5032 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 5016 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 5016 4912 cmd.exe cacls.exe PID 4912 wrote to memory of 5016 4912 cmd.exe cacls.exe PID 2032 wrote to memory of 4992 2032 legenda.exe 1.exe PID 2032 wrote to memory of 4992 2032 legenda.exe 1.exe PID 2032 wrote to memory of 4992 2032 legenda.exe 1.exe PID 2032 wrote to memory of 4896 2032 legenda.exe 1.exe PID 2032 wrote to memory of 4896 2032 legenda.exe 1.exe PID 2032 wrote to memory of 4896 2032 legenda.exe 1.exe PID 2032 wrote to memory of 1112 2032 legenda.exe usa.exe PID 2032 wrote to memory of 1112 2032 legenda.exe usa.exe PID 2032 wrote to memory of 1112 2032 legenda.exe usa.exe PID 4992 wrote to memory of 1860 4992 1.exe cmd.exe PID 4992 wrote to memory of 1860 4992 1.exe cmd.exe PID 4992 wrote to memory of 1860 4992 1.exe cmd.exe PID 1860 wrote to memory of 1492 1860 cmd.exe WMIC.exe PID 1860 wrote to memory of 1492 1860 cmd.exe WMIC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exe"C:\Users\Admin\AppData\Local\Temp\1e463bbe965e9b93156ced796ad05c417edc095c177a0b3f42e31bf4799262d4.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5683.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5683.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5381.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5381.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4177.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4177.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz9192.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz9192.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3189cX.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3189cX.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w69Em02.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w69Em02.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xAQIe33.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xAQIe33.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y73hy95.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y73hy95.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Roaming\1000150000\1.exe"C:\Users\Admin\AppData\Roaming\1000150000\1.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wmic csproduct get uuid"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name6⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"5⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name6⤵
-
C:\Windows\SysWOW64\cmd.execmd "/c " systeminfo5⤵
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo6⤵
- Gathers system information
-
C:\Users\Admin\AppData\Local\Temp\1000151001\1.exe"C:\Users\Admin\AppData\Local\Temp\1000151001\1.exe"4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000152001\usa.exe"C:\Users\Admin\AppData\Local\Temp\1000152001\usa.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1000151001\1.exeFilesize
3.1MB
MD564e554cd95971c4a00ae1f6677331cce
SHA1d7189c4afd0bfbdf12323917434dcfdd55e8b300
SHA2564564dd1ce4e535487bbe27f9c4b2ac6bee07fa1acf838142e1044fe425d9d0c3
SHA5124000e391279f0d930079d2355f78cb173cb00308e3c847edfe473daf9c08000c7acaa6fd5accc2a91b389cdbc4a0f5ca2511ca9a65760a7042d8d466fc726074
-
C:\Users\Admin\AppData\Local\Temp\1000151001\1.exeFilesize
3.1MB
MD564e554cd95971c4a00ae1f6677331cce
SHA1d7189c4afd0bfbdf12323917434dcfdd55e8b300
SHA2564564dd1ce4e535487bbe27f9c4b2ac6bee07fa1acf838142e1044fe425d9d0c3
SHA5124000e391279f0d930079d2355f78cb173cb00308e3c847edfe473daf9c08000c7acaa6fd5accc2a91b389cdbc4a0f5ca2511ca9a65760a7042d8d466fc726074
-
C:\Users\Admin\AppData\Local\Temp\1000152001\usa.exeFilesize
335KB
MD5f00f6596f6bf65d01cb390aebc5326f5
SHA18e8d257bd51d2213ed871c4b8b88a0238036e313
SHA2562e54e59e1fabb5accbef4a42a2cf7af640c57ac0fa7e3542c160662fb327caa7
SHA51274bde8fd32b51b42c6cc70790f86ae4bc1b83f37aa6e246d147469220c46b5d789d9349fef961491917a773dca061665cc09ab858df449f5119e96e59fbf0fb0
-
C:\Users\Admin\AppData\Local\Temp\1000152001\usa.exeFilesize
335KB
MD5f00f6596f6bf65d01cb390aebc5326f5
SHA18e8d257bd51d2213ed871c4b8b88a0238036e313
SHA2562e54e59e1fabb5accbef4a42a2cf7af640c57ac0fa7e3542c160662fb327caa7
SHA51274bde8fd32b51b42c6cc70790f86ae4bc1b83f37aa6e246d147469220c46b5d789d9349fef961491917a773dca061665cc09ab858df449f5119e96e59fbf0fb0
-
C:\Users\Admin\AppData\Local\Temp\1000152001\usa.exeFilesize
335KB
MD5f00f6596f6bf65d01cb390aebc5326f5
SHA18e8d257bd51d2213ed871c4b8b88a0238036e313
SHA2562e54e59e1fabb5accbef4a42a2cf7af640c57ac0fa7e3542c160662fb327caa7
SHA51274bde8fd32b51b42c6cc70790f86ae4bc1b83f37aa6e246d147469220c46b5d789d9349fef961491917a773dca061665cc09ab858df449f5119e96e59fbf0fb0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y73hy95.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y73hy95.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5683.exeFilesize
842KB
MD5039a800738581ffa8b723ecefdc96639
SHA12f896a4eb32f92bf3cc6fbabc150812a7ff5d36b
SHA2561ee6be262d071bcda273617d53795c0a7069ac6a0c986fa924491d67e9d82a8c
SHA512cc400075c1d18551f8c9360e4944be52c9a1852caace407b57c31fde7cacc599cd4bdace1029db09232da663af03f2cc3bbc3e91d5bfb110d57b39881f4c5c31
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap5683.exeFilesize
842KB
MD5039a800738581ffa8b723ecefdc96639
SHA12f896a4eb32f92bf3cc6fbabc150812a7ff5d36b
SHA2561ee6be262d071bcda273617d53795c0a7069ac6a0c986fa924491d67e9d82a8c
SHA512cc400075c1d18551f8c9360e4944be52c9a1852caace407b57c31fde7cacc599cd4bdace1029db09232da663af03f2cc3bbc3e91d5bfb110d57b39881f4c5c31
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xAQIe33.exeFilesize
175KB
MD578efaf7292c2027da40635ca1aae855a
SHA1686227a48e23b382a06c74f17d9b6f36e76042fd
SHA2562f1381bbe319ee3d19b3e07704205a3d31a7ffb7b5b7c282b9d884682bc892ab
SHA51219e22ec7ad2295a1a3f4cbabb2e005df674ff3731cc33b74e175e10fcc4e482c8f0ce9c8722a8d14a0f9f9ad6e37360ce6816215512bea8324cd87a9fefc852a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xAQIe33.exeFilesize
175KB
MD578efaf7292c2027da40635ca1aae855a
SHA1686227a48e23b382a06c74f17d9b6f36e76042fd
SHA2562f1381bbe319ee3d19b3e07704205a3d31a7ffb7b5b7c282b9d884682bc892ab
SHA51219e22ec7ad2295a1a3f4cbabb2e005df674ff3731cc33b74e175e10fcc4e482c8f0ce9c8722a8d14a0f9f9ad6e37360ce6816215512bea8324cd87a9fefc852a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5381.exeFilesize
700KB
MD50d1430e32ffd3a545acf28c434ae4e1d
SHA1cea5532bd43c9d8c55975e9e1f0d5ca6093054c7
SHA256f69cd85e1a0dbd8307298a69b3c67caebb7608af91d5d1a0bc3ce285ed95a633
SHA512dd11c75176437f17ae4054864587784894c777177f45289db5cdf27046ec80ed8601fb6c1b77e1823ff06baf4df8a20bff508c573bf85fc49f9f549e4c31014a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap5381.exeFilesize
700KB
MD50d1430e32ffd3a545acf28c434ae4e1d
SHA1cea5532bd43c9d8c55975e9e1f0d5ca6093054c7
SHA256f69cd85e1a0dbd8307298a69b3c67caebb7608af91d5d1a0bc3ce285ed95a633
SHA512dd11c75176437f17ae4054864587784894c777177f45289db5cdf27046ec80ed8601fb6c1b77e1823ff06baf4df8a20bff508c573bf85fc49f9f549e4c31014a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w69Em02.exeFilesize
358KB
MD5a8caa038b56390887c950e4880c21cea
SHA126ae0e8e1092c2dc191d67b4ed132545a26d7110
SHA256c93eee43ec19ef9970518b1d30225661b13290d55a896d340547a51f92f265ad
SHA512aa5319206a8dd7f95c5164d385acb0b32617445c53666ba3776e3ae08ce33cc36e1c152b428a735071bd41c0b2c472fb7f60825217f96481c9968b6f34afb26c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w69Em02.exeFilesize
358KB
MD5a8caa038b56390887c950e4880c21cea
SHA126ae0e8e1092c2dc191d67b4ed132545a26d7110
SHA256c93eee43ec19ef9970518b1d30225661b13290d55a896d340547a51f92f265ad
SHA512aa5319206a8dd7f95c5164d385acb0b32617445c53666ba3776e3ae08ce33cc36e1c152b428a735071bd41c0b2c472fb7f60825217f96481c9968b6f34afb26c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4177.exeFilesize
347KB
MD573044be170fee907a265855d67b9ce8a
SHA1be52009b4d70b99985ba337a5070d112c002b781
SHA25600c31b6cbef18ce723844f9286a75eec38f5648cf9b684202887d7143f5ef096
SHA5127edfe63d26d2eea3ae1cdbcf747911d6ed2d1522b9b71c7887dc7aa390af8d263f64e0262236e2beb96f34487b20ae73248d1d7ccda08e3d43aad0dff276acd0
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4177.exeFilesize
347KB
MD573044be170fee907a265855d67b9ce8a
SHA1be52009b4d70b99985ba337a5070d112c002b781
SHA25600c31b6cbef18ce723844f9286a75eec38f5648cf9b684202887d7143f5ef096
SHA5127edfe63d26d2eea3ae1cdbcf747911d6ed2d1522b9b71c7887dc7aa390af8d263f64e0262236e2beb96f34487b20ae73248d1d7ccda08e3d43aad0dff276acd0
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz9192.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz9192.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3189cX.exeFilesize
300KB
MD5db6501bba09c74d201940bb291a9a6d1
SHA10561370049068ea85dd562dd6dec550a314ce594
SHA2564274c669a731733f5cca49e6d6aad3267a43bd23676b0562ec3fc345b0109a5b
SHA51288f7f656271bcb8595dd82056da64c4ad0b9fa05c0c9400959cff1f2cf7be63399734c6c7625fc54aa2f38a0ffda9cf80f9cb3b4b7f7aac50d38681107e05761
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v3189cX.exeFilesize
300KB
MD5db6501bba09c74d201940bb291a9a6d1
SHA10561370049068ea85dd562dd6dec550a314ce594
SHA2564274c669a731733f5cca49e6d6aad3267a43bd23676b0562ec3fc345b0109a5b
SHA51288f7f656271bcb8595dd82056da64c4ad0b9fa05c0c9400959cff1f2cf7be63399734c6c7625fc54aa2f38a0ffda9cf80f9cb3b4b7f7aac50d38681107e05761
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\1000150000\1.exeFilesize
3.1MB
MD564e554cd95971c4a00ae1f6677331cce
SHA1d7189c4afd0bfbdf12323917434dcfdd55e8b300
SHA2564564dd1ce4e535487bbe27f9c4b2ac6bee07fa1acf838142e1044fe425d9d0c3
SHA5124000e391279f0d930079d2355f78cb173cb00308e3c847edfe473daf9c08000c7acaa6fd5accc2a91b389cdbc4a0f5ca2511ca9a65760a7042d8d466fc726074
-
C:\Users\Admin\AppData\Roaming\1000150000\1.exeFilesize
3.1MB
MD564e554cd95971c4a00ae1f6677331cce
SHA1d7189c4afd0bfbdf12323917434dcfdd55e8b300
SHA2564564dd1ce4e535487bbe27f9c4b2ac6bee07fa1acf838142e1044fe425d9d0c3
SHA5124000e391279f0d930079d2355f78cb173cb00308e3c847edfe473daf9c08000c7acaa6fd5accc2a91b389cdbc4a0f5ca2511ca9a65760a7042d8d466fc726074
-
C:\Users\Admin\AppData\Roaming\1000150000\1.exeFilesize
3.1MB
MD564e554cd95971c4a00ae1f6677331cce
SHA1d7189c4afd0bfbdf12323917434dcfdd55e8b300
SHA2564564dd1ce4e535487bbe27f9c4b2ac6bee07fa1acf838142e1044fe425d9d0c3
SHA5124000e391279f0d930079d2355f78cb173cb00308e3c847edfe473daf9c08000c7acaa6fd5accc2a91b389cdbc4a0f5ca2511ca9a65760a7042d8d466fc726074
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
memory/1112-1184-0x0000000000850000-0x00000000008AA000-memory.dmpFilesize
360KB
-
memory/1112-1185-0x0000000001110000-0x0000000001116000-memory.dmpFilesize
24KB
-
memory/1112-1186-0x000000000AA10000-0x000000000AA5B000-memory.dmpFilesize
300KB
-
memory/1112-1187-0x00000000051C0000-0x00000000051D0000-memory.dmpFilesize
64KB
-
memory/1116-218-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-1121-0x00000000063F0000-0x0000000006482000-memory.dmpFilesize
584KB
-
memory/1116-199-0x00000000024B0000-0x00000000024F6000-memory.dmpFilesize
280KB
-
memory/1116-200-0x0000000004CA0000-0x0000000004CE4000-memory.dmpFilesize
272KB
-
memory/1116-202-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-201-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-206-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-204-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-210-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-208-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-214-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-212-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-216-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-220-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-222-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-1126-0x0000000006870000-0x0000000006D9C000-memory.dmpFilesize
5.2MB
-
memory/1116-226-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-224-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-234-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-232-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-230-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-228-0x0000000004CA0000-0x0000000004CDE000-memory.dmpFilesize
248KB
-
memory/1116-261-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/1116-258-0x00000000007F0000-0x000000000083B000-memory.dmpFilesize
300KB
-
memory/1116-264-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/1116-262-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/1116-1111-0x00000000058F0000-0x0000000005EF6000-memory.dmpFilesize
6.0MB
-
memory/1116-1112-0x00000000052E0000-0x00000000053EA000-memory.dmpFilesize
1.0MB
-
memory/1116-1113-0x00000000053F0000-0x0000000005402000-memory.dmpFilesize
72KB
-
memory/1116-1114-0x0000000005410000-0x000000000544E000-memory.dmpFilesize
248KB
-
memory/1116-1115-0x0000000005560000-0x00000000055AB000-memory.dmpFilesize
300KB
-
memory/1116-1116-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/1116-1118-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/1116-1119-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/1116-1120-0x00000000056F0000-0x0000000005756000-memory.dmpFilesize
408KB
-
memory/1116-1125-0x0000000006680000-0x0000000006842000-memory.dmpFilesize
1.8MB
-
memory/1116-1122-0x0000000006490000-0x0000000006506000-memory.dmpFilesize
472KB
-
memory/1116-1123-0x0000000006510000-0x0000000006560000-memory.dmpFilesize
320KB
-
memory/1116-1124-0x0000000004DD0000-0x0000000004DE0000-memory.dmpFilesize
64KB
-
memory/1500-149-0x0000000000F20000-0x0000000000F2A000-memory.dmpFilesize
40KB
-
memory/3808-1132-0x0000000000750000-0x0000000000782000-memory.dmpFilesize
200KB
-
memory/3808-1134-0x0000000005000000-0x0000000005010000-memory.dmpFilesize
64KB
-
memory/3808-1133-0x0000000005010000-0x000000000505B000-memory.dmpFilesize
300KB
-
memory/4388-183-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-173-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-191-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/4388-189-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/4388-188-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/4388-187-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-185-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-171-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-175-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-177-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-194-0x0000000000400000-0x000000000070E000-memory.dmpFilesize
3.1MB
-
memory/4388-179-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-181-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-190-0x0000000000400000-0x000000000070E000-memory.dmpFilesize
3.1MB
-
memory/4388-169-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-167-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-165-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-163-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-161-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-160-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/4388-159-0x0000000005140000-0x0000000005158000-memory.dmpFilesize
96KB
-
memory/4388-158-0x0000000004BE0000-0x00000000050DE000-memory.dmpFilesize
5.0MB
-
memory/4388-157-0x0000000004BB0000-0x0000000004BCA000-memory.dmpFilesize
104KB
-
memory/4388-156-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB
-
memory/4388-155-0x00000000001D0000-0x00000000001FD000-memory.dmpFilesize
180KB
-
memory/4388-192-0x0000000002470000-0x0000000002480000-memory.dmpFilesize
64KB