Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 18:20
Static task
static1
General
-
Target
e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exe
-
Size
1.0MB
-
MD5
6cd01f88701e0a437a40fffec0fc8873
-
SHA1
ac7aad1269e31293726609d3d9191adcf0d279c9
-
SHA256
e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31
-
SHA512
11fd28ef826d235936fa529c7499777f402f0ba927f6d4d378aab9ff7cefacdab086523ba4613d60f496970c31254a1af1f4f1f8fc7e78311ac9432a5e3ed3b0
-
SSDEEP
24576:+yu9p/BSfFpWXBLglPJQtZzHAVVHF1BWX6UJ1Yw2ZfT6:NiwfTWxqGjz33Y7f
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
lida
193.233.20.32:4125
-
auth_value
24052aa2e9b85984a98d80cf08623e8d
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
redline
Cong
199.115.193.171:48258
-
auth_value
aecbeec46b8431628af8ba12e4621a71
Extracted
redline
whitedoc
81.161.229.143:45156
-
auth_value
2020d22aaa2ecafa1b12e00dfcffae03
Signatures
-
Processes:
v2918ob.exetz0647.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v2918ob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v2918ob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v2918ob.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz0647.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v2918ob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v2918ob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz0647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz0647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v2918ob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz0647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz0647.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz0647.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 19 IoCs
Processes:
resource yara_rule behavioral1/memory/4596-210-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-211-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-213-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-215-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-217-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-219-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-222-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-226-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-229-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-231-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-233-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-235-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-237-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-239-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-241-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-243-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-245-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-247-0x0000000007170000-0x00000000071AF000-memory.dmp family_redline behavioral1/memory/4596-1128-0x00000000071C0000-0x00000000071D0000-memory.dmp family_redline -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legenda.exe76783.exey48ZD68.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation legenda.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation 76783.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation y48ZD68.exe -
Executes dropped EXE 16 IoCs
Processes:
zap8359.exezap7459.exezap8141.exetz0647.exev2918ob.exew07Dx93.exexrZdd10.exey48ZD68.exelegenda.exe76783.exeBlaubok.exeBlaubok.exeBlaubok.exebuild.exelegenda.exelegenda.exepid process 3008 zap8359.exe 640 zap7459.exe 4360 zap8141.exe 4364 tz0647.exe 1500 v2918ob.exe 4596 w07Dx93.exe 2788 xrZdd10.exe 3472 y48ZD68.exe 2232 legenda.exe 1492 76783.exe 1312 Blaubok.exe 3044 Blaubok.exe 756 Blaubok.exe 2088 build.exe 2564 legenda.exe 5084 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4988 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz0647.exev2918ob.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz0647.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v2918ob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v2918ob.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
zap8359.exezap7459.exezap8141.exee2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap8359.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap7459.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap7459.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap8141.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap8141.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap8359.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
Blaubok.exe76783.exedescription pid process target process PID 1312 set thread context of 756 1312 Blaubok.exe Blaubok.exe PID 1492 set thread context of 4392 1492 76783.exe InstallUtil.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1972 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 1108 1500 WerFault.exe v2918ob.exe 4392 4596 WerFault.exe w07Dx93.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tz0647.exev2918ob.exew07Dx93.exexrZdd10.exe76783.exepid process 4364 tz0647.exe 4364 tz0647.exe 1500 v2918ob.exe 1500 v2918ob.exe 4596 w07Dx93.exe 4596 w07Dx93.exe 2788 xrZdd10.exe 2788 xrZdd10.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe 1492 76783.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
tz0647.exev2918ob.exew07Dx93.exexrZdd10.exe76783.exebuild.exeBlaubok.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4364 tz0647.exe Token: SeDebugPrivilege 1500 v2918ob.exe Token: SeDebugPrivilege 4596 w07Dx93.exe Token: SeDebugPrivilege 2788 xrZdd10.exe Token: SeDebugPrivilege 1492 76783.exe Token: SeDebugPrivilege 2088 build.exe Token: SeDebugPrivilege 756 Blaubok.exe Token: SeDebugPrivilege 4392 InstallUtil.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exezap8359.exezap7459.exezap8141.exey48ZD68.exelegenda.execmd.exeBlaubok.exedescription pid process target process PID 684 wrote to memory of 3008 684 e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exe zap8359.exe PID 684 wrote to memory of 3008 684 e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exe zap8359.exe PID 684 wrote to memory of 3008 684 e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exe zap8359.exe PID 3008 wrote to memory of 640 3008 zap8359.exe zap7459.exe PID 3008 wrote to memory of 640 3008 zap8359.exe zap7459.exe PID 3008 wrote to memory of 640 3008 zap8359.exe zap7459.exe PID 640 wrote to memory of 4360 640 zap7459.exe zap8141.exe PID 640 wrote to memory of 4360 640 zap7459.exe zap8141.exe PID 640 wrote to memory of 4360 640 zap7459.exe zap8141.exe PID 4360 wrote to memory of 4364 4360 zap8141.exe tz0647.exe PID 4360 wrote to memory of 4364 4360 zap8141.exe tz0647.exe PID 4360 wrote to memory of 1500 4360 zap8141.exe v2918ob.exe PID 4360 wrote to memory of 1500 4360 zap8141.exe v2918ob.exe PID 4360 wrote to memory of 1500 4360 zap8141.exe v2918ob.exe PID 640 wrote to memory of 4596 640 zap7459.exe w07Dx93.exe PID 640 wrote to memory of 4596 640 zap7459.exe w07Dx93.exe PID 640 wrote to memory of 4596 640 zap7459.exe w07Dx93.exe PID 3008 wrote to memory of 2788 3008 zap8359.exe xrZdd10.exe PID 3008 wrote to memory of 2788 3008 zap8359.exe xrZdd10.exe PID 3008 wrote to memory of 2788 3008 zap8359.exe xrZdd10.exe PID 684 wrote to memory of 3472 684 e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exe y48ZD68.exe PID 684 wrote to memory of 3472 684 e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exe y48ZD68.exe PID 684 wrote to memory of 3472 684 e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exe y48ZD68.exe PID 3472 wrote to memory of 2232 3472 y48ZD68.exe legenda.exe PID 3472 wrote to memory of 2232 3472 y48ZD68.exe legenda.exe PID 3472 wrote to memory of 2232 3472 y48ZD68.exe legenda.exe PID 2232 wrote to memory of 4920 2232 legenda.exe schtasks.exe PID 2232 wrote to memory of 4920 2232 legenda.exe schtasks.exe PID 2232 wrote to memory of 4920 2232 legenda.exe schtasks.exe PID 2232 wrote to memory of 4492 2232 legenda.exe cmd.exe PID 2232 wrote to memory of 4492 2232 legenda.exe cmd.exe PID 2232 wrote to memory of 4492 2232 legenda.exe cmd.exe PID 4492 wrote to memory of 4772 4492 cmd.exe cmd.exe PID 4492 wrote to memory of 4772 4492 cmd.exe cmd.exe PID 4492 wrote to memory of 4772 4492 cmd.exe cmd.exe PID 4492 wrote to memory of 4852 4492 cmd.exe cacls.exe PID 4492 wrote to memory of 4852 4492 cmd.exe cacls.exe PID 4492 wrote to memory of 4852 4492 cmd.exe cacls.exe PID 4492 wrote to memory of 1028 4492 cmd.exe cacls.exe PID 4492 wrote to memory of 1028 4492 cmd.exe cacls.exe PID 4492 wrote to memory of 1028 4492 cmd.exe cacls.exe PID 4492 wrote to memory of 4892 4492 cmd.exe cmd.exe PID 4492 wrote to memory of 4892 4492 cmd.exe cmd.exe PID 4492 wrote to memory of 4892 4492 cmd.exe cmd.exe PID 4492 wrote to memory of 4808 4492 cmd.exe cacls.exe PID 4492 wrote to memory of 4808 4492 cmd.exe cacls.exe PID 4492 wrote to memory of 4808 4492 cmd.exe cacls.exe PID 4492 wrote to memory of 3856 4492 cmd.exe cacls.exe PID 4492 wrote to memory of 3856 4492 cmd.exe cacls.exe PID 4492 wrote to memory of 3856 4492 cmd.exe cacls.exe PID 2232 wrote to memory of 1492 2232 legenda.exe 76783.exe PID 2232 wrote to memory of 1492 2232 legenda.exe 76783.exe PID 2232 wrote to memory of 1492 2232 legenda.exe 76783.exe PID 2232 wrote to memory of 1312 2232 legenda.exe Blaubok.exe PID 2232 wrote to memory of 1312 2232 legenda.exe Blaubok.exe PID 2232 wrote to memory of 1312 2232 legenda.exe Blaubok.exe PID 1312 wrote to memory of 3044 1312 Blaubok.exe Blaubok.exe PID 1312 wrote to memory of 3044 1312 Blaubok.exe Blaubok.exe PID 1312 wrote to memory of 3044 1312 Blaubok.exe Blaubok.exe PID 1312 wrote to memory of 3044 1312 Blaubok.exe Blaubok.exe PID 1312 wrote to memory of 756 1312 Blaubok.exe Blaubok.exe PID 1312 wrote to memory of 756 1312 Blaubok.exe Blaubok.exe PID 1312 wrote to memory of 756 1312 Blaubok.exe Blaubok.exe PID 1312 wrote to memory of 756 1312 Blaubok.exe Blaubok.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exe"C:\Users\Admin\AppData\Local\Temp\e2b85eec020b61e8102bdb31dd7a4e4294b02a9d53a8b813bcab9feb8bdb9e31.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8359.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8359.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7459.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7459.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8141.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8141.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0647.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0647.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2918ob.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2918ob.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 10886⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w07Dx93.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w07Dx93.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4596 -s 15525⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xrZdd10.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xrZdd10.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y48ZD68.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y48ZD68.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exe"C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe"C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeC:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeC:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1500 -ip 15001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4596 -ip 45961⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Blaubok.exe.logFilesize
1KB
MD5a3c82409506a33dec1856104ca55cbfd
SHA12e2ba4e4227590f8821002831c5410f7f45fe812
SHA256780a0d4410f5f9798cb573bcd774561d1439987a39b1368d3c890226928cd203
SHA5129621cfd3dab86d964a2bea6b3788fc19a895307962dcc41428741b8a86291f114df722e9017f755f63d53d09b5111e68f05aa505d9c9deae6c4378a87cdfa69f
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exeFilesize
1.3MB
MD51782e83ab6ad4f8b4b24dc03ee802100
SHA1fcc9e4d3a0b8bc205339f878f83775939acb93e6
SHA256e5d6c6b7449ea4f9931eed975d0fbf40ded3c637bafee5adb4bd4bd7a703f7dd
SHA512ada7fa28dd6a60a5bef1b63ac07e697e14091fe8bd0d569b0b9cb9e5483acf4c650b25d64ec35027a1ec14ef2fb028c7cf7dd2bdb36f1da7acdddb51d4580e35
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exeFilesize
1.3MB
MD51782e83ab6ad4f8b4b24dc03ee802100
SHA1fcc9e4d3a0b8bc205339f878f83775939acb93e6
SHA256e5d6c6b7449ea4f9931eed975d0fbf40ded3c637bafee5adb4bd4bd7a703f7dd
SHA512ada7fa28dd6a60a5bef1b63ac07e697e14091fe8bd0d569b0b9cb9e5483acf4c650b25d64ec35027a1ec14ef2fb028c7cf7dd2bdb36f1da7acdddb51d4580e35
-
C:\Users\Admin\AppData\Local\Temp\1000156001\76783.exeFilesize
1.3MB
MD51782e83ab6ad4f8b4b24dc03ee802100
SHA1fcc9e4d3a0b8bc205339f878f83775939acb93e6
SHA256e5d6c6b7449ea4f9931eed975d0fbf40ded3c637bafee5adb4bd4bd7a703f7dd
SHA512ada7fa28dd6a60a5bef1b63ac07e697e14091fe8bd0d569b0b9cb9e5483acf4c650b25d64ec35027a1ec14ef2fb028c7cf7dd2bdb36f1da7acdddb51d4580e35
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\1000157001\Blaubok.exeFilesize
895KB
MD53c62500496bfc4f35d38ddbe71be78c2
SHA14982a2fb4963f1f574a9ee1e5d02c429148c5e70
SHA256dc980114d28ff6a6743bf6951527b33e43ee1e72d254d6a46cc2049ce0eba165
SHA512d71935afa0f1f3e5c6a291b09b20a020ea6b73ec181f22520f0dd35306f9357c229e6dad17956657c935a455403efb308f224444a06821c414d0c395f484cd4c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y48ZD68.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y48ZD68.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8359.exeFilesize
856KB
MD53074eb0763d661e44fa28f2c16fc1133
SHA158be18bdca4aa77a87a203d24b0c20c593566f3c
SHA25650b0250be6489cb5b5eb7fb56c4e81b9a8545a6cb6d1a5ea51b95dcada405b6d
SHA5120d00c465892673821a24fdb11f89e24e3664fd32258b518a03853cd52a789bd74abd16bf13d6b18d049af9869dbf97a5754f864007dc95ad79d6864969e68f9e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap8359.exeFilesize
856KB
MD53074eb0763d661e44fa28f2c16fc1133
SHA158be18bdca4aa77a87a203d24b0c20c593566f3c
SHA25650b0250be6489cb5b5eb7fb56c4e81b9a8545a6cb6d1a5ea51b95dcada405b6d
SHA5120d00c465892673821a24fdb11f89e24e3664fd32258b518a03853cd52a789bd74abd16bf13d6b18d049af9869dbf97a5754f864007dc95ad79d6864969e68f9e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xrZdd10.exeFilesize
175KB
MD56b06147bf5fd26306978a93fe83127a4
SHA17b14ff42f4441b985591ef5b7d4cc703f0bbcdfa
SHA25611e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0
SHA512603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xrZdd10.exeFilesize
175KB
MD56b06147bf5fd26306978a93fe83127a4
SHA17b14ff42f4441b985591ef5b7d4cc703f0bbcdfa
SHA25611e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0
SHA512603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7459.exeFilesize
714KB
MD534e95608837b51587be169fcfeb574b4
SHA1b97eb398e8b42296149c320a293e5cf402567e73
SHA256dc2a1a8147574f80f65fbbe73996876f9206b8b59ec4b1f7cf1ee0f0f9060eef
SHA5127e5c0745a136b836fee6d20a3c6daaae3afbb176ab4f599c54f1d75dc4bb6adbf44fca0eddea7c684edf547f9b0aeb36780a8c2a66d9c16fa1687a6621b6350c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap7459.exeFilesize
714KB
MD534e95608837b51587be169fcfeb574b4
SHA1b97eb398e8b42296149c320a293e5cf402567e73
SHA256dc2a1a8147574f80f65fbbe73996876f9206b8b59ec4b1f7cf1ee0f0f9060eef
SHA5127e5c0745a136b836fee6d20a3c6daaae3afbb176ab4f599c54f1d75dc4bb6adbf44fca0eddea7c684edf547f9b0aeb36780a8c2a66d9c16fa1687a6621b6350c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w07Dx93.exeFilesize
386KB
MD5e76fff6416ff5ae77101b7bece4c789a
SHA1fd219ef7d56ddc896776c90631f91a3b7ea291bc
SHA256e88e529427e280a5ac061b169cabb2fb9e365d78342910f4cd81a4c8e92ffd74
SHA512e1cc8174014ab55ec5ea8a49d673122293b86e833954a4ac9dce389e3d23a3567134bd172deecc99c3c4b94d26a7155982c9a37c0568d4dcadc87270bd8a1427
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w07Dx93.exeFilesize
386KB
MD5e76fff6416ff5ae77101b7bece4c789a
SHA1fd219ef7d56ddc896776c90631f91a3b7ea291bc
SHA256e88e529427e280a5ac061b169cabb2fb9e365d78342910f4cd81a4c8e92ffd74
SHA512e1cc8174014ab55ec5ea8a49d673122293b86e833954a4ac9dce389e3d23a3567134bd172deecc99c3c4b94d26a7155982c9a37c0568d4dcadc87270bd8a1427
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8141.exeFilesize
355KB
MD58215bcb8b65821c6896e9c4628e7d84e
SHA1d3a287e7405cf31c47ea32812f9b5817ea0c33a0
SHA2566d9168f1151de55adbf227b736e77527fb15be518845e51fe8fcdfc1e027a2c8
SHA512d3ef35775573e518ff9e6e2b9c3cf10a861367aee403b16a726683f149afbd64e6ceb027f470ac2db565ef81c09ac1d85ca2df16622a9bc7082270f176fc3448
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8141.exeFilesize
355KB
MD58215bcb8b65821c6896e9c4628e7d84e
SHA1d3a287e7405cf31c47ea32812f9b5817ea0c33a0
SHA2566d9168f1151de55adbf227b736e77527fb15be518845e51fe8fcdfc1e027a2c8
SHA512d3ef35775573e518ff9e6e2b9c3cf10a861367aee403b16a726683f149afbd64e6ceb027f470ac2db565ef81c09ac1d85ca2df16622a9bc7082270f176fc3448
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0647.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0647.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2918ob.exeFilesize
328KB
MD5ae35f6088b85cd3f6080eca0f2ea4d96
SHA13ea10534834235a70398b66ad2618cac96038e13
SHA256c149d42a2e0cca1251585f9d453e567040f74017ae87d2d32c165bfc52b659b7
SHA51286d56353ddfbfa54369a38f4774fd77023242223588e47bd2aa2636c0611bcb288cd009d7fa738cfad75e0ecf242ecb087684b51c641512ccfe84714cdd94039
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v2918ob.exeFilesize
328KB
MD5ae35f6088b85cd3f6080eca0f2ea4d96
SHA13ea10534834235a70398b66ad2618cac96038e13
SHA256c149d42a2e0cca1251585f9d453e567040f74017ae87d2d32c165bfc52b659b7
SHA51286d56353ddfbfa54369a38f4774fd77023242223588e47bd2aa2636c0611bcb288cd009d7fa738cfad75e0ecf242ecb087684b51c641512ccfe84714cdd94039
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exeFilesize
219KB
MD58335af270081d77360614e79069a2c33
SHA14ddbbe796abda834b342f0987df5b72c35fd2717
SHA256f10d06d3709919d84af8c6ca81c85c3e33d501da0f1e36b6c37f04c5e58345c1
SHA512448389132aa57473478a8b44761ae029510ab1ed3828d8c501fe4206317cb18ba5d46660788a5065568fb91c2c6626e74f0d3c41198b518e86336b5e2991648f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exeFilesize
219KB
MD58335af270081d77360614e79069a2c33
SHA14ddbbe796abda834b342f0987df5b72c35fd2717
SHA256f10d06d3709919d84af8c6ca81c85c3e33d501da0f1e36b6c37f04c5e58345c1
SHA512448389132aa57473478a8b44761ae029510ab1ed3828d8c501fe4206317cb18ba5d46660788a5065568fb91c2c6626e74f0d3c41198b518e86336b5e2991648f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\build.exeFilesize
219KB
MD58335af270081d77360614e79069a2c33
SHA14ddbbe796abda834b342f0987df5b72c35fd2717
SHA256f10d06d3709919d84af8c6ca81c85c3e33d501da0f1e36b6c37f04c5e58345c1
SHA512448389132aa57473478a8b44761ae029510ab1ed3828d8c501fe4206317cb18ba5d46660788a5065568fb91c2c6626e74f0d3c41198b518e86336b5e2991648f
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
memory/756-1210-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB
-
memory/756-1229-0x00000000053A0000-0x00000000053B0000-memory.dmpFilesize
64KB
-
memory/756-1209-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1312-1200-0x0000000004AE0000-0x0000000004AF0000-memory.dmpFilesize
64KB
-
memory/1312-1198-0x00000000000D0000-0x00000000001B6000-memory.dmpFilesize
920KB
-
memory/1492-1177-0x0000000006340000-0x00000000068AC000-memory.dmpFilesize
5.4MB
-
memory/1492-1199-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/1492-1176-0x00000000009F0000-0x0000000000B30000-memory.dmpFilesize
1.2MB
-
memory/1492-1178-0x00000000061B0000-0x000000000624C000-memory.dmpFilesize
624KB
-
memory/1492-1211-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/1492-1212-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/1492-1213-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/1492-1228-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/1492-1203-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/1492-1231-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/1492-1202-0x0000000005810000-0x0000000005820000-memory.dmpFilesize
64KB
-
memory/1492-1201-0x0000000004C80000-0x0000000004C8A000-memory.dmpFilesize
40KB
-
memory/1500-200-0x0000000000400000-0x0000000002B7F000-memory.dmpFilesize
39.5MB
-
memory/1500-192-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-204-0x0000000007520000-0x0000000007530000-memory.dmpFilesize
64KB
-
memory/1500-203-0x0000000007520000-0x0000000007530000-memory.dmpFilesize
64KB
-
memory/1500-167-0x0000000002C50000-0x0000000002C7D000-memory.dmpFilesize
180KB
-
memory/1500-168-0x0000000007530000-0x0000000007AD4000-memory.dmpFilesize
5.6MB
-
memory/1500-170-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-169-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-202-0x0000000007520000-0x0000000007530000-memory.dmpFilesize
64KB
-
memory/1500-199-0x0000000007520000-0x0000000007530000-memory.dmpFilesize
64KB
-
memory/1500-172-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-198-0x0000000007520000-0x0000000007530000-memory.dmpFilesize
64KB
-
memory/1500-174-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-176-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-178-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-197-0x0000000007520000-0x0000000007530000-memory.dmpFilesize
64KB
-
memory/1500-196-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-180-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-182-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-184-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-186-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-188-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-190-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-194-0x0000000004A00000-0x0000000004A12000-memory.dmpFilesize
72KB
-
memory/1500-205-0x0000000000400000-0x0000000002B7F000-memory.dmpFilesize
39.5MB
-
memory/2088-1225-0x00000000000D0000-0x0000000000110000-memory.dmpFilesize
256KB
-
memory/2088-1226-0x000000001AE20000-0x000000001AE30000-memory.dmpFilesize
64KB
-
memory/2088-1230-0x000000001AE20000-0x000000001AE30000-memory.dmpFilesize
64KB
-
memory/2788-1143-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/2788-1142-0x00000000006C0000-0x00000000006F2000-memory.dmpFilesize
200KB
-
memory/4364-161-0x0000000000F90000-0x0000000000F9A000-memory.dmpFilesize
40KB
-
memory/4392-1234-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/4392-1235-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/4392-1255-0x0000000007B60000-0x0000000007B7E000-memory.dmpFilesize
120KB
-
memory/4596-1133-0x000000000B2E0000-0x000000000B330000-memory.dmpFilesize
320KB
-
memory/4596-1134-0x000000000B450000-0x000000000B612000-memory.dmpFilesize
1.8MB
-
memory/4596-215-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-213-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-211-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-210-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-219-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-221-0x0000000002B90000-0x0000000002BDB000-memory.dmpFilesize
300KB
-
memory/4596-222-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-223-0x00000000071C0000-0x00000000071D0000-memory.dmpFilesize
64KB
-
memory/4596-226-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-229-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-225-0x00000000071C0000-0x00000000071D0000-memory.dmpFilesize
64KB
-
memory/4596-228-0x00000000071C0000-0x00000000071D0000-memory.dmpFilesize
64KB
-
memory/4596-231-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-233-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-235-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-237-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-1135-0x000000000B620000-0x000000000BB4C000-memory.dmpFilesize
5.2MB
-
memory/4596-217-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-239-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-1132-0x000000000B250000-0x000000000B2C6000-memory.dmpFilesize
472KB
-
memory/4596-1131-0x00000000071C0000-0x00000000071D0000-memory.dmpFilesize
64KB
-
memory/4596-1130-0x0000000008BD0000-0x0000000008C62000-memory.dmpFilesize
584KB
-
memory/4596-1129-0x00000000071C0000-0x00000000071D0000-memory.dmpFilesize
64KB
-
memory/4596-1128-0x00000000071C0000-0x00000000071D0000-memory.dmpFilesize
64KB
-
memory/4596-1127-0x00000000071C0000-0x00000000071D0000-memory.dmpFilesize
64KB
-
memory/4596-1126-0x00000000083C0000-0x0000000008426000-memory.dmpFilesize
408KB
-
memory/4596-1124-0x00000000071C0000-0x00000000071D0000-memory.dmpFilesize
64KB
-
memory/4596-1123-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/4596-1122-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/4596-1121-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/4596-1120-0x00000000078D0000-0x0000000007EE8000-memory.dmpFilesize
6.1MB
-
memory/4596-247-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-245-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-243-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB
-
memory/4596-241-0x0000000007170000-0x00000000071AF000-memory.dmpFilesize
252KB