Analysis
-
max time kernel
108s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 20:17
Static task
static1
Behavioral task
behavioral1
Sample
b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exe
Resource
win10v2004-20230220-en
General
-
Target
b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exe
-
Size
1.0MB
-
MD5
c8e60370917531fac16cc5ae6ac3c818
-
SHA1
a80c8cfb98d84a18f06206775a0478868bc03f5a
-
SHA256
b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0
-
SHA512
dab1e854dc918276c68e2baf6c0008380cbf3d1dcd8f6f73fe2823d6e02276d984a06eb7693e2b16f2f06a4d5faa863ee2a7e46d4abdda4b06c2f2fe2b08bcb5
-
SSDEEP
24576:zys4XqfYrfMCPBA4/gyM09Df5zltT6vrhQZhhR7Zimuay5:GsQlrfMeBj/g8lT6T6Zh7uz
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
store
193.233.20.32:4125
-
auth_value
e34e5836de4e256271ab56c648765bcd
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
redline
@REDLINEVIPCHAT Cloud (TG: @FATHEROFCARDERS)
151.80.89.234:19388
-
auth_value
56af49c3278d982f9a41ef2abb7c4d09
Extracted
redline
ngan003
199.115.193.116:11300
-
auth_value
b500a5cf0cb429e32a81c6ddcd8d4545
Signatures
-
Processes:
tz6653.exev4213JI.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz6653.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v4213JI.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v4213JI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz6653.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz6653.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz6653.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz6653.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v4213JI.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz6653.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v4213JI.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v4213JI.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v4213JI.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/3812-210-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-211-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-213-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-215-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-217-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-229-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-231-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-233-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-227-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-225-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-235-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-223-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-239-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-243-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-241-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-237-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-221-0x0000000007130000-0x000000000716F000-memory.dmp family_redline behavioral1/memory/3812-219-0x0000000007130000-0x000000000716F000-memory.dmp family_redline -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
y44vk06.exelegenda.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation y44vk06.exe Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation legenda.exe -
Executes dropped EXE 14 IoCs
Processes:
zap6304.exezap0363.exezap4341.exetz6653.exev4213JI.exew79WY82.exexqseL30.exey44vk06.exelegenda.exe1millRDX.exeSprawl.exeSprawl.exeSprawl.exelegenda.exepid process 2000 zap6304.exe 1316 zap0363.exe 2956 zap4341.exe 3920 tz6653.exe 1896 v4213JI.exe 3812 w79WY82.exe 3904 xqseL30.exe 4364 y44vk06.exe 4288 legenda.exe 1508 1millRDX.exe 4140 Sprawl.exe 1220 Sprawl.exe 2852 Sprawl.exe 3848 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4100 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz6653.exev4213JI.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz6653.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v4213JI.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v4213JI.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exezap6304.exezap0363.exezap4341.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap6304.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap6304.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap0363.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap0363.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap4341.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap4341.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Sprawl.exedescription pid process target process PID 4140 set thread context of 2852 4140 Sprawl.exe Sprawl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 2260 1896 WerFault.exe v4213JI.exe 4672 3812 WerFault.exe w79WY82.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
tz6653.exev4213JI.exew79WY82.exexqseL30.exe1millRDX.exeSprawl.exepid process 3920 tz6653.exe 3920 tz6653.exe 1896 v4213JI.exe 1896 v4213JI.exe 3812 w79WY82.exe 3812 w79WY82.exe 3904 xqseL30.exe 3904 xqseL30.exe 1508 1millRDX.exe 1508 1millRDX.exe 2852 Sprawl.exe 2852 Sprawl.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
tz6653.exev4213JI.exew79WY82.exexqseL30.exe1millRDX.exeSprawl.exedescription pid process Token: SeDebugPrivilege 3920 tz6653.exe Token: SeDebugPrivilege 1896 v4213JI.exe Token: SeDebugPrivilege 3812 w79WY82.exe Token: SeDebugPrivilege 3904 xqseL30.exe Token: SeDebugPrivilege 1508 1millRDX.exe Token: SeDebugPrivilege 2852 Sprawl.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exezap6304.exezap0363.exezap4341.exey44vk06.exelegenda.execmd.exeSprawl.exedescription pid process target process PID 4384 wrote to memory of 2000 4384 b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exe zap6304.exe PID 4384 wrote to memory of 2000 4384 b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exe zap6304.exe PID 4384 wrote to memory of 2000 4384 b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exe zap6304.exe PID 2000 wrote to memory of 1316 2000 zap6304.exe zap0363.exe PID 2000 wrote to memory of 1316 2000 zap6304.exe zap0363.exe PID 2000 wrote to memory of 1316 2000 zap6304.exe zap0363.exe PID 1316 wrote to memory of 2956 1316 zap0363.exe zap4341.exe PID 1316 wrote to memory of 2956 1316 zap0363.exe zap4341.exe PID 1316 wrote to memory of 2956 1316 zap0363.exe zap4341.exe PID 2956 wrote to memory of 3920 2956 zap4341.exe tz6653.exe PID 2956 wrote to memory of 3920 2956 zap4341.exe tz6653.exe PID 2956 wrote to memory of 1896 2956 zap4341.exe v4213JI.exe PID 2956 wrote to memory of 1896 2956 zap4341.exe v4213JI.exe PID 2956 wrote to memory of 1896 2956 zap4341.exe v4213JI.exe PID 1316 wrote to memory of 3812 1316 zap0363.exe w79WY82.exe PID 1316 wrote to memory of 3812 1316 zap0363.exe w79WY82.exe PID 1316 wrote to memory of 3812 1316 zap0363.exe w79WY82.exe PID 2000 wrote to memory of 3904 2000 zap6304.exe xqseL30.exe PID 2000 wrote to memory of 3904 2000 zap6304.exe xqseL30.exe PID 2000 wrote to memory of 3904 2000 zap6304.exe xqseL30.exe PID 4384 wrote to memory of 4364 4384 b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exe y44vk06.exe PID 4384 wrote to memory of 4364 4384 b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exe y44vk06.exe PID 4384 wrote to memory of 4364 4384 b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exe y44vk06.exe PID 4364 wrote to memory of 4288 4364 y44vk06.exe legenda.exe PID 4364 wrote to memory of 4288 4364 y44vk06.exe legenda.exe PID 4364 wrote to memory of 4288 4364 y44vk06.exe legenda.exe PID 4288 wrote to memory of 3936 4288 legenda.exe schtasks.exe PID 4288 wrote to memory of 3936 4288 legenda.exe schtasks.exe PID 4288 wrote to memory of 3936 4288 legenda.exe schtasks.exe PID 4288 wrote to memory of 4516 4288 legenda.exe cmd.exe PID 4288 wrote to memory of 4516 4288 legenda.exe cmd.exe PID 4288 wrote to memory of 4516 4288 legenda.exe cmd.exe PID 4516 wrote to memory of 4600 4516 cmd.exe cmd.exe PID 4516 wrote to memory of 4600 4516 cmd.exe cmd.exe PID 4516 wrote to memory of 4600 4516 cmd.exe cmd.exe PID 4516 wrote to memory of 4608 4516 cmd.exe cacls.exe PID 4516 wrote to memory of 4608 4516 cmd.exe cacls.exe PID 4516 wrote to memory of 4608 4516 cmd.exe cacls.exe PID 4516 wrote to memory of 4296 4516 cmd.exe cacls.exe PID 4516 wrote to memory of 4296 4516 cmd.exe cacls.exe PID 4516 wrote to memory of 4296 4516 cmd.exe cacls.exe PID 4516 wrote to memory of 3388 4516 cmd.exe cmd.exe PID 4516 wrote to memory of 3388 4516 cmd.exe cmd.exe PID 4516 wrote to memory of 3388 4516 cmd.exe cmd.exe PID 4516 wrote to memory of 3416 4516 cmd.exe cacls.exe PID 4516 wrote to memory of 3416 4516 cmd.exe cacls.exe PID 4516 wrote to memory of 3416 4516 cmd.exe cacls.exe PID 4516 wrote to memory of 3400 4516 cmd.exe cacls.exe PID 4516 wrote to memory of 3400 4516 cmd.exe cacls.exe PID 4516 wrote to memory of 3400 4516 cmd.exe cacls.exe PID 4288 wrote to memory of 1508 4288 legenda.exe 1millRDX.exe PID 4288 wrote to memory of 1508 4288 legenda.exe 1millRDX.exe PID 4288 wrote to memory of 1508 4288 legenda.exe 1millRDX.exe PID 4288 wrote to memory of 4140 4288 legenda.exe Sprawl.exe PID 4288 wrote to memory of 4140 4288 legenda.exe Sprawl.exe PID 4288 wrote to memory of 4140 4288 legenda.exe Sprawl.exe PID 4140 wrote to memory of 1220 4140 Sprawl.exe Sprawl.exe PID 4140 wrote to memory of 1220 4140 Sprawl.exe Sprawl.exe PID 4140 wrote to memory of 1220 4140 Sprawl.exe Sprawl.exe PID 4140 wrote to memory of 1220 4140 Sprawl.exe Sprawl.exe PID 4140 wrote to memory of 2852 4140 Sprawl.exe Sprawl.exe PID 4140 wrote to memory of 2852 4140 Sprawl.exe Sprawl.exe PID 4140 wrote to memory of 2852 4140 Sprawl.exe Sprawl.exe PID 4140 wrote to memory of 2852 4140 Sprawl.exe Sprawl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exe"C:\Users\Admin\AppData\Local\Temp\b70843ff6bbb601813269fb98b144745526ce26fe7f6127998a390aa122c54d0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6304.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6304.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0363.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0363.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4341.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4341.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6653.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6653.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4213JI.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4213JI.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 10886⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w79WY82.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w79WY82.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 13365⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqseL30.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqseL30.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y44vk06.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y44vk06.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000161001\1millRDX.exe"C:\Users\Admin\AppData\Local\Temp\1000161001\1millRDX.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe"C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exeC:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exeC:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1896 -ip 18961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3812 -ip 38121⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Sprawl.exe.logFilesize
1KB
MD5a3c82409506a33dec1856104ca55cbfd
SHA12e2ba4e4227590f8821002831c5410f7f45fe812
SHA256780a0d4410f5f9798cb573bcd774561d1439987a39b1368d3c890226928cd203
SHA5129621cfd3dab86d964a2bea6b3788fc19a895307962dcc41428741b8a86291f114df722e9017f755f63d53d09b5111e68f05aa505d9c9deae6c4378a87cdfa69f
-
C:\Users\Admin\AppData\Local\Temp\1000161001\1millRDX.exeFilesize
175KB
MD5f197d1eb5c9a1f9e586e2438529067b6
SHA1143d53443170406749b1a56eab31cfd532105677
SHA2563a65f720bc48f5ea51dd7c073961f71332cf864ec6ae1e3469a1a284dfaabdd8
SHA512d20a7f47d033257751134687f0e0da3864864e0adb6575115e827c22d5b0a5f454023607dd5b0b37f1133715e3fae20e1bd60dca8d596d9763b4def339d5f4fb
-
C:\Users\Admin\AppData\Local\Temp\1000161001\1millRDX.exeFilesize
175KB
MD5f197d1eb5c9a1f9e586e2438529067b6
SHA1143d53443170406749b1a56eab31cfd532105677
SHA2563a65f720bc48f5ea51dd7c073961f71332cf864ec6ae1e3469a1a284dfaabdd8
SHA512d20a7f47d033257751134687f0e0da3864864e0adb6575115e827c22d5b0a5f454023607dd5b0b37f1133715e3fae20e1bd60dca8d596d9763b4def339d5f4fb
-
C:\Users\Admin\AppData\Local\Temp\1000161001\1millRDX.exeFilesize
175KB
MD5f197d1eb5c9a1f9e586e2438529067b6
SHA1143d53443170406749b1a56eab31cfd532105677
SHA2563a65f720bc48f5ea51dd7c073961f71332cf864ec6ae1e3469a1a284dfaabdd8
SHA512d20a7f47d033257751134687f0e0da3864864e0adb6575115e827c22d5b0a5f454023607dd5b0b37f1133715e3fae20e1bd60dca8d596d9763b4def339d5f4fb
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exeFilesize
895KB
MD57f9cc3889e95b39a93593207cc823dd2
SHA1553b922ae2d755e012792ab495c879f63ab3b923
SHA256d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5
SHA5125a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exeFilesize
895KB
MD57f9cc3889e95b39a93593207cc823dd2
SHA1553b922ae2d755e012792ab495c879f63ab3b923
SHA256d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5
SHA5125a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exeFilesize
895KB
MD57f9cc3889e95b39a93593207cc823dd2
SHA1553b922ae2d755e012792ab495c879f63ab3b923
SHA256d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5
SHA5125a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exeFilesize
895KB
MD57f9cc3889e95b39a93593207cc823dd2
SHA1553b922ae2d755e012792ab495c879f63ab3b923
SHA256d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5
SHA5125a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951
-
C:\Users\Admin\AppData\Local\Temp\1000164001\Sprawl.exeFilesize
895KB
MD57f9cc3889e95b39a93593207cc823dd2
SHA1553b922ae2d755e012792ab495c879f63ab3b923
SHA256d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5
SHA5125a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y44vk06.exeFilesize
235KB
MD5aeba5f9a60cec4ca1c9a32aaa1650bca
SHA1d523bc190a515bcd77cb84d3265eb18adca982f1
SHA256bfe8ece2426db438eb5912e36d53ef8e59cdca27414d93054117fa9b5942fd1b
SHA512f9a1b29d8dc8e6ae1d39a3cfa017eb27eea4ff17597f21c2cc2a3951466e065e8bec48c88525824fc413598a5b9abdc7afb6a80686c7ef5e4669063d0d2e0e5a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y44vk06.exeFilesize
235KB
MD5aeba5f9a60cec4ca1c9a32aaa1650bca
SHA1d523bc190a515bcd77cb84d3265eb18adca982f1
SHA256bfe8ece2426db438eb5912e36d53ef8e59cdca27414d93054117fa9b5942fd1b
SHA512f9a1b29d8dc8e6ae1d39a3cfa017eb27eea4ff17597f21c2cc2a3951466e065e8bec48c88525824fc413598a5b9abdc7afb6a80686c7ef5e4669063d0d2e0e5a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6304.exeFilesize
855KB
MD5b9f959178817e5f142e6c5a4c67fcb01
SHA1df2fa53cfdbf78cdf9ec090661db75330099a808
SHA2567dff4214cab90927848d5325683f35d258d31d7d57181d72b8ce43209bc4e9b2
SHA512c3904b8aa2f17bed7677bd363a55540bd71d7979d1c0cf7806b8b84f8499b8617d123a49332def0893adbab0c3c34650e279c1216c6cefcac18731a7fa032dbd
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap6304.exeFilesize
855KB
MD5b9f959178817e5f142e6c5a4c67fcb01
SHA1df2fa53cfdbf78cdf9ec090661db75330099a808
SHA2567dff4214cab90927848d5325683f35d258d31d7d57181d72b8ce43209bc4e9b2
SHA512c3904b8aa2f17bed7677bd363a55540bd71d7979d1c0cf7806b8b84f8499b8617d123a49332def0893adbab0c3c34650e279c1216c6cefcac18731a7fa032dbd
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqseL30.exeFilesize
175KB
MD5d2f203076e19ff4b1c36617f22d2144e
SHA15282fd839fc9ab7b1bb7977d7a1e1bffdd20d2fc
SHA25626434766a5a27f77e642680b4848bb85b953466f3b01d51602501ad2af1dfa9d
SHA512e66097135817c139615bae7126c15be484c4330c343737a64a56dd81408c3901e0e64cf684743bbabf73ca480a33ebc3acba8144d9cc4c48329f47536ddadaef
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqseL30.exeFilesize
175KB
MD5d2f203076e19ff4b1c36617f22d2144e
SHA15282fd839fc9ab7b1bb7977d7a1e1bffdd20d2fc
SHA25626434766a5a27f77e642680b4848bb85b953466f3b01d51602501ad2af1dfa9d
SHA512e66097135817c139615bae7126c15be484c4330c343737a64a56dd81408c3901e0e64cf684743bbabf73ca480a33ebc3acba8144d9cc4c48329f47536ddadaef
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0363.exeFilesize
713KB
MD5cea027176fde5c7a02e1abec14e63e07
SHA1644ab3ab8a9cd72d1c9afb6e532d1eecaac883df
SHA256abe18568d6494e673130a54c3a90f69a282d4b19ea3f4100787c47693cf12707
SHA5123bf0224d92f150ca8f2ff3002a769822f085f2a4614195f9654b8bd90d0f35c6aa9cbef7822ac6c5377b9e06517696142fb3a661b150390a7c431163c449bb75
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0363.exeFilesize
713KB
MD5cea027176fde5c7a02e1abec14e63e07
SHA1644ab3ab8a9cd72d1c9afb6e532d1eecaac883df
SHA256abe18568d6494e673130a54c3a90f69a282d4b19ea3f4100787c47693cf12707
SHA5123bf0224d92f150ca8f2ff3002a769822f085f2a4614195f9654b8bd90d0f35c6aa9cbef7822ac6c5377b9e06517696142fb3a661b150390a7c431163c449bb75
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w79WY82.exeFilesize
383KB
MD5afc544bf1f9c579279f30e1a31a41514
SHA1f73b5c6bcd46c97ebb5a74f0d69ea18d28d0a601
SHA256026e23678c68896c4d21f88cd2076868007c90dc4bfa3f2a0445ec7d5f293ed1
SHA51251dd2b17edfa236658d7eca87f632da41a67aaf5db67f65c052f7f74a1320835bc2d32f662064ab6a18615a5eafc6b864b23d168bb3e77b89dac4ab0d9734e66
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w79WY82.exeFilesize
383KB
MD5afc544bf1f9c579279f30e1a31a41514
SHA1f73b5c6bcd46c97ebb5a74f0d69ea18d28d0a601
SHA256026e23678c68896c4d21f88cd2076868007c90dc4bfa3f2a0445ec7d5f293ed1
SHA51251dd2b17edfa236658d7eca87f632da41a67aaf5db67f65c052f7f74a1320835bc2d32f662064ab6a18615a5eafc6b864b23d168bb3e77b89dac4ab0d9734e66
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4341.exeFilesize
353KB
MD583d18205867ce0c3e2ef8c2b3e4f464e
SHA10d14478c735554a917faea7321da24f0cda58b9e
SHA256c37466981174d9688d8a099a8ca52578ba2766deebac2239ce34f8da50754fe4
SHA51290363ea23ac2432605cfde98aba289e2426cdc5ee731ee5dd909501061e384b0a6abc092c70a1062248b131666be3d287c13729cef8cc250dd95cd60f4c7c5e2
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap4341.exeFilesize
353KB
MD583d18205867ce0c3e2ef8c2b3e4f464e
SHA10d14478c735554a917faea7321da24f0cda58b9e
SHA256c37466981174d9688d8a099a8ca52578ba2766deebac2239ce34f8da50754fe4
SHA51290363ea23ac2432605cfde98aba289e2426cdc5ee731ee5dd909501061e384b0a6abc092c70a1062248b131666be3d287c13729cef8cc250dd95cd60f4c7c5e2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6653.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz6653.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4213JI.exeFilesize
325KB
MD5c9be35c1834032915ae4b64ae7222a20
SHA1d21d5dca362be28601644f5a7a0bb5a16157bc46
SHA25611da3c81cd4ec113d25f3002088b14010f854d010c72aaf1d4b3a259a98d460c
SHA5125a339edd2c8242a986778dab49f00b6dd1c9307823a26a79d4cca6330cec56d2f39cebebacbcf356ec4ebd7416385f9772c20e32048fe465835cf215151b9512
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v4213JI.exeFilesize
325KB
MD5c9be35c1834032915ae4b64ae7222a20
SHA1d21d5dca362be28601644f5a7a0bb5a16157bc46
SHA25611da3c81cd4ec113d25f3002088b14010f854d010c72aaf1d4b3a259a98d460c
SHA5125a339edd2c8242a986778dab49f00b6dd1c9307823a26a79d4cca6330cec56d2f39cebebacbcf356ec4ebd7416385f9772c20e32048fe465835cf215151b9512
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD5aeba5f9a60cec4ca1c9a32aaa1650bca
SHA1d523bc190a515bcd77cb84d3265eb18adca982f1
SHA256bfe8ece2426db438eb5912e36d53ef8e59cdca27414d93054117fa9b5942fd1b
SHA512f9a1b29d8dc8e6ae1d39a3cfa017eb27eea4ff17597f21c2cc2a3951466e065e8bec48c88525824fc413598a5b9abdc7afb6a80686c7ef5e4669063d0d2e0e5a
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD5aeba5f9a60cec4ca1c9a32aaa1650bca
SHA1d523bc190a515bcd77cb84d3265eb18adca982f1
SHA256bfe8ece2426db438eb5912e36d53ef8e59cdca27414d93054117fa9b5942fd1b
SHA512f9a1b29d8dc8e6ae1d39a3cfa017eb27eea4ff17597f21c2cc2a3951466e065e8bec48c88525824fc413598a5b9abdc7afb6a80686c7ef5e4669063d0d2e0e5a
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD5aeba5f9a60cec4ca1c9a32aaa1650bca
SHA1d523bc190a515bcd77cb84d3265eb18adca982f1
SHA256bfe8ece2426db438eb5912e36d53ef8e59cdca27414d93054117fa9b5942fd1b
SHA512f9a1b29d8dc8e6ae1d39a3cfa017eb27eea4ff17597f21c2cc2a3951466e065e8bec48c88525824fc413598a5b9abdc7afb6a80686c7ef5e4669063d0d2e0e5a
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD5aeba5f9a60cec4ca1c9a32aaa1650bca
SHA1d523bc190a515bcd77cb84d3265eb18adca982f1
SHA256bfe8ece2426db438eb5912e36d53ef8e59cdca27414d93054117fa9b5942fd1b
SHA512f9a1b29d8dc8e6ae1d39a3cfa017eb27eea4ff17597f21c2cc2a3951466e065e8bec48c88525824fc413598a5b9abdc7afb6a80686c7ef5e4669063d0d2e0e5a
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
memory/1508-1176-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/1508-1175-0x00000000000E0000-0x0000000000112000-memory.dmpFilesize
200KB
-
memory/1896-171-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/1896-179-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-203-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/1896-202-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/1896-201-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/1896-200-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/1896-199-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-167-0x0000000002B80000-0x0000000002BAD000-memory.dmpFilesize
180KB
-
memory/1896-168-0x0000000007300000-0x00000000078A4000-memory.dmpFilesize
5.6MB
-
memory/1896-197-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-169-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/1896-195-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-193-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-191-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-189-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-187-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-185-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-183-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-181-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-205-0x0000000000400000-0x0000000002B7E000-memory.dmpFilesize
39.5MB
-
memory/1896-177-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-175-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-173-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-172-0x0000000004F10000-0x0000000004F22000-memory.dmpFilesize
72KB
-
memory/1896-170-0x0000000004970000-0x0000000004980000-memory.dmpFilesize
64KB
-
memory/2852-1204-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/2852-1205-0x0000000005480000-0x0000000005490000-memory.dmpFilesize
64KB
-
memory/2852-1207-0x0000000005480000-0x0000000005490000-memory.dmpFilesize
64KB
-
memory/3812-241-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-321-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/3812-1126-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/3812-1127-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/3812-1128-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/3812-1129-0x00000000083C0000-0x0000000008452000-memory.dmpFilesize
584KB
-
memory/3812-1130-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/3812-1131-0x0000000008DD0000-0x0000000008E46000-memory.dmpFilesize
472KB
-
memory/3812-1132-0x0000000008E50000-0x0000000008EA0000-memory.dmpFilesize
320KB
-
memory/3812-1133-0x0000000008EE0000-0x00000000090A2000-memory.dmpFilesize
1.8MB
-
memory/3812-1134-0x00000000092B0000-0x00000000097DC000-memory.dmpFilesize
5.2MB
-
memory/3812-1136-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/3812-1123-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/3812-1122-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/3812-210-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-211-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-1121-0x0000000007F70000-0x000000000807A000-memory.dmpFilesize
1.0MB
-
memory/3812-1120-0x00000000078D0000-0x0000000007EE8000-memory.dmpFilesize
6.1MB
-
memory/3812-319-0x0000000002C70000-0x0000000002CBB000-memory.dmpFilesize
300KB
-
memory/3812-324-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/3812-323-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/3812-1124-0x00000000071D0000-0x00000000071E0000-memory.dmpFilesize
64KB
-
memory/3812-219-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-221-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-237-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-243-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-239-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-213-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-223-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-235-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-215-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-225-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-227-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-233-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-231-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-229-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3812-217-0x0000000007130000-0x000000000716F000-memory.dmpFilesize
252KB
-
memory/3904-1142-0x0000000004EF0000-0x0000000004F00000-memory.dmpFilesize
64KB
-
memory/3904-1141-0x0000000000370000-0x00000000003A2000-memory.dmpFilesize
200KB
-
memory/3920-161-0x0000000000490000-0x000000000049A000-memory.dmpFilesize
40KB
-
memory/4140-1197-0x00000000058B0000-0x00000000058C0000-memory.dmpFilesize
64KB
-
memory/4140-1196-0x0000000000F90000-0x0000000001076000-memory.dmpFilesize
920KB