Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2023 01:15
Static task
static1
General
-
Target
623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exe
-
Size
1.1MB
-
MD5
2c9c1dcd97fe8377f9bb841f9de3d324
-
SHA1
72f0ace05ad54c2d1b2a4ed351eeebef84192551
-
SHA256
623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13
-
SHA512
ed22905cac4bde9521fa889e6d31d15e548d298e2a7c9f4c66ea37d7211e1a9b8d12540acf4b40ab81c2af31ef2fb959d04769f5bd769b855099ebd2d3911f83
-
SSDEEP
24576:EyLd/MAvYWbQ0iwwQHxqkSPCzcqEwWaqp6wchRQtgEoKx68K:TLdZfXSPa+5p6wchCCr
Malware Config
Extracted
redline
luka
185.161.248.75:4132
-
auth_value
44560bcd37d6bf076da309730fdb519a
Extracted
redline
terra
185.161.248.75:4132
-
auth_value
60df3f535f8aa4e264f78041983592d2
Extracted
vjw0rm
http://vj5566.duckdns.org:5566
Signatures
-
Processes:
o4587438.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" o4587438.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection o4587438.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" o4587438.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" o4587438.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" o4587438.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" o4587438.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
WSHRAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\lRDdN.vbs family_wshrat C:\Users\Admin\lRDdN.vbs family_wshrat -
Blocklisted process makes network request 5 IoCs
Processes:
wscript.exewscript.exeWScript.exeflow pid process 27 4368 wscript.exe 28 4368 wscript.exe 30 5072 wscript.exe 31 5072 wscript.exe 33 1256 WScript.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legends.exewindows.exewscript.exewscript.exes0548241.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation legends.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation windows.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation s0548241.exe -
Executes dropped EXE 16 IoCs
Processes:
z5302561.exez7011905.exeo4587438.exep5087070.exer1662265.exer1662265.exes0548241.exes0548241.exelegends.exelegends.exewindows.exelegends.exelegends.exelegends.exelegends.exelegends.exepid process 2108 z5302561.exe 3820 z7011905.exe 1056 o4587438.exe 4588 p5087070.exe 1588 r1662265.exe 4712 r1662265.exe 2660 s0548241.exe 4208 s0548241.exe 4852 legends.exe 3536 legends.exe 1304 windows.exe 3096 legends.exe 1280 legends.exe 2428 legends.exe 744 legends.exe 984 legends.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4144 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
o4587438.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features o4587438.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" o4587438.exe -
Adds Run key to start application 2 TTPs 16 IoCs
Processes:
623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exez7011905.exewscript.exewscript.exeWScript.exez5302561.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z7011905.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z7011905.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BXBCC2V24Z = "\"C:\\Users\\Admin\\AppData\\Roaming\\windows.js\"" WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z5302561.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\software\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z5302561.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 5 IoCs
Processes:
r1662265.exes0548241.exelegends.exelegends.exelegends.exedescription pid process target process PID 1588 set thread context of 4712 1588 r1662265.exe r1662265.exe PID 2660 set thread context of 4208 2660 s0548241.exe s0548241.exe PID 4852 set thread context of 3536 4852 legends.exe legends.exe PID 3096 set thread context of 2428 3096 legends.exe legends.exe PID 744 set thread context of 984 744 legends.exe legends.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5056 4588 WerFault.exe p5087070.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings wscript.exe -
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 27 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 28 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 30 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 31 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
o4587438.exer1662265.exepid process 1056 o4587438.exe 1056 o4587438.exe 4712 r1662265.exe 4712 r1662265.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
o4587438.exer1662265.exes0548241.exelegends.exer1662265.exelegends.exelegends.exedescription pid process Token: SeDebugPrivilege 1056 o4587438.exe Token: SeDebugPrivilege 1588 r1662265.exe Token: SeDebugPrivilege 2660 s0548241.exe Token: SeDebugPrivilege 4852 legends.exe Token: SeDebugPrivilege 4712 r1662265.exe Token: SeDebugPrivilege 3096 legends.exe Token: SeDebugPrivilege 744 legends.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
s0548241.exepid process 4208 s0548241.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exez5302561.exez7011905.exer1662265.exes0548241.exes0548241.exelegends.exelegends.execmd.exedescription pid process target process PID 5088 wrote to memory of 2108 5088 623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exe z5302561.exe PID 5088 wrote to memory of 2108 5088 623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exe z5302561.exe PID 5088 wrote to memory of 2108 5088 623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exe z5302561.exe PID 2108 wrote to memory of 3820 2108 z5302561.exe z7011905.exe PID 2108 wrote to memory of 3820 2108 z5302561.exe z7011905.exe PID 2108 wrote to memory of 3820 2108 z5302561.exe z7011905.exe PID 3820 wrote to memory of 1056 3820 z7011905.exe o4587438.exe PID 3820 wrote to memory of 1056 3820 z7011905.exe o4587438.exe PID 3820 wrote to memory of 1056 3820 z7011905.exe o4587438.exe PID 3820 wrote to memory of 4588 3820 z7011905.exe p5087070.exe PID 3820 wrote to memory of 4588 3820 z7011905.exe p5087070.exe PID 3820 wrote to memory of 4588 3820 z7011905.exe p5087070.exe PID 2108 wrote to memory of 1588 2108 z5302561.exe r1662265.exe PID 2108 wrote to memory of 1588 2108 z5302561.exe r1662265.exe PID 2108 wrote to memory of 1588 2108 z5302561.exe r1662265.exe PID 1588 wrote to memory of 4712 1588 r1662265.exe r1662265.exe PID 1588 wrote to memory of 4712 1588 r1662265.exe r1662265.exe PID 1588 wrote to memory of 4712 1588 r1662265.exe r1662265.exe PID 1588 wrote to memory of 4712 1588 r1662265.exe r1662265.exe PID 1588 wrote to memory of 4712 1588 r1662265.exe r1662265.exe PID 1588 wrote to memory of 4712 1588 r1662265.exe r1662265.exe PID 1588 wrote to memory of 4712 1588 r1662265.exe r1662265.exe PID 1588 wrote to memory of 4712 1588 r1662265.exe r1662265.exe PID 5088 wrote to memory of 2660 5088 623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exe s0548241.exe PID 5088 wrote to memory of 2660 5088 623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exe s0548241.exe PID 5088 wrote to memory of 2660 5088 623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exe s0548241.exe PID 2660 wrote to memory of 4208 2660 s0548241.exe s0548241.exe PID 2660 wrote to memory of 4208 2660 s0548241.exe s0548241.exe PID 2660 wrote to memory of 4208 2660 s0548241.exe s0548241.exe PID 2660 wrote to memory of 4208 2660 s0548241.exe s0548241.exe PID 2660 wrote to memory of 4208 2660 s0548241.exe s0548241.exe PID 2660 wrote to memory of 4208 2660 s0548241.exe s0548241.exe PID 2660 wrote to memory of 4208 2660 s0548241.exe s0548241.exe PID 2660 wrote to memory of 4208 2660 s0548241.exe s0548241.exe PID 2660 wrote to memory of 4208 2660 s0548241.exe s0548241.exe PID 2660 wrote to memory of 4208 2660 s0548241.exe s0548241.exe PID 4208 wrote to memory of 4852 4208 s0548241.exe legends.exe PID 4208 wrote to memory of 4852 4208 s0548241.exe legends.exe PID 4208 wrote to memory of 4852 4208 s0548241.exe legends.exe PID 4852 wrote to memory of 3536 4852 legends.exe legends.exe PID 4852 wrote to memory of 3536 4852 legends.exe legends.exe PID 4852 wrote to memory of 3536 4852 legends.exe legends.exe PID 4852 wrote to memory of 3536 4852 legends.exe legends.exe PID 4852 wrote to memory of 3536 4852 legends.exe legends.exe PID 4852 wrote to memory of 3536 4852 legends.exe legends.exe PID 4852 wrote to memory of 3536 4852 legends.exe legends.exe PID 4852 wrote to memory of 3536 4852 legends.exe legends.exe PID 4852 wrote to memory of 3536 4852 legends.exe legends.exe PID 4852 wrote to memory of 3536 4852 legends.exe legends.exe PID 3536 wrote to memory of 408 3536 legends.exe schtasks.exe PID 3536 wrote to memory of 408 3536 legends.exe schtasks.exe PID 3536 wrote to memory of 408 3536 legends.exe schtasks.exe PID 3536 wrote to memory of 2412 3536 legends.exe cmd.exe PID 3536 wrote to memory of 2412 3536 legends.exe cmd.exe PID 3536 wrote to memory of 2412 3536 legends.exe cmd.exe PID 2412 wrote to memory of 2272 2412 cmd.exe cmd.exe PID 2412 wrote to memory of 2272 2412 cmd.exe cmd.exe PID 2412 wrote to memory of 2272 2412 cmd.exe cmd.exe PID 2412 wrote to memory of 1468 2412 cmd.exe cacls.exe PID 2412 wrote to memory of 1468 2412 cmd.exe cacls.exe PID 2412 wrote to memory of 1468 2412 cmd.exe cacls.exe PID 2412 wrote to memory of 544 2412 cmd.exe cacls.exe PID 2412 wrote to memory of 544 2412 cmd.exe cacls.exe PID 2412 wrote to memory of 544 2412 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exe"C:\Users\Admin\AppData\Local\Temp\623955cd6372716d695a5f9957f84875085e5c5d011abfeb65d36b756fea3a13.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5302561.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5302561.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7011905.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7011905.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o4587438.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o4587438.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5087070.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5087070.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4588 -s 9285⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1662265.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1662265.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1662265.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1662265.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0548241.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0548241.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0548241.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0548241.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:R" /E7⤵
-
C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exe"C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\lRDdN.vbs"7⤵
- Blocklisted process makes network request
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\lRDdN.vbs"8⤵
- Blocklisted process makes network request
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\windows.js"9⤵
- Blocklisted process makes network request
- Adds Run key to start application
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4588 -ip 45881⤵
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r1662265.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exeFilesize
541KB
MD5c159fc653a86ef3eab80e5d06b9cfa2c
SHA1f95b35bcd8528dafda2b8fd53bed2bab150676e3
SHA256b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b
SHA51278ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2
-
C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exeFilesize
541KB
MD5c159fc653a86ef3eab80e5d06b9cfa2c
SHA1f95b35bcd8528dafda2b8fd53bed2bab150676e3
SHA256b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b
SHA51278ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2
-
C:\Users\Admin\AppData\Local\Temp\1000009001\windows.exeFilesize
541KB
MD5c159fc653a86ef3eab80e5d06b9cfa2c
SHA1f95b35bcd8528dafda2b8fd53bed2bab150676e3
SHA256b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b
SHA51278ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD5e62550cb5b903d8365c9804ff98c95f2
SHA194180bcf14840b1b420367b6f402fd5590f779b2
SHA2562cf153ff62aaef9b1a7e9abe2380755945f4f919a91ee6d3200999e728b72b4a
SHA512d274dc143275372b58d2c29e48ccd11afcb510ac4b5809aa4831244c2865408e761decf36308faaada5527b2161086ceb2626ad43905c46a40dd0638c39edb9c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD5e62550cb5b903d8365c9804ff98c95f2
SHA194180bcf14840b1b420367b6f402fd5590f779b2
SHA2562cf153ff62aaef9b1a7e9abe2380755945f4f919a91ee6d3200999e728b72b4a
SHA512d274dc143275372b58d2c29e48ccd11afcb510ac4b5809aa4831244c2865408e761decf36308faaada5527b2161086ceb2626ad43905c46a40dd0638c39edb9c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD5e62550cb5b903d8365c9804ff98c95f2
SHA194180bcf14840b1b420367b6f402fd5590f779b2
SHA2562cf153ff62aaef9b1a7e9abe2380755945f4f919a91ee6d3200999e728b72b4a
SHA512d274dc143275372b58d2c29e48ccd11afcb510ac4b5809aa4831244c2865408e761decf36308faaada5527b2161086ceb2626ad43905c46a40dd0638c39edb9c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD5e62550cb5b903d8365c9804ff98c95f2
SHA194180bcf14840b1b420367b6f402fd5590f779b2
SHA2562cf153ff62aaef9b1a7e9abe2380755945f4f919a91ee6d3200999e728b72b4a
SHA512d274dc143275372b58d2c29e48ccd11afcb510ac4b5809aa4831244c2865408e761decf36308faaada5527b2161086ceb2626ad43905c46a40dd0638c39edb9c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD5e62550cb5b903d8365c9804ff98c95f2
SHA194180bcf14840b1b420367b6f402fd5590f779b2
SHA2562cf153ff62aaef9b1a7e9abe2380755945f4f919a91ee6d3200999e728b72b4a
SHA512d274dc143275372b58d2c29e48ccd11afcb510ac4b5809aa4831244c2865408e761decf36308faaada5527b2161086ceb2626ad43905c46a40dd0638c39edb9c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD5e62550cb5b903d8365c9804ff98c95f2
SHA194180bcf14840b1b420367b6f402fd5590f779b2
SHA2562cf153ff62aaef9b1a7e9abe2380755945f4f919a91ee6d3200999e728b72b4a
SHA512d274dc143275372b58d2c29e48ccd11afcb510ac4b5809aa4831244c2865408e761decf36308faaada5527b2161086ceb2626ad43905c46a40dd0638c39edb9c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD5e62550cb5b903d8365c9804ff98c95f2
SHA194180bcf14840b1b420367b6f402fd5590f779b2
SHA2562cf153ff62aaef9b1a7e9abe2380755945f4f919a91ee6d3200999e728b72b4a
SHA512d274dc143275372b58d2c29e48ccd11afcb510ac4b5809aa4831244c2865408e761decf36308faaada5527b2161086ceb2626ad43905c46a40dd0638c39edb9c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD5e62550cb5b903d8365c9804ff98c95f2
SHA194180bcf14840b1b420367b6f402fd5590f779b2
SHA2562cf153ff62aaef9b1a7e9abe2380755945f4f919a91ee6d3200999e728b72b4a
SHA512d274dc143275372b58d2c29e48ccd11afcb510ac4b5809aa4831244c2865408e761decf36308faaada5527b2161086ceb2626ad43905c46a40dd0638c39edb9c
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
961KB
MD5e62550cb5b903d8365c9804ff98c95f2
SHA194180bcf14840b1b420367b6f402fd5590f779b2
SHA2562cf153ff62aaef9b1a7e9abe2380755945f4f919a91ee6d3200999e728b72b4a
SHA512d274dc143275372b58d2c29e48ccd11afcb510ac4b5809aa4831244c2865408e761decf36308faaada5527b2161086ceb2626ad43905c46a40dd0638c39edb9c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0548241.exeFilesize
961KB
MD5e62550cb5b903d8365c9804ff98c95f2
SHA194180bcf14840b1b420367b6f402fd5590f779b2
SHA2562cf153ff62aaef9b1a7e9abe2380755945f4f919a91ee6d3200999e728b72b4a
SHA512d274dc143275372b58d2c29e48ccd11afcb510ac4b5809aa4831244c2865408e761decf36308faaada5527b2161086ceb2626ad43905c46a40dd0638c39edb9c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0548241.exeFilesize
961KB
MD5e62550cb5b903d8365c9804ff98c95f2
SHA194180bcf14840b1b420367b6f402fd5590f779b2
SHA2562cf153ff62aaef9b1a7e9abe2380755945f4f919a91ee6d3200999e728b72b4a
SHA512d274dc143275372b58d2c29e48ccd11afcb510ac4b5809aa4831244c2865408e761decf36308faaada5527b2161086ceb2626ad43905c46a40dd0638c39edb9c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s0548241.exeFilesize
961KB
MD5e62550cb5b903d8365c9804ff98c95f2
SHA194180bcf14840b1b420367b6f402fd5590f779b2
SHA2562cf153ff62aaef9b1a7e9abe2380755945f4f919a91ee6d3200999e728b72b4a
SHA512d274dc143275372b58d2c29e48ccd11afcb510ac4b5809aa4831244c2865408e761decf36308faaada5527b2161086ceb2626ad43905c46a40dd0638c39edb9c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5302561.exeFilesize
702KB
MD5500a155aa80beaa3b3a46db971c4d1f5
SHA1499088e00e9cdb01d89b9e1d45590b6f82162c3e
SHA256a72d78795a7d5c271ccb80924fc20c0cfdec156247dab5701e6d24c202b97c80
SHA512e2104cff4bed1c79126a87a54871b3ed07289bd98b1e3c967dd7b5b73f98de180d890047049cfdc038ef2ce2e05047cd1cce9f265a4610918e3e6054358b767b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5302561.exeFilesize
702KB
MD5500a155aa80beaa3b3a46db971c4d1f5
SHA1499088e00e9cdb01d89b9e1d45590b6f82162c3e
SHA256a72d78795a7d5c271ccb80924fc20c0cfdec156247dab5701e6d24c202b97c80
SHA512e2104cff4bed1c79126a87a54871b3ed07289bd98b1e3c967dd7b5b73f98de180d890047049cfdc038ef2ce2e05047cd1cce9f265a4610918e3e6054358b767b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1662265.exeFilesize
904KB
MD53f12b146ecf1f84bbe6b12dc61d27200
SHA19e415077c54f78cfe9383a9162681aea0bb077c0
SHA256c771edb638331db55344bedeed91f3936c9d45dcae9c8f49dae5c56d06b99a90
SHA5120bc3a96ecc803923d8ae402860fd69dd4286c9013d1201e4b7268ccd0a1a36b5996410f415224027ab8deea36d8ba413034e52cb89b8c25ecffa36b7f46bbeb9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1662265.exeFilesize
904KB
MD53f12b146ecf1f84bbe6b12dc61d27200
SHA19e415077c54f78cfe9383a9162681aea0bb077c0
SHA256c771edb638331db55344bedeed91f3936c9d45dcae9c8f49dae5c56d06b99a90
SHA5120bc3a96ecc803923d8ae402860fd69dd4286c9013d1201e4b7268ccd0a1a36b5996410f415224027ab8deea36d8ba413034e52cb89b8c25ecffa36b7f46bbeb9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r1662265.exeFilesize
904KB
MD53f12b146ecf1f84bbe6b12dc61d27200
SHA19e415077c54f78cfe9383a9162681aea0bb077c0
SHA256c771edb638331db55344bedeed91f3936c9d45dcae9c8f49dae5c56d06b99a90
SHA5120bc3a96ecc803923d8ae402860fd69dd4286c9013d1201e4b7268ccd0a1a36b5996410f415224027ab8deea36d8ba413034e52cb89b8c25ecffa36b7f46bbeb9
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7011905.exeFilesize
306KB
MD539f941b04d00bf5c0afde01f5281cc7d
SHA1993601e8b801d5de1ccf7302769b5fa19c2f73ee
SHA256d135efa2ee8502003a27176c244c09cb5aec4beb7e47faad3bc6266f9f322792
SHA51243d241171d0c6ebe0847adc9180884736f4b789a62f5ea2bb821c5abfca04042e6b3f67b09bb5b6dafe27c16a095ecc34a5a4070d94a21d975c26edb7e79526f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7011905.exeFilesize
306KB
MD539f941b04d00bf5c0afde01f5281cc7d
SHA1993601e8b801d5de1ccf7302769b5fa19c2f73ee
SHA256d135efa2ee8502003a27176c244c09cb5aec4beb7e47faad3bc6266f9f322792
SHA51243d241171d0c6ebe0847adc9180884736f4b789a62f5ea2bb821c5abfca04042e6b3f67b09bb5b6dafe27c16a095ecc34a5a4070d94a21d975c26edb7e79526f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o4587438.exeFilesize
185KB
MD564ca871c20d6a60b73cd8edc830cfec4
SHA18f4eb9360d10c36d99b2dfae8d18f3aabe52bbfd
SHA256aeab8b138fce2af5d663d0dc72e1f845ee0939150f3de4dfbbe8f0f14603cade
SHA512809e90c419583f1f0317ad7b8d6aa087b7460c17b96a82120703732567b9e748e6bff9f553bee5ec7725a531b5598e51d5503955741b9eec215141eb423e4cdf
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o4587438.exeFilesize
185KB
MD564ca871c20d6a60b73cd8edc830cfec4
SHA18f4eb9360d10c36d99b2dfae8d18f3aabe52bbfd
SHA256aeab8b138fce2af5d663d0dc72e1f845ee0939150f3de4dfbbe8f0f14603cade
SHA512809e90c419583f1f0317ad7b8d6aa087b7460c17b96a82120703732567b9e748e6bff9f553bee5ec7725a531b5598e51d5503955741b9eec215141eb423e4cdf
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5087070.exeFilesize
145KB
MD557eb75fac240729fb4fef487b8dae9d5
SHA127868659a05ba0e899d9d583593f2e74a4c29ba3
SHA2562847d16d0794de9b0218fdfb97a09e9eba3bc7c1da7263a43291d398973da72a
SHA5122f300a6ce058af154193943ca59926de5c50daa92deda7912a5abd6ff8d98e23d5f136303eb8f210efae5e93dd62cef5e34b2da465ddcf5174f55978f1e7118a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p5087070.exeFilesize
145KB
MD557eb75fac240729fb4fef487b8dae9d5
SHA127868659a05ba0e899d9d583593f2e74a4c29ba3
SHA2562847d16d0794de9b0218fdfb97a09e9eba3bc7c1da7263a43291d398973da72a
SHA5122f300a6ce058af154193943ca59926de5c50daa92deda7912a5abd6ff8d98e23d5f136303eb8f210efae5e93dd62cef5e34b2da465ddcf5174f55978f1e7118a
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
C:\Users\Admin\AppData\Roaming\lRDdN.vbsFilesize
185KB
MD543fca5129026c9b6b49ce26c27759df2
SHA146a4acdd5faae42e04ba753f69e6e777324ae8e9
SHA256a6772f8687d81d92138a6cfa10ead2b3c409a0884053a1600c640ae65eea517e
SHA512c465b24ebba4ce399e7e8605b8b93993e92916b653c42c470e9168a8a9573bfc42bb1dc730674e1fc7656453820fc3a19240514c1bd2b8acf32d87ffa09cf228
-
C:\Users\Admin\lRDdN.vbsFilesize
185KB
MD543fca5129026c9b6b49ce26c27759df2
SHA146a4acdd5faae42e04ba753f69e6e777324ae8e9
SHA256a6772f8687d81d92138a6cfa10ead2b3c409a0884053a1600c640ae65eea517e
SHA512c465b24ebba4ce399e7e8605b8b93993e92916b653c42c470e9168a8a9573bfc42bb1dc730674e1fc7656453820fc3a19240514c1bd2b8acf32d87ffa09cf228
-
C:\Users\Admin\windows.jsFilesize
3KB
MD514d1d9d3dc5e8d0eac04d5b78645a2ea
SHA1aa14b5a613919e41c4d97fef48ff1a24ff06fd2b
SHA25692d5609974d3d52dc028185e819111679f0ff052c1e3b951e2eee9b18e361f36
SHA512e13cc2ca8b4dc4564a2176e4bc06d2a3271a957918cb84589402462ea2fe33782eb92ab1575187ab07ac3e270e8301607bff6b7ccb1dd688666be940716f092c
-
memory/984-319-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/984-318-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/984-317-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1056-184-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-174-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-154-0x0000000004A90000-0x0000000005034000-memory.dmpFilesize
5.6MB
-
memory/1056-155-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-182-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-156-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-159-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-160-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/1056-158-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/1056-162-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-164-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-166-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-186-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/1056-180-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-178-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-176-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-185-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/1056-168-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-170-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-172-0x0000000002400000-0x0000000002416000-memory.dmpFilesize
88KB
-
memory/1056-187-0x0000000002450000-0x0000000002460000-memory.dmpFilesize
64KB
-
memory/1304-273-0x0000000000A50000-0x0000000000A60000-memory.dmpFilesize
64KB
-
memory/1588-196-0x0000000000F30000-0x0000000001018000-memory.dmpFilesize
928KB
-
memory/1588-197-0x0000000007D20000-0x0000000007D30000-memory.dmpFilesize
64KB
-
memory/2428-289-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2428-290-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2428-291-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2660-205-0x0000000000BB0000-0x0000000000CA6000-memory.dmpFilesize
984KB
-
memory/2660-208-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3096-285-0x0000000007E90000-0x0000000007EA0000-memory.dmpFilesize
64KB
-
memory/3536-256-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3536-311-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3536-239-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3536-266-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3536-240-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3536-242-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/3536-243-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4208-212-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4208-215-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4208-216-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4208-218-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4208-232-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4588-192-0x00000000005D0000-0x00000000005FA000-memory.dmpFilesize
168KB
-
memory/4712-234-0x0000000005B80000-0x0000000005C12000-memory.dmpFilesize
584KB
-
memory/4712-198-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/4712-245-0x0000000006040000-0x00000000060B6000-memory.dmpFilesize
472KB
-
memory/4712-235-0x0000000005C20000-0x0000000005C86000-memory.dmpFilesize
408KB
-
memory/4712-269-0x00000000070B0000-0x00000000075DC000-memory.dmpFilesize
5.2MB
-
memory/4712-270-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/4712-257-0x00000000069B0000-0x0000000006B72000-memory.dmpFilesize
1.8MB
-
memory/4712-206-0x0000000005560000-0x0000000005B78000-memory.dmpFilesize
6.1MB
-
memory/4712-246-0x00000000060C0000-0x0000000006110000-memory.dmpFilesize
320KB
-
memory/4712-211-0x0000000005070000-0x00000000050AC000-memory.dmpFilesize
240KB
-
memory/4712-209-0x0000000005380000-0x0000000005390000-memory.dmpFilesize
64KB
-
memory/4712-210-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/4712-207-0x00000000050E0000-0x00000000051EA000-memory.dmpFilesize
1.0MB
-
memory/4852-233-0x00000000075B0000-0x00000000075C0000-memory.dmpFilesize
64KB