Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2023 17:26
Static task
static1
General
-
Target
e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exe
-
Size
1.1MB
-
MD5
62ad7b05bb28e7ccded3c9ddc896e874
-
SHA1
e95f4a8ca7a568ff59ba8b7df222d5be6651a720
-
SHA256
e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671
-
SHA512
e2391285dfdd1e473708c7f725c3869885fb2bd32f3603ac3152a98812f89788221e6d33344a9e2b306826107a376b8aa89e7fb8ed840955d2206aeca7780807
-
SSDEEP
24576:gyAwt7vnXUJPWRGGCVb6ZKyrIWglmF5qlF8+2Fvg:nAwFnXUtWRE6IZmWL8X
Malware Config
Extracted
redline
larry
185.161.248.75:4132
-
auth_value
9039557bb7a08f5f2f60e2b71e1dee0e
Extracted
redline
warum
185.161.248.75:4132
-
auth_value
0bdb2dda91dadc65f555dee088a6a2a4
Signatures
-
Processes:
o9169877.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection o9169877.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" o9169877.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" o9169877.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" o9169877.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" o9169877.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" o9169877.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
WSHRAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\lRDdN.vbs family_wshrat C:\Users\Admin\lRDdN.vbs family_wshrat -
Blocklisted process makes network request 8 IoCs
Processes:
wscript.exewscript.exeWScript.exeflow pid process 39 4052 wscript.exe 40 4052 wscript.exe 42 3452 wscript.exe 43 3452 wscript.exe 45 4472 WScript.exe 54 4472 WScript.exe 57 4472 WScript.exe 60 4472 WScript.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 5 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
s5954861.exelegends.exewindows.exewscript.exewscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation s5954861.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation legends.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation windows.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation wscript.exe -
Executes dropped EXE 16 IoCs
Processes:
z1875686.exez0369206.exeo9169877.exep9997885.exer5291345.exer5291345.exer5291345.exes5954861.exes5954861.exelegends.exelegends.exewindows.exelegends.exelegends.exelegends.exelegends.exepid process 4692 z1875686.exe 1268 z0369206.exe 2140 o9169877.exe 2160 p9997885.exe 5076 r5291345.exe 1532 r5291345.exe 4956 r5291345.exe 4804 s5954861.exe 2456 s5954861.exe 1956 legends.exe 4272 legends.exe 1972 windows.exe 2900 legends.exe 4612 legends.exe 464 legends.exe 4924 legends.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4460 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
o9169877.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features o9169877.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" o9169877.exe -
Adds Run key to start application 2 TTPs 16 IoCs
Processes:
z0369206.exewscript.exewscript.exez1875686.exeWScript.exee4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z0369206.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\software\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\software\microsoft\windows\currentversion\run wscript.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z1875686.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BXBCC2V24Z = "\"C:\\Users\\Admin\\AppData\\Roaming\\windows.js\"" WScript.exe Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\windows\currentversion\run wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z1875686.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce z0369206.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows\CurrentVersion\Run WScript.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lRDdN = "wscript.exe //B \"C:\\Users\\Admin\\lRDdN.vbs\"" wscript.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 5 IoCs
Processes:
r5291345.exes5954861.exelegends.exelegends.exelegends.exedescription pid process target process PID 5076 set thread context of 4956 5076 r5291345.exe r5291345.exe PID 4804 set thread context of 2456 4804 s5954861.exe s5954861.exe PID 1956 set thread context of 4272 1956 legends.exe legends.exe PID 2900 set thread context of 4612 2900 legends.exe legends.exe PID 464 set thread context of 4924 464 legends.exe legends.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 1 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000_Classes\Local Settings wscript.exe -
Script User-Agent 4 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 39 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 40 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 42 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 43 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
o9169877.exep9997885.exer5291345.exepid process 2140 o9169877.exe 2140 o9169877.exe 2160 p9997885.exe 2160 p9997885.exe 4956 r5291345.exe 4956 r5291345.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
o9169877.exep9997885.exer5291345.exes5954861.exelegends.exer5291345.exelegends.exelegends.exedescription pid process Token: SeDebugPrivilege 2140 o9169877.exe Token: SeDebugPrivilege 2160 p9997885.exe Token: SeDebugPrivilege 5076 r5291345.exe Token: SeDebugPrivilege 4804 s5954861.exe Token: SeDebugPrivilege 1956 legends.exe Token: SeDebugPrivilege 4956 r5291345.exe Token: SeDebugPrivilege 2900 legends.exe Token: SeDebugPrivilege 464 legends.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
s5954861.exepid process 2456 s5954861.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exez1875686.exez0369206.exer5291345.exes5954861.exes5954861.exelegends.exelegends.execmd.exedescription pid process target process PID 560 wrote to memory of 4692 560 e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exe z1875686.exe PID 560 wrote to memory of 4692 560 e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exe z1875686.exe PID 560 wrote to memory of 4692 560 e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exe z1875686.exe PID 4692 wrote to memory of 1268 4692 z1875686.exe z0369206.exe PID 4692 wrote to memory of 1268 4692 z1875686.exe z0369206.exe PID 4692 wrote to memory of 1268 4692 z1875686.exe z0369206.exe PID 1268 wrote to memory of 2140 1268 z0369206.exe o9169877.exe PID 1268 wrote to memory of 2140 1268 z0369206.exe o9169877.exe PID 1268 wrote to memory of 2140 1268 z0369206.exe o9169877.exe PID 1268 wrote to memory of 2160 1268 z0369206.exe p9997885.exe PID 1268 wrote to memory of 2160 1268 z0369206.exe p9997885.exe PID 1268 wrote to memory of 2160 1268 z0369206.exe p9997885.exe PID 4692 wrote to memory of 5076 4692 z1875686.exe r5291345.exe PID 4692 wrote to memory of 5076 4692 z1875686.exe r5291345.exe PID 4692 wrote to memory of 5076 4692 z1875686.exe r5291345.exe PID 5076 wrote to memory of 1532 5076 r5291345.exe r5291345.exe PID 5076 wrote to memory of 1532 5076 r5291345.exe r5291345.exe PID 5076 wrote to memory of 1532 5076 r5291345.exe r5291345.exe PID 5076 wrote to memory of 1532 5076 r5291345.exe r5291345.exe PID 5076 wrote to memory of 4956 5076 r5291345.exe r5291345.exe PID 5076 wrote to memory of 4956 5076 r5291345.exe r5291345.exe PID 5076 wrote to memory of 4956 5076 r5291345.exe r5291345.exe PID 5076 wrote to memory of 4956 5076 r5291345.exe r5291345.exe PID 5076 wrote to memory of 4956 5076 r5291345.exe r5291345.exe PID 5076 wrote to memory of 4956 5076 r5291345.exe r5291345.exe PID 5076 wrote to memory of 4956 5076 r5291345.exe r5291345.exe PID 5076 wrote to memory of 4956 5076 r5291345.exe r5291345.exe PID 560 wrote to memory of 4804 560 e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exe s5954861.exe PID 560 wrote to memory of 4804 560 e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exe s5954861.exe PID 560 wrote to memory of 4804 560 e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exe s5954861.exe PID 4804 wrote to memory of 2456 4804 s5954861.exe s5954861.exe PID 4804 wrote to memory of 2456 4804 s5954861.exe s5954861.exe PID 4804 wrote to memory of 2456 4804 s5954861.exe s5954861.exe PID 4804 wrote to memory of 2456 4804 s5954861.exe s5954861.exe PID 4804 wrote to memory of 2456 4804 s5954861.exe s5954861.exe PID 4804 wrote to memory of 2456 4804 s5954861.exe s5954861.exe PID 4804 wrote to memory of 2456 4804 s5954861.exe s5954861.exe PID 4804 wrote to memory of 2456 4804 s5954861.exe s5954861.exe PID 4804 wrote to memory of 2456 4804 s5954861.exe s5954861.exe PID 4804 wrote to memory of 2456 4804 s5954861.exe s5954861.exe PID 2456 wrote to memory of 1956 2456 s5954861.exe legends.exe PID 2456 wrote to memory of 1956 2456 s5954861.exe legends.exe PID 2456 wrote to memory of 1956 2456 s5954861.exe legends.exe PID 1956 wrote to memory of 4272 1956 legends.exe legends.exe PID 1956 wrote to memory of 4272 1956 legends.exe legends.exe PID 1956 wrote to memory of 4272 1956 legends.exe legends.exe PID 1956 wrote to memory of 4272 1956 legends.exe legends.exe PID 1956 wrote to memory of 4272 1956 legends.exe legends.exe PID 1956 wrote to memory of 4272 1956 legends.exe legends.exe PID 1956 wrote to memory of 4272 1956 legends.exe legends.exe PID 1956 wrote to memory of 4272 1956 legends.exe legends.exe PID 1956 wrote to memory of 4272 1956 legends.exe legends.exe PID 1956 wrote to memory of 4272 1956 legends.exe legends.exe PID 4272 wrote to memory of 840 4272 legends.exe schtasks.exe PID 4272 wrote to memory of 840 4272 legends.exe schtasks.exe PID 4272 wrote to memory of 840 4272 legends.exe schtasks.exe PID 4272 wrote to memory of 5032 4272 legends.exe cmd.exe PID 4272 wrote to memory of 5032 4272 legends.exe cmd.exe PID 4272 wrote to memory of 5032 4272 legends.exe cmd.exe PID 5032 wrote to memory of 2172 5032 cmd.exe cmd.exe PID 5032 wrote to memory of 2172 5032 cmd.exe cmd.exe PID 5032 wrote to memory of 2172 5032 cmd.exe cmd.exe PID 5032 wrote to memory of 1004 5032 cmd.exe cacls.exe PID 5032 wrote to memory of 1004 5032 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exe"C:\Users\Admin\AppData\Local\Temp\e4734927ff18085f3258504413e625eb64f2ed10cfbc14ca05a7edfed5e85671.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1875686.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1875686.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0369206.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0369206.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o9169877.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o9169877.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9997885.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9997885.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5291345.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5291345.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5291345.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5291345.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5291345.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5291345.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5954861.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5954861.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5954861.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5954861.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legends.exe /TR "C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legends.exe" /P "Admin:N"&&CACLS "legends.exe" /P "Admin:R" /E&&echo Y|CACLS "..\41bde21dc7" /P "Admin:N"&&CACLS "..\41bde21dc7" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legends.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\41bde21dc7" /P "Admin:R" /E7⤵
-
C:\Users\Admin\AppData\Local\Temp\1000013001\windows.exe"C:\Users\Admin\AppData\Local\Temp\1000013001\windows.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\lRDdN.vbs"7⤵
- Blocklisted process makes network request
- Checks computer location settings
- Adds Run key to start application
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\lRDdN.vbs"8⤵
- Blocklisted process makes network request
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\windows.js"9⤵
- Blocklisted process makes network request
- Adds Run key to start application
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeC:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\legends.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\r5291345.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Temp\1000013001\windows.exeFilesize
541KB
MD5c159fc653a86ef3eab80e5d06b9cfa2c
SHA1f95b35bcd8528dafda2b8fd53bed2bab150676e3
SHA256b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b
SHA51278ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2
-
C:\Users\Admin\AppData\Local\Temp\1000013001\windows.exeFilesize
541KB
MD5c159fc653a86ef3eab80e5d06b9cfa2c
SHA1f95b35bcd8528dafda2b8fd53bed2bab150676e3
SHA256b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b
SHA51278ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2
-
C:\Users\Admin\AppData\Local\Temp\1000013001\windows.exeFilesize
541KB
MD5c159fc653a86ef3eab80e5d06b9cfa2c
SHA1f95b35bcd8528dafda2b8fd53bed2bab150676e3
SHA256b6e0c17a224fe0df6f58add122e0420aad76a697c1d7634aa0cfe2f5dc84dc2b
SHA51278ee8d1c957f21e6023f4c9096f63c9bc697620cfc7584bb937b4cffb792f312c8fd0cb586c0aa4f43ddf8e622042f2c85852f10018e0c5799d6dd02903ab9f2
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
962KB
MD54a6e5203569fcf0aa61436770d45b644
SHA1fdaa9c5c10854fd5716473e0b1f261e3463e3784
SHA256174f13a3533ec1c384077edfb63ba167e19f0c435937e93fd0ea57f2f0101f55
SHA5123466075731f97edb3ae8297a7320616409771c75adaebd264b8b78a371da358cb775a079775bf9154d2a3fbd948b6048f83ac9d1d60414dd3ea0f08445a1011a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
962KB
MD54a6e5203569fcf0aa61436770d45b644
SHA1fdaa9c5c10854fd5716473e0b1f261e3463e3784
SHA256174f13a3533ec1c384077edfb63ba167e19f0c435937e93fd0ea57f2f0101f55
SHA5123466075731f97edb3ae8297a7320616409771c75adaebd264b8b78a371da358cb775a079775bf9154d2a3fbd948b6048f83ac9d1d60414dd3ea0f08445a1011a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
962KB
MD54a6e5203569fcf0aa61436770d45b644
SHA1fdaa9c5c10854fd5716473e0b1f261e3463e3784
SHA256174f13a3533ec1c384077edfb63ba167e19f0c435937e93fd0ea57f2f0101f55
SHA5123466075731f97edb3ae8297a7320616409771c75adaebd264b8b78a371da358cb775a079775bf9154d2a3fbd948b6048f83ac9d1d60414dd3ea0f08445a1011a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
962KB
MD54a6e5203569fcf0aa61436770d45b644
SHA1fdaa9c5c10854fd5716473e0b1f261e3463e3784
SHA256174f13a3533ec1c384077edfb63ba167e19f0c435937e93fd0ea57f2f0101f55
SHA5123466075731f97edb3ae8297a7320616409771c75adaebd264b8b78a371da358cb775a079775bf9154d2a3fbd948b6048f83ac9d1d60414dd3ea0f08445a1011a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
962KB
MD54a6e5203569fcf0aa61436770d45b644
SHA1fdaa9c5c10854fd5716473e0b1f261e3463e3784
SHA256174f13a3533ec1c384077edfb63ba167e19f0c435937e93fd0ea57f2f0101f55
SHA5123466075731f97edb3ae8297a7320616409771c75adaebd264b8b78a371da358cb775a079775bf9154d2a3fbd948b6048f83ac9d1d60414dd3ea0f08445a1011a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
962KB
MD54a6e5203569fcf0aa61436770d45b644
SHA1fdaa9c5c10854fd5716473e0b1f261e3463e3784
SHA256174f13a3533ec1c384077edfb63ba167e19f0c435937e93fd0ea57f2f0101f55
SHA5123466075731f97edb3ae8297a7320616409771c75adaebd264b8b78a371da358cb775a079775bf9154d2a3fbd948b6048f83ac9d1d60414dd3ea0f08445a1011a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
962KB
MD54a6e5203569fcf0aa61436770d45b644
SHA1fdaa9c5c10854fd5716473e0b1f261e3463e3784
SHA256174f13a3533ec1c384077edfb63ba167e19f0c435937e93fd0ea57f2f0101f55
SHA5123466075731f97edb3ae8297a7320616409771c75adaebd264b8b78a371da358cb775a079775bf9154d2a3fbd948b6048f83ac9d1d60414dd3ea0f08445a1011a
-
C:\Users\Admin\AppData\Local\Temp\41bde21dc7\legends.exeFilesize
962KB
MD54a6e5203569fcf0aa61436770d45b644
SHA1fdaa9c5c10854fd5716473e0b1f261e3463e3784
SHA256174f13a3533ec1c384077edfb63ba167e19f0c435937e93fd0ea57f2f0101f55
SHA5123466075731f97edb3ae8297a7320616409771c75adaebd264b8b78a371da358cb775a079775bf9154d2a3fbd948b6048f83ac9d1d60414dd3ea0f08445a1011a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5954861.exeFilesize
962KB
MD54a6e5203569fcf0aa61436770d45b644
SHA1fdaa9c5c10854fd5716473e0b1f261e3463e3784
SHA256174f13a3533ec1c384077edfb63ba167e19f0c435937e93fd0ea57f2f0101f55
SHA5123466075731f97edb3ae8297a7320616409771c75adaebd264b8b78a371da358cb775a079775bf9154d2a3fbd948b6048f83ac9d1d60414dd3ea0f08445a1011a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5954861.exeFilesize
962KB
MD54a6e5203569fcf0aa61436770d45b644
SHA1fdaa9c5c10854fd5716473e0b1f261e3463e3784
SHA256174f13a3533ec1c384077edfb63ba167e19f0c435937e93fd0ea57f2f0101f55
SHA5123466075731f97edb3ae8297a7320616409771c75adaebd264b8b78a371da358cb775a079775bf9154d2a3fbd948b6048f83ac9d1d60414dd3ea0f08445a1011a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\s5954861.exeFilesize
962KB
MD54a6e5203569fcf0aa61436770d45b644
SHA1fdaa9c5c10854fd5716473e0b1f261e3463e3784
SHA256174f13a3533ec1c384077edfb63ba167e19f0c435937e93fd0ea57f2f0101f55
SHA5123466075731f97edb3ae8297a7320616409771c75adaebd264b8b78a371da358cb775a079775bf9154d2a3fbd948b6048f83ac9d1d60414dd3ea0f08445a1011a
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1875686.exeFilesize
701KB
MD5665193ffd11428639d6f2d5ed7b8c65b
SHA16cb3f4608fd44aeb3a762161cbb0903b9891b83a
SHA256ef0bbf2b764c9f46b0e80c19fb0b17bbd4e495c9e9ca640f03dd8efbda0e4a1a
SHA51275e0b94cb24f386ee487ac0c8e161332f870af6218cd5ace027d7add3f2114d7ff837ad3ecb56da9170abfb18429bd382e51342a9e4669b4268838ac3ff5e431
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1875686.exeFilesize
701KB
MD5665193ffd11428639d6f2d5ed7b8c65b
SHA16cb3f4608fd44aeb3a762161cbb0903b9891b83a
SHA256ef0bbf2b764c9f46b0e80c19fb0b17bbd4e495c9e9ca640f03dd8efbda0e4a1a
SHA51275e0b94cb24f386ee487ac0c8e161332f870af6218cd5ace027d7add3f2114d7ff837ad3ecb56da9170abfb18429bd382e51342a9e4669b4268838ac3ff5e431
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5291345.exeFilesize
903KB
MD532a4a3815a9ddbc3c12b64f1d128b8a9
SHA173877adc14558117d42c4134f31d8e0b5eebbc00
SHA2561c0ada6aed92afdc40d268ebccb12a0ca433a479626f6cb1131fd0a3ddc37c55
SHA512d17fe305e4a845f237422fbea19b17b42e67ad90c246fa0a1abb0441c2e453b4a827df8fdc16aa22cd565f4a4c0f630b5de129f56c79a8a3a097bc3063662b8a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5291345.exeFilesize
903KB
MD532a4a3815a9ddbc3c12b64f1d128b8a9
SHA173877adc14558117d42c4134f31d8e0b5eebbc00
SHA2561c0ada6aed92afdc40d268ebccb12a0ca433a479626f6cb1131fd0a3ddc37c55
SHA512d17fe305e4a845f237422fbea19b17b42e67ad90c246fa0a1abb0441c2e453b4a827df8fdc16aa22cd565f4a4c0f630b5de129f56c79a8a3a097bc3063662b8a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5291345.exeFilesize
903KB
MD532a4a3815a9ddbc3c12b64f1d128b8a9
SHA173877adc14558117d42c4134f31d8e0b5eebbc00
SHA2561c0ada6aed92afdc40d268ebccb12a0ca433a479626f6cb1131fd0a3ddc37c55
SHA512d17fe305e4a845f237422fbea19b17b42e67ad90c246fa0a1abb0441c2e453b4a827df8fdc16aa22cd565f4a4c0f630b5de129f56c79a8a3a097bc3063662b8a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\r5291345.exeFilesize
903KB
MD532a4a3815a9ddbc3c12b64f1d128b8a9
SHA173877adc14558117d42c4134f31d8e0b5eebbc00
SHA2561c0ada6aed92afdc40d268ebccb12a0ca433a479626f6cb1131fd0a3ddc37c55
SHA512d17fe305e4a845f237422fbea19b17b42e67ad90c246fa0a1abb0441c2e453b4a827df8fdc16aa22cd565f4a4c0f630b5de129f56c79a8a3a097bc3063662b8a
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0369206.exeFilesize
305KB
MD50f7e7c23bfb538b2b2edba6ba51ac27a
SHA1309d4a9f60ba938221ee789e01ccd2f417a7036b
SHA256677affdab79d34f65f9da88aa75392f5497e2376e88514b353b986b0720274c5
SHA512427dfc8431900a9f9639e65b593fd950e43689c1275a2691c9deae91b899da9b20987261ae5e5daa1899932692cc89ce9b19ee21ee989de61f6e436fa233b4cf
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0369206.exeFilesize
305KB
MD50f7e7c23bfb538b2b2edba6ba51ac27a
SHA1309d4a9f60ba938221ee789e01ccd2f417a7036b
SHA256677affdab79d34f65f9da88aa75392f5497e2376e88514b353b986b0720274c5
SHA512427dfc8431900a9f9639e65b593fd950e43689c1275a2691c9deae91b899da9b20987261ae5e5daa1899932692cc89ce9b19ee21ee989de61f6e436fa233b4cf
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o9169877.exeFilesize
184KB
MD5086d420106201720de9b354b6f987561
SHA161a29a2a98d96dfc49b8a251b0d84d23616046b6
SHA2568c73873e5c8a3dfd26c809a6632131d87d949bb46cbff893319c87349abacd29
SHA51238823e298d43fb91edae562e67a45fb6134fe027f285cbfad67e5ff30da061be0a37a51b43010f19fc9ba012f7f1bf161a4a48f7566ccb7515b4ce3dfe53d84f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\o9169877.exeFilesize
184KB
MD5086d420106201720de9b354b6f987561
SHA161a29a2a98d96dfc49b8a251b0d84d23616046b6
SHA2568c73873e5c8a3dfd26c809a6632131d87d949bb46cbff893319c87349abacd29
SHA51238823e298d43fb91edae562e67a45fb6134fe027f285cbfad67e5ff30da061be0a37a51b43010f19fc9ba012f7f1bf161a4a48f7566ccb7515b4ce3dfe53d84f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9997885.exeFilesize
145KB
MD54fe2fe7fa4dcdfe8006a26b581fbb51a
SHA1c5df222e0a4cbdbcad2d3650431e9310a226fa38
SHA2564667dae01a8b710c1e84d1717ed700623670d8cf351ff79686caf0048900de14
SHA512c431c83cf13ef98976fb0dead4fdd03d4263885ed76913f3d52ea2a02d42bd3a487a2d056329b8f8f647d787f55810fc9a7e0e23d8c3daaa9c9b02c7a23dd8b6
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\p9997885.exeFilesize
145KB
MD54fe2fe7fa4dcdfe8006a26b581fbb51a
SHA1c5df222e0a4cbdbcad2d3650431e9310a226fa38
SHA2564667dae01a8b710c1e84d1717ed700623670d8cf351ff79686caf0048900de14
SHA512c431c83cf13ef98976fb0dead4fdd03d4263885ed76913f3d52ea2a02d42bd3a487a2d056329b8f8f647d787f55810fc9a7e0e23d8c3daaa9c9b02c7a23dd8b6
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD573c0c85e39b9a63b42f6c4ff6d634f8b
SHA1efb047b4177ad78268f6fc8bf959f58f1123eb51
SHA256477252e3531300fe2a21a679fba3664803179e91a1a4d5dd44080dbd41126368
SHA512ca32507717c2c099d54a5473fb062083237f7fda9c076e9a957b70072f41a78eedf9244b50862b81d00374297e3795021ad6db943c8408da50b1da8b5ed4a643
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
C:\Users\Admin\AppData\Roaming\lRDdN.vbsFilesize
185KB
MD543fca5129026c9b6b49ce26c27759df2
SHA146a4acdd5faae42e04ba753f69e6e777324ae8e9
SHA256a6772f8687d81d92138a6cfa10ead2b3c409a0884053a1600c640ae65eea517e
SHA512c465b24ebba4ce399e7e8605b8b93993e92916b653c42c470e9168a8a9573bfc42bb1dc730674e1fc7656453820fc3a19240514c1bd2b8acf32d87ffa09cf228
-
C:\Users\Admin\lRDdN.vbsFilesize
185KB
MD543fca5129026c9b6b49ce26c27759df2
SHA146a4acdd5faae42e04ba753f69e6e777324ae8e9
SHA256a6772f8687d81d92138a6cfa10ead2b3c409a0884053a1600c640ae65eea517e
SHA512c465b24ebba4ce399e7e8605b8b93993e92916b653c42c470e9168a8a9573bfc42bb1dc730674e1fc7656453820fc3a19240514c1bd2b8acf32d87ffa09cf228
-
C:\Users\Admin\windows.jsFilesize
3KB
MD514d1d9d3dc5e8d0eac04d5b78645a2ea
SHA1aa14b5a613919e41c4d97fef48ff1a24ff06fd2b
SHA25692d5609974d3d52dc028185e819111679f0ff052c1e3b951e2eee9b18e361f36
SHA512e13cc2ca8b4dc4564a2176e4bc06d2a3271a957918cb84589402462ea2fe33782eb92ab1575187ab07ac3e270e8301607bff6b7ccb1dd688666be940716f092c
-
memory/1956-241-0x0000000007B20000-0x0000000007B30000-memory.dmpFilesize
64KB
-
memory/1972-273-0x0000000000C90000-0x0000000000CA0000-memory.dmpFilesize
64KB
-
memory/2140-184-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/2140-162-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-168-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-166-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-170-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-154-0x0000000004B40000-0x00000000050E4000-memory.dmpFilesize
5.6MB
-
memory/2140-155-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-164-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-156-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-183-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/2140-185-0x0000000004B30000-0x0000000004B40000-memory.dmpFilesize
64KB
-
memory/2140-158-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-180-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-178-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-160-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-182-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-176-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-174-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2140-172-0x0000000004AA0000-0x0000000004AB6000-memory.dmpFilesize
88KB
-
memory/2160-196-0x0000000004F70000-0x0000000004FD6000-memory.dmpFilesize
408KB
-
memory/2160-192-0x0000000004CC0000-0x0000000004DCA000-memory.dmpFilesize
1.0MB
-
memory/2160-194-0x0000000004C50000-0x0000000004C8C000-memory.dmpFilesize
240KB
-
memory/2160-191-0x0000000005190000-0x00000000057A8000-memory.dmpFilesize
6.1MB
-
memory/2160-190-0x0000000000220000-0x000000000024A000-memory.dmpFilesize
168KB
-
memory/2160-195-0x0000000004EF0000-0x0000000004F00000-memory.dmpFilesize
64KB
-
memory/2160-193-0x0000000004BF0000-0x0000000004C02000-memory.dmpFilesize
72KB
-
memory/2160-197-0x0000000005B50000-0x0000000005BE2000-memory.dmpFilesize
584KB
-
memory/2160-198-0x0000000005DC0000-0x0000000005F82000-memory.dmpFilesize
1.8MB
-
memory/2160-199-0x0000000006B40000-0x000000000706C000-memory.dmpFilesize
5.2MB
-
memory/2160-201-0x0000000006010000-0x0000000006060000-memory.dmpFilesize
320KB
-
memory/2160-200-0x0000000005F90000-0x0000000006006000-memory.dmpFilesize
472KB
-
memory/2160-202-0x0000000004EF0000-0x0000000004F00000-memory.dmpFilesize
64KB
-
memory/2456-224-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2456-240-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2456-229-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2456-223-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2456-220-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/2900-287-0x0000000007DB0000-0x0000000007DC0000-memory.dmpFilesize
64KB
-
memory/4272-248-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4272-271-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4272-261-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4272-310-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4272-249-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4272-246-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4272-245-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4612-292-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4612-291-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4612-290-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4804-219-0x0000000007140000-0x0000000007150000-memory.dmpFilesize
64KB
-
memory/4804-217-0x0000000000260000-0x0000000000356000-memory.dmpFilesize
984KB
-
memory/4924-316-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4924-317-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4924-318-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/4956-218-0x0000000005670000-0x0000000005680000-memory.dmpFilesize
64KB
-
memory/4956-251-0x0000000005670000-0x0000000005680000-memory.dmpFilesize
64KB
-
memory/4956-210-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/5076-208-0x00000000075A0000-0x00000000075B0000-memory.dmpFilesize
64KB
-
memory/5076-207-0x00000000006B0000-0x0000000000798000-memory.dmpFilesize
928KB