Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
24-03-2023 14:29
Static task
static1
General
-
Target
3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exe
-
Size
1008KB
-
MD5
e5e55a8118a4372ce0b49bfde5573b78
-
SHA1
3395e08ad643c702fd51b9ff8ada6f3a3286d1dc
-
SHA256
3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2
-
SHA512
ebfb08524d69502aba37f985c6661fc6e6318e3608e554522260512ece7ba880d76c99a8c56d0a71f309e3782d078f0354c51c6f5751ec2e7e68a013bee8d14c
-
SSDEEP
12288:2Mrsy90PsdxaX2VhlbpAsIlMl+NxsG6Efv2PN94XPmDLbuWl9zLJOX2oAv4Tllyw:Gymkg2hXA1Ml+NGG6EfYMwLhLJ4vr
Malware Config
Extracted
redline
boris
193.233.20.32:4125
-
auth_value
766b5bdf6dbefcf7ca223351952fc38f
Extracted
redline
lida
193.233.20.32:4125
-
auth_value
24052aa2e9b85984a98d80cf08623e8d
Extracted
amadey
3.68
62.204.41.87/joomla/index.php
Extracted
redline
Anh123
199.115.193.116:11300
-
auth_value
db990971ec3911c24ea05eeccc2e1f60
Signatures
-
Processes:
v5884Jr.exetz0831.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" v5884Jr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" v5884Jr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection tz0831.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" tz0831.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" tz0831.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" tz0831.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" v5884Jr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" tz0831.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" tz0831.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection v5884Jr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" v5884Jr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" v5884Jr.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 18 IoCs
Processes:
resource yara_rule behavioral1/memory/3492-210-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-209-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-212-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-214-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-216-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-220-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-224-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-226-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-228-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-230-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-232-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-234-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-236-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-238-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-240-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-242-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-244-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline behavioral1/memory/3492-246-0x00000000071B0000-0x00000000071EF000-memory.dmp family_redline -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
y44hl43.exelegenda.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation y44hl43.exe Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation legenda.exe -
Executes dropped EXE 13 IoCs
Processes:
zap4720.exezap0522.exezap8317.exetz0831.exev5884Jr.exew61bc33.exexqCIv54.exey44hl43.exelegenda.exeNasalized.exeNasalized.exeNasalized.exelegenda.exepid process 1932 zap4720.exe 696 zap0522.exe 3100 zap8317.exe 4972 tz0831.exe 1816 v5884Jr.exe 3492 w61bc33.exe 1184 xqCIv54.exe 4088 y44hl43.exe 4448 legenda.exe 4712 Nasalized.exe 5024 Nasalized.exe 3892 Nasalized.exe 5048 legenda.exe -
Loads dropped DLL 1 IoCs
Processes:
rundll32.exepid process 4252 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
tz0831.exev5884Jr.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" tz0831.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features v5884Jr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" v5884Jr.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exezap4720.exezap0522.exezap8317.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap4720.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" zap4720.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap0522.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" zap0522.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce zap8317.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" zap8317.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Nasalized.exedescription pid process target process PID 4712 set thread context of 3892 4712 Nasalized.exe Nasalized.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 2 IoCs
Processes:
WerFault.exeWerFault.exepid pid_target process target process 4152 1816 WerFault.exe v5884Jr.exe 4684 3492 WerFault.exe w61bc33.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
tz0831.exev5884Jr.exew61bc33.exexqCIv54.exepid process 4972 tz0831.exe 4972 tz0831.exe 1816 v5884Jr.exe 1816 v5884Jr.exe 3492 w61bc33.exe 3492 w61bc33.exe 1184 xqCIv54.exe 1184 xqCIv54.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
tz0831.exev5884Jr.exew61bc33.exexqCIv54.exedescription pid process Token: SeDebugPrivilege 4972 tz0831.exe Token: SeDebugPrivilege 1816 v5884Jr.exe Token: SeDebugPrivilege 3492 w61bc33.exe Token: SeDebugPrivilege 1184 xqCIv54.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exezap4720.exezap0522.exezap8317.exey44hl43.exelegenda.execmd.exeNasalized.exedescription pid process target process PID 2400 wrote to memory of 1932 2400 3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exe zap4720.exe PID 2400 wrote to memory of 1932 2400 3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exe zap4720.exe PID 2400 wrote to memory of 1932 2400 3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exe zap4720.exe PID 1932 wrote to memory of 696 1932 zap4720.exe zap0522.exe PID 1932 wrote to memory of 696 1932 zap4720.exe zap0522.exe PID 1932 wrote to memory of 696 1932 zap4720.exe zap0522.exe PID 696 wrote to memory of 3100 696 zap0522.exe zap8317.exe PID 696 wrote to memory of 3100 696 zap0522.exe zap8317.exe PID 696 wrote to memory of 3100 696 zap0522.exe zap8317.exe PID 3100 wrote to memory of 4972 3100 zap8317.exe tz0831.exe PID 3100 wrote to memory of 4972 3100 zap8317.exe tz0831.exe PID 3100 wrote to memory of 1816 3100 zap8317.exe v5884Jr.exe PID 3100 wrote to memory of 1816 3100 zap8317.exe v5884Jr.exe PID 3100 wrote to memory of 1816 3100 zap8317.exe v5884Jr.exe PID 696 wrote to memory of 3492 696 zap0522.exe w61bc33.exe PID 696 wrote to memory of 3492 696 zap0522.exe w61bc33.exe PID 696 wrote to memory of 3492 696 zap0522.exe w61bc33.exe PID 1932 wrote to memory of 1184 1932 zap4720.exe xqCIv54.exe PID 1932 wrote to memory of 1184 1932 zap4720.exe xqCIv54.exe PID 1932 wrote to memory of 1184 1932 zap4720.exe xqCIv54.exe PID 2400 wrote to memory of 4088 2400 3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exe y44hl43.exe PID 2400 wrote to memory of 4088 2400 3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exe y44hl43.exe PID 2400 wrote to memory of 4088 2400 3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exe y44hl43.exe PID 4088 wrote to memory of 4448 4088 y44hl43.exe legenda.exe PID 4088 wrote to memory of 4448 4088 y44hl43.exe legenda.exe PID 4088 wrote to memory of 4448 4088 y44hl43.exe legenda.exe PID 4448 wrote to memory of 4276 4448 legenda.exe schtasks.exe PID 4448 wrote to memory of 4276 4448 legenda.exe schtasks.exe PID 4448 wrote to memory of 4276 4448 legenda.exe schtasks.exe PID 4448 wrote to memory of 2664 4448 legenda.exe cmd.exe PID 4448 wrote to memory of 2664 4448 legenda.exe cmd.exe PID 4448 wrote to memory of 2664 4448 legenda.exe cmd.exe PID 2664 wrote to memory of 4948 2664 cmd.exe cmd.exe PID 2664 wrote to memory of 4948 2664 cmd.exe cmd.exe PID 2664 wrote to memory of 4948 2664 cmd.exe cmd.exe PID 2664 wrote to memory of 4636 2664 cmd.exe cacls.exe PID 2664 wrote to memory of 4636 2664 cmd.exe cacls.exe PID 2664 wrote to memory of 4636 2664 cmd.exe cacls.exe PID 2664 wrote to memory of 3724 2664 cmd.exe cacls.exe PID 2664 wrote to memory of 3724 2664 cmd.exe cacls.exe PID 2664 wrote to memory of 3724 2664 cmd.exe cacls.exe PID 2664 wrote to memory of 3912 2664 cmd.exe cmd.exe PID 2664 wrote to memory of 3912 2664 cmd.exe cmd.exe PID 2664 wrote to memory of 3912 2664 cmd.exe cmd.exe PID 2664 wrote to memory of 4432 2664 cmd.exe cacls.exe PID 2664 wrote to memory of 4432 2664 cmd.exe cacls.exe PID 2664 wrote to memory of 4432 2664 cmd.exe cacls.exe PID 2664 wrote to memory of 3444 2664 cmd.exe cacls.exe PID 2664 wrote to memory of 3444 2664 cmd.exe cacls.exe PID 2664 wrote to memory of 3444 2664 cmd.exe cacls.exe PID 4448 wrote to memory of 4712 4448 legenda.exe Nasalized.exe PID 4448 wrote to memory of 4712 4448 legenda.exe Nasalized.exe PID 4448 wrote to memory of 4712 4448 legenda.exe Nasalized.exe PID 4712 wrote to memory of 5024 4712 Nasalized.exe Nasalized.exe PID 4712 wrote to memory of 5024 4712 Nasalized.exe Nasalized.exe PID 4712 wrote to memory of 5024 4712 Nasalized.exe Nasalized.exe PID 4712 wrote to memory of 5024 4712 Nasalized.exe Nasalized.exe PID 4712 wrote to memory of 3892 4712 Nasalized.exe Nasalized.exe PID 4712 wrote to memory of 3892 4712 Nasalized.exe Nasalized.exe PID 4712 wrote to memory of 3892 4712 Nasalized.exe Nasalized.exe PID 4712 wrote to memory of 3892 4712 Nasalized.exe Nasalized.exe PID 4712 wrote to memory of 3892 4712 Nasalized.exe Nasalized.exe PID 4712 wrote to memory of 3892 4712 Nasalized.exe Nasalized.exe PID 4712 wrote to memory of 3892 4712 Nasalized.exe Nasalized.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exe"C:\Users\Admin\AppData\Local\Temp\3d4e73538fe0af0540e167674d16d9bf83256c224fc4890b02ffc952db5b2de2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4720.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4720.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0522.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0522.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8317.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8317.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0831.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0831.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5884Jr.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5884Jr.exe5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1816 -s 10366⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w61bc33.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w61bc33.exe4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3492 -s 18325⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqCIv54.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqCIv54.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y44hl43.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y44hl43.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legenda.exe" /P "Admin:R" /E5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:N"5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\f22b669919" /P "Admin:R" /E5⤵
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exe"C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeC:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exe5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeC:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exe5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main4⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1816 -ip 18161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3492 -ip 34921⤵
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeC:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Nasalized.exe.logFilesize
1KB
MD599f88b99e0d77c5607bb7826596c5340
SHA14d2902c0c3a8c134139e9e85f4ca557750c7b21a
SHA256baa2292d20266e157ecc8340d1c201b82dcce67629a1c95ec27fea646624c56d
SHA512ff3ee0ad2a99c952f3fb709f9c3159138d66abb16f022e8f62f717c2edf621f43967fc3d7418b3bdd78b1399567fcc899c1e38aaf44abf97032d2c696b928a60
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeFilesize
898KB
MD54c42520a02966a874eb4fbdc0a74e208
SHA18c17320204683ca1dcf81c0a031a6e6c0d679d84
SHA2560c71cf525042e6cd8d338248d66081495cbf35be2f28d515965fa15f1ad7432d
SHA512c9891c1a8428ba8ece0880c725a8fbbc0a77573f3460c35eeb7385c6993712fd35143b9662599d09f25af36f30ff856b32ae085161b1baa431aa428ecd5ea512
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeFilesize
898KB
MD54c42520a02966a874eb4fbdc0a74e208
SHA18c17320204683ca1dcf81c0a031a6e6c0d679d84
SHA2560c71cf525042e6cd8d338248d66081495cbf35be2f28d515965fa15f1ad7432d
SHA512c9891c1a8428ba8ece0880c725a8fbbc0a77573f3460c35eeb7385c6993712fd35143b9662599d09f25af36f30ff856b32ae085161b1baa431aa428ecd5ea512
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeFilesize
898KB
MD54c42520a02966a874eb4fbdc0a74e208
SHA18c17320204683ca1dcf81c0a031a6e6c0d679d84
SHA2560c71cf525042e6cd8d338248d66081495cbf35be2f28d515965fa15f1ad7432d
SHA512c9891c1a8428ba8ece0880c725a8fbbc0a77573f3460c35eeb7385c6993712fd35143b9662599d09f25af36f30ff856b32ae085161b1baa431aa428ecd5ea512
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeFilesize
898KB
MD54c42520a02966a874eb4fbdc0a74e208
SHA18c17320204683ca1dcf81c0a031a6e6c0d679d84
SHA2560c71cf525042e6cd8d338248d66081495cbf35be2f28d515965fa15f1ad7432d
SHA512c9891c1a8428ba8ece0880c725a8fbbc0a77573f3460c35eeb7385c6993712fd35143b9662599d09f25af36f30ff856b32ae085161b1baa431aa428ecd5ea512
-
C:\Users\Admin\AppData\Local\Temp\1000155001\Nasalized.exeFilesize
898KB
MD54c42520a02966a874eb4fbdc0a74e208
SHA18c17320204683ca1dcf81c0a031a6e6c0d679d84
SHA2560c71cf525042e6cd8d338248d66081495cbf35be2f28d515965fa15f1ad7432d
SHA512c9891c1a8428ba8ece0880c725a8fbbc0a77573f3460c35eeb7385c6993712fd35143b9662599d09f25af36f30ff856b32ae085161b1baa431aa428ecd5ea512
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y44hl43.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y44hl43.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4720.exeFilesize
830KB
MD5fe2035934c36204bcf1caa2968e4a92e
SHA1788fa969f01c73684eef9d56e4534015eb1644a7
SHA2564f9e923990103e0f48c783d1a4819045de57843495934114c3d948464037e73d
SHA512fc000837f6753834142234e61b9c3815d6f65eda754350341467ac30c4e876ac37181f86e7b86a368ac7c07b44ca1e333d66ab84b18bee37f54ad0b8faace381
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap4720.exeFilesize
830KB
MD5fe2035934c36204bcf1caa2968e4a92e
SHA1788fa969f01c73684eef9d56e4534015eb1644a7
SHA2564f9e923990103e0f48c783d1a4819045de57843495934114c3d948464037e73d
SHA512fc000837f6753834142234e61b9c3815d6f65eda754350341467ac30c4e876ac37181f86e7b86a368ac7c07b44ca1e333d66ab84b18bee37f54ad0b8faace381
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqCIv54.exeFilesize
175KB
MD56b06147bf5fd26306978a93fe83127a4
SHA17b14ff42f4441b985591ef5b7d4cc703f0bbcdfa
SHA25611e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0
SHA512603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xqCIv54.exeFilesize
175KB
MD56b06147bf5fd26306978a93fe83127a4
SHA17b14ff42f4441b985591ef5b7d4cc703f0bbcdfa
SHA25611e6d45ae92fc4505f14f550d01d97a42fba91a999b900daf843251772c755e0
SHA512603007d99e52da5739040fee891c193123dc5741985de1c3dde091dd07e759336ec749312e4ab95d05c1c6681f10e56b4e9aee67d633a97b6aa25c5119f4d6b4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0522.exeFilesize
688KB
MD58239ba0b88761c0be332e3282520669d
SHA13b7c72cee1c065b3958e66fac9ff919cf0c7e235
SHA256e4114fd6e690f8276cd8fc881f6afe33581e56573862308e48baf38f49c1e772
SHA512b914f49a0606a15b61c074df99eeeac8c46f41c9d2b0cefd39ccf962a7049183476bcc83cb3967c07ed4d5e75e2e89e5fdada256663de88dfdb88f9c5616d5e6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap0522.exeFilesize
688KB
MD58239ba0b88761c0be332e3282520669d
SHA13b7c72cee1c065b3958e66fac9ff919cf0c7e235
SHA256e4114fd6e690f8276cd8fc881f6afe33581e56573862308e48baf38f49c1e772
SHA512b914f49a0606a15b61c074df99eeeac8c46f41c9d2b0cefd39ccf962a7049183476bcc83cb3967c07ed4d5e75e2e89e5fdada256663de88dfdb88f9c5616d5e6
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w61bc33.exeFilesize
357KB
MD571eeed7c557f2316845de7a61cf71a36
SHA1fe00e952b8dfb23bf815869f32ffc3e83ab7fd2d
SHA256b2caa3d0bb39d6dd397f5ae33cb0cbd7a89b812cca835dc940fe0c4c1e215f0e
SHA512cf6fff164536d872a83f15ab1f2e2efd25520d60a6ebd63d03f1ca6ae497f94634f28919c20d6241b5b2eab357daeae0a95a3c825c91a06868557f758fbc93d5
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w61bc33.exeFilesize
357KB
MD571eeed7c557f2316845de7a61cf71a36
SHA1fe00e952b8dfb23bf815869f32ffc3e83ab7fd2d
SHA256b2caa3d0bb39d6dd397f5ae33cb0cbd7a89b812cca835dc940fe0c4c1e215f0e
SHA512cf6fff164536d872a83f15ab1f2e2efd25520d60a6ebd63d03f1ca6ae497f94634f28919c20d6241b5b2eab357daeae0a95a3c825c91a06868557f758fbc93d5
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8317.exeFilesize
340KB
MD55808a593d66b8ef07d9d58e45b6116a6
SHA115710b5b2f86f8a48ae564c2ca6907cc2fc6c885
SHA25638205d72b554df54738d8e5669dd6bbb2272affc4496b8d3efc17c68c1e0e675
SHA512d0ca67134316e68e4713af8b77bc31f92b04d7d735f0038f5db9fb0793ec392e0f1ae8ef59a18a97af272518709015f0e25612fc58468c71323c76ec8cfcd3b1
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8317.exeFilesize
340KB
MD55808a593d66b8ef07d9d58e45b6116a6
SHA115710b5b2f86f8a48ae564c2ca6907cc2fc6c885
SHA25638205d72b554df54738d8e5669dd6bbb2272affc4496b8d3efc17c68c1e0e675
SHA512d0ca67134316e68e4713af8b77bc31f92b04d7d735f0038f5db9fb0793ec392e0f1ae8ef59a18a97af272518709015f0e25612fc58468c71323c76ec8cfcd3b1
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0831.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz0831.exeFilesize
11KB
MD57e93bacbbc33e6652e147e7fe07572a0
SHA1421a7167da01c8da4dc4d5234ca3dd84e319e762
SHA256850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38
SHA512250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5884Jr.exeFilesize
298KB
MD53899c765415501eedc1f5f43f07ae247
SHA1100e396f1f32700c4438510fad61b7105d0bdefe
SHA256e25eb7103c5d40a1d5d814f9a65aecdc94c57d50053baf092d40ccd195b36f7b
SHA5129fe597b7df02817290cc5f066203e91682a15aeac8c94aac25760268b32daa6ad130f0be7f3fa5923e3ec62f0c8c02a2172a6878e72594a368c82f0f2f07afcb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v5884Jr.exeFilesize
298KB
MD53899c765415501eedc1f5f43f07ae247
SHA1100e396f1f32700c4438510fad61b7105d0bdefe
SHA256e25eb7103c5d40a1d5d814f9a65aecdc94c57d50053baf092d40ccd195b36f7b
SHA5129fe597b7df02817290cc5f066203e91682a15aeac8c94aac25760268b32daa6ad130f0be7f3fa5923e3ec62f0c8c02a2172a6878e72594a368c82f0f2f07afcb
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exeFilesize
235KB
MD55086db99de54fca268169a1c6cf26122
SHA1003f768ffcc99bda5cda1fb966fda8625a8fdc3e
SHA25642873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4
SHA51290531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD516cf28ebb6d37dbaba93f18320c6086e
SHA1eae7d4b7a9636329065877aabe8d4f721a26ab25
SHA256c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106
SHA512f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
223B
MD594cbeec5d4343918fd0e48760e40539c
SHA1a049266c5c1131f692f306c8710d7e72586ae79d
SHA25648eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279
SHA5124e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0
-
memory/1184-1142-0x0000000005240000-0x0000000005250000-memory.dmpFilesize
64KB
-
memory/1184-1141-0x0000000000670000-0x00000000006A2000-memory.dmpFilesize
200KB
-
memory/1816-167-0x0000000002C50000-0x0000000002C7D000-memory.dmpFilesize
180KB
-
memory/1816-199-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-200-0x0000000000400000-0x0000000002B79000-memory.dmpFilesize
39.5MB
-
memory/1816-201-0x0000000007370000-0x0000000007380000-memory.dmpFilesize
64KB
-
memory/1816-202-0x0000000007370000-0x0000000007380000-memory.dmpFilesize
64KB
-
memory/1816-204-0x0000000000400000-0x0000000002B79000-memory.dmpFilesize
39.5MB
-
memory/1816-197-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-195-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-193-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-191-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-189-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-187-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-185-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-183-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-181-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-179-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-177-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-175-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-173-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-172-0x0000000004C90000-0x0000000004CA2000-memory.dmpFilesize
72KB
-
memory/1816-171-0x0000000007380000-0x0000000007924000-memory.dmpFilesize
5.6MB
-
memory/1816-170-0x0000000007370000-0x0000000007380000-memory.dmpFilesize
64KB
-
memory/1816-169-0x0000000007370000-0x0000000007380000-memory.dmpFilesize
64KB
-
memory/1816-168-0x0000000007370000-0x0000000007380000-memory.dmpFilesize
64KB
-
memory/3492-226-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-232-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-244-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-246-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-1119-0x0000000007960000-0x0000000007F78000-memory.dmpFilesize
6.1MB
-
memory/3492-1120-0x0000000007F80000-0x000000000808A000-memory.dmpFilesize
1.0MB
-
memory/3492-1121-0x00000000080B0000-0x00000000080C2000-memory.dmpFilesize
72KB
-
memory/3492-1122-0x00000000080D0000-0x000000000810C000-memory.dmpFilesize
240KB
-
memory/3492-1123-0x00000000072A0000-0x00000000072B0000-memory.dmpFilesize
64KB
-
memory/3492-1125-0x00000000072A0000-0x00000000072B0000-memory.dmpFilesize
64KB
-
memory/3492-1126-0x00000000072A0000-0x00000000072B0000-memory.dmpFilesize
64KB
-
memory/3492-1127-0x00000000072A0000-0x00000000072B0000-memory.dmpFilesize
64KB
-
memory/3492-1128-0x00000000083C0000-0x0000000008452000-memory.dmpFilesize
584KB
-
memory/3492-1129-0x0000000008460000-0x00000000084C6000-memory.dmpFilesize
408KB
-
memory/3492-1130-0x0000000008C80000-0x0000000008CF6000-memory.dmpFilesize
472KB
-
memory/3492-1131-0x0000000008D00000-0x0000000008D50000-memory.dmpFilesize
320KB
-
memory/3492-1132-0x00000000072A0000-0x00000000072B0000-memory.dmpFilesize
64KB
-
memory/3492-240-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-238-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-236-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-234-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-242-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-230-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-228-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-222-0x00000000072A0000-0x00000000072B0000-memory.dmpFilesize
64KB
-
memory/3492-224-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-220-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-1133-0x000000000A040000-0x000000000A202000-memory.dmpFilesize
1.8MB
-
memory/3492-1134-0x000000000A210000-0x000000000A73C000-memory.dmpFilesize
5.2MB
-
memory/3492-210-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-209-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-221-0x00000000072A0000-0x00000000072B0000-memory.dmpFilesize
64KB
-
memory/3492-219-0x00000000072A0000-0x00000000072B0000-memory.dmpFilesize
64KB
-
memory/3492-212-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-217-0x0000000002CA0000-0x0000000002CEB000-memory.dmpFilesize
300KB
-
memory/3492-214-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3492-216-0x00000000071B0000-0x00000000071EF000-memory.dmpFilesize
252KB
-
memory/3892-1184-0x0000000005600000-0x0000000005610000-memory.dmpFilesize
64KB
-
memory/3892-1183-0x0000000005600000-0x0000000005610000-memory.dmpFilesize
64KB
-
memory/3892-1182-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4712-1176-0x00000000057C0000-0x00000000057D0000-memory.dmpFilesize
64KB
-
memory/4712-1175-0x0000000000D10000-0x0000000000DF6000-memory.dmpFilesize
920KB
-
memory/4972-161-0x0000000000A00000-0x0000000000A0A000-memory.dmpFilesize
40KB