Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 19:22
Static task
static1
Behavioral task
behavioral1
Sample
0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exe
-
Size
1.0MB
-
MD5
a1551c35af55dc867e46cdd3460bdb6d
-
SHA1
567b931e5cc6cb02ef22b130eb5ba54a40f2c245
-
SHA256
0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e
-
SHA512
f4b588a35a6bccc6a697d7bf19a473663088c992ea317b27b88af895ef5a8f0e062426961293c7ffbc70b5ac432b6c34a7777c64b1ff10f35f3885d535d81db0
-
SSDEEP
24576:Hy4pnGm2tCRB+ui31vHrLIACSlLpVyIeWrg7vhfCF:S4pG5CvGLLB/8m04
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6037872.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6037872.exe healer behavioral2/memory/1016-35-0x0000000000300000-0x000000000030A000-memory.dmp healer -
Processes:
q6037872.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q6037872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q6037872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q6037872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q6037872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q6037872.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q6037872.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t1701789.exeexplothe.exeu1331864.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation t1701789.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation u1331864.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z7801410.exez3260939.exez5336314.exez6684804.exeq6037872.exer1012016.exes1354332.exet1701789.exeexplothe.exeu1331864.exelegota.exew0022676.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 2176 z7801410.exe 1008 z3260939.exe 4668 z5336314.exe 2812 z6684804.exe 1016 q6037872.exe 1508 r1012016.exe 4864 s1354332.exe 760 t1701789.exe 3892 explothe.exe 3284 u1331864.exe 1380 legota.exe 4204 w0022676.exe 4408 explothe.exe 1748 legota.exe 3736 explothe.exe 536 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 552 rundll32.exe 180 rundll32.exe -
Processes:
q6037872.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q6037872.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z6684804.exe0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exez7801410.exez3260939.exez5336314.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z6684804.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z7801410.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z3260939.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z5336314.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r1012016.exes1354332.exedescription pid process target process PID 1508 set thread context of 4896 1508 r1012016.exe AppLaunch.exe PID 4864 set thread context of 968 4864 s1354332.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4904 4896 WerFault.exe AppLaunch.exe 2764 1508 WerFault.exe r1012016.exe 1956 4864 WerFault.exe s1354332.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 404 schtasks.exe 4784 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q6037872.exepid process 1016 q6037872.exe 1016 q6037872.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q6037872.exedescription pid process Token: SeDebugPrivilege 1016 q6037872.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exez7801410.exez3260939.exez5336314.exez6684804.exer1012016.exes1354332.exet1701789.exeexplothe.exeu1331864.exedescription pid process target process PID 460 wrote to memory of 2176 460 0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exe z7801410.exe PID 460 wrote to memory of 2176 460 0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exe z7801410.exe PID 460 wrote to memory of 2176 460 0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exe z7801410.exe PID 2176 wrote to memory of 1008 2176 z7801410.exe z3260939.exe PID 2176 wrote to memory of 1008 2176 z7801410.exe z3260939.exe PID 2176 wrote to memory of 1008 2176 z7801410.exe z3260939.exe PID 1008 wrote to memory of 4668 1008 z3260939.exe z5336314.exe PID 1008 wrote to memory of 4668 1008 z3260939.exe z5336314.exe PID 1008 wrote to memory of 4668 1008 z3260939.exe z5336314.exe PID 4668 wrote to memory of 2812 4668 z5336314.exe z6684804.exe PID 4668 wrote to memory of 2812 4668 z5336314.exe z6684804.exe PID 4668 wrote to memory of 2812 4668 z5336314.exe z6684804.exe PID 2812 wrote to memory of 1016 2812 z6684804.exe q6037872.exe PID 2812 wrote to memory of 1016 2812 z6684804.exe q6037872.exe PID 2812 wrote to memory of 1508 2812 z6684804.exe r1012016.exe PID 2812 wrote to memory of 1508 2812 z6684804.exe r1012016.exe PID 2812 wrote to memory of 1508 2812 z6684804.exe r1012016.exe PID 1508 wrote to memory of 344 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 344 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 344 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 2864 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 2864 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 2864 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 4896 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 4896 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 4896 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 4896 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 4896 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 4896 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 4896 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 4896 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 4896 1508 r1012016.exe AppLaunch.exe PID 1508 wrote to memory of 4896 1508 r1012016.exe AppLaunch.exe PID 4668 wrote to memory of 4864 4668 z5336314.exe s1354332.exe PID 4668 wrote to memory of 4864 4668 z5336314.exe s1354332.exe PID 4668 wrote to memory of 4864 4668 z5336314.exe s1354332.exe PID 4864 wrote to memory of 968 4864 s1354332.exe AppLaunch.exe PID 4864 wrote to memory of 968 4864 s1354332.exe AppLaunch.exe PID 4864 wrote to memory of 968 4864 s1354332.exe AppLaunch.exe PID 4864 wrote to memory of 968 4864 s1354332.exe AppLaunch.exe PID 4864 wrote to memory of 968 4864 s1354332.exe AppLaunch.exe PID 4864 wrote to memory of 968 4864 s1354332.exe AppLaunch.exe PID 4864 wrote to memory of 968 4864 s1354332.exe AppLaunch.exe PID 4864 wrote to memory of 968 4864 s1354332.exe AppLaunch.exe PID 1008 wrote to memory of 760 1008 z3260939.exe t1701789.exe PID 1008 wrote to memory of 760 1008 z3260939.exe t1701789.exe PID 1008 wrote to memory of 760 1008 z3260939.exe t1701789.exe PID 760 wrote to memory of 3892 760 t1701789.exe explothe.exe PID 760 wrote to memory of 3892 760 t1701789.exe explothe.exe PID 760 wrote to memory of 3892 760 t1701789.exe explothe.exe PID 2176 wrote to memory of 3284 2176 z7801410.exe u1331864.exe PID 2176 wrote to memory of 3284 2176 z7801410.exe u1331864.exe PID 2176 wrote to memory of 3284 2176 z7801410.exe u1331864.exe PID 3892 wrote to memory of 404 3892 explothe.exe schtasks.exe PID 3892 wrote to memory of 404 3892 explothe.exe schtasks.exe PID 3892 wrote to memory of 404 3892 explothe.exe schtasks.exe PID 3892 wrote to memory of 2732 3892 explothe.exe cmd.exe PID 3892 wrote to memory of 2732 3892 explothe.exe cmd.exe PID 3892 wrote to memory of 2732 3892 explothe.exe cmd.exe PID 3284 wrote to memory of 1380 3284 u1331864.exe legota.exe PID 3284 wrote to memory of 1380 3284 u1331864.exe legota.exe PID 3284 wrote to memory of 1380 3284 u1331864.exe legota.exe PID 460 wrote to memory of 4204 460 0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exe w0022676.exe PID 460 wrote to memory of 4204 460 0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exe w0022676.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exe"C:\Users\Admin\AppData\Local\Temp\0edfbd81b926c0078063c474e5515e1480b38e8ed9ae650d6a9444f7d43db64e_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7801410.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7801410.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3260939.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3260939.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5336314.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5336314.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6684804.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6684804.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6037872.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6037872.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1012016.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1012016.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:344
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:2864
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:4896
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 5408⤵
- Program crash
PID:4904 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1508 -s 5967⤵
- Program crash
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1354332.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1354332.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4864 -s 5966⤵
- Program crash
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1701789.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1701789.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:404 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:2732
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4052
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:3456
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:372
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1564
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:3708
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:5056
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:552 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1331864.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1331864.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:1380 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:4784 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:3544
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:448
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:552
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:3176
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2940
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:772
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:3920
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:180 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0022676.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0022676.exe2⤵
- Executes dropped EXE
PID:4204
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1508 -ip 15081⤵PID:3736
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4896 -ip 48961⤵PID:4568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4864 -ip 48641⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:4408
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:1748
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:3736
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:536
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0022676.exeFilesize
23KB
MD5c195b217016c3d64230229fd3a6127ac
SHA161956901c94d852e2b4646021578a720745989ab
SHA256452f2283a6c329a85fdff3efda786808491a68f5f53e4b8c2ce3ecbdd3e814a4
SHA512d3e5d25a9529d3a26ffd09a113eec1808a052d56a8718427118191f45e27ddd4c6ccdabf60d9c2525e0f14403b102aefe1b0a686ea83eed7149b632d1fdeb1f8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0022676.exeFilesize
23KB
MD5c195b217016c3d64230229fd3a6127ac
SHA161956901c94d852e2b4646021578a720745989ab
SHA256452f2283a6c329a85fdff3efda786808491a68f5f53e4b8c2ce3ecbdd3e814a4
SHA512d3e5d25a9529d3a26ffd09a113eec1808a052d56a8718427118191f45e27ddd4c6ccdabf60d9c2525e0f14403b102aefe1b0a686ea83eed7149b632d1fdeb1f8
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7801410.exeFilesize
972KB
MD57d8a8730a67998ad10978e82a4cf8154
SHA18993d7cea72e2789992f04515f3f151e54a1c7bd
SHA256a3bb319c83d243511b76f01b6fd6943844c418f98c52d23d5afaccb8b62149b9
SHA512ffcea458b89e15b3fb8f00a4374ffce7957df54b7a6cb128bd3eb29f8056868a6c8604b9194be19c3813f7c9f0b1f85eeca111a4616c4d5dd3266e504f2e02d3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7801410.exeFilesize
972KB
MD57d8a8730a67998ad10978e82a4cf8154
SHA18993d7cea72e2789992f04515f3f151e54a1c7bd
SHA256a3bb319c83d243511b76f01b6fd6943844c418f98c52d23d5afaccb8b62149b9
SHA512ffcea458b89e15b3fb8f00a4374ffce7957df54b7a6cb128bd3eb29f8056868a6c8604b9194be19c3813f7c9f0b1f85eeca111a4616c4d5dd3266e504f2e02d3
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1331864.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1331864.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3260939.exeFilesize
789KB
MD50c27baa0f66d278906838605ed86d563
SHA18c92fcd291d8f6bcebd540cfa734fde8960ec845
SHA25624dc89dfdac991d5076ee6d38be3d97c0c821560609f8680ff3eb6ed37ef6f89
SHA51241c7eed92b662626e07476a1e079a0b8b15bb3483616abb17028c0ba44cde573900ddc9b04e1b32c5f5a1dfd536336f83c764ab694724a4df4cb9e46916a4166
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3260939.exeFilesize
789KB
MD50c27baa0f66d278906838605ed86d563
SHA18c92fcd291d8f6bcebd540cfa734fde8960ec845
SHA25624dc89dfdac991d5076ee6d38be3d97c0c821560609f8680ff3eb6ed37ef6f89
SHA51241c7eed92b662626e07476a1e079a0b8b15bb3483616abb17028c0ba44cde573900ddc9b04e1b32c5f5a1dfd536336f83c764ab694724a4df4cb9e46916a4166
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1701789.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1701789.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5336314.exeFilesize
606KB
MD5f5afeecafa36b6878f6a831b6718d6da
SHA123d810f35e55d2e6781ec746d4c0d3942b33bd86
SHA2567222823fa8d7bea7a26b302d6d107a733e21349e34f8122084d03c514ab0895d
SHA512a41803b0e8269983fac9675e708c0ea3e56ef370fe7e34823fd7d75dc5994a5be732537a6c514f35a020fc4310050cfae73f58d2266fd02a484e47272ffd3413
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5336314.exeFilesize
606KB
MD5f5afeecafa36b6878f6a831b6718d6da
SHA123d810f35e55d2e6781ec746d4c0d3942b33bd86
SHA2567222823fa8d7bea7a26b302d6d107a733e21349e34f8122084d03c514ab0895d
SHA512a41803b0e8269983fac9675e708c0ea3e56ef370fe7e34823fd7d75dc5994a5be732537a6c514f35a020fc4310050cfae73f58d2266fd02a484e47272ffd3413
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1354332.exeFilesize
390KB
MD5570c5c193b85312ed8a6b903f840b294
SHA1a09cc5fb3c044f949922b7a1ea591c51b7f9007d
SHA25687e02146418edce51478ac680167ba1bd49be936b25a181ed6c5bdd72bc131c4
SHA5123e274fb5c8df044ddeaa866eecb24a9c1bd2433bcca50f58c9413e4201983e7cdce5327499be33e96fab746ab6b228f36b5af59f00230c7585cadf733cf5da18
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1354332.exeFilesize
390KB
MD5570c5c193b85312ed8a6b903f840b294
SHA1a09cc5fb3c044f949922b7a1ea591c51b7f9007d
SHA25687e02146418edce51478ac680167ba1bd49be936b25a181ed6c5bdd72bc131c4
SHA5123e274fb5c8df044ddeaa866eecb24a9c1bd2433bcca50f58c9413e4201983e7cdce5327499be33e96fab746ab6b228f36b5af59f00230c7585cadf733cf5da18
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6684804.exeFilesize
335KB
MD5861ca8380ff18f5f5eed84c8f4f5e04c
SHA197bba3627fc2977c861cbb88fc80e40d4d8459ea
SHA256af7168787a5e3d33df9255e8267ebad4190dcb68954a6cc30759b5d754dbdbe3
SHA512b26416c62e66367dc9996a30f3f1526dbc1e3b86642d70c2be137b1f31ca4013a9bdbdac311390bb1814a5a6f407c6695249091d2aa91f3c08973ed231bfa9af
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6684804.exeFilesize
335KB
MD5861ca8380ff18f5f5eed84c8f4f5e04c
SHA197bba3627fc2977c861cbb88fc80e40d4d8459ea
SHA256af7168787a5e3d33df9255e8267ebad4190dcb68954a6cc30759b5d754dbdbe3
SHA512b26416c62e66367dc9996a30f3f1526dbc1e3b86642d70c2be137b1f31ca4013a9bdbdac311390bb1814a5a6f407c6695249091d2aa91f3c08973ed231bfa9af
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6037872.exeFilesize
11KB
MD531946c1df259ded1f9d78f5175ba2908
SHA116335b20eba6a3c8ff6ad500344d6d1bcc0e5b06
SHA25627db2aa1b906d41dadfef28aa13cdd93de2352a623765d2241b45ec9844310d3
SHA512205ec4058279f5bb59fd7b3b6c52d19145540370b4fff1423daea9931398074f8de423d54259e44a703ece88de8f3b052050bb664b1ad0a270d3bd447de57c79
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6037872.exeFilesize
11KB
MD531946c1df259ded1f9d78f5175ba2908
SHA116335b20eba6a3c8ff6ad500344d6d1bcc0e5b06
SHA25627db2aa1b906d41dadfef28aa13cdd93de2352a623765d2241b45ec9844310d3
SHA512205ec4058279f5bb59fd7b3b6c52d19145540370b4fff1423daea9931398074f8de423d54259e44a703ece88de8f3b052050bb664b1ad0a270d3bd447de57c79
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1012016.exeFilesize
356KB
MD5d648bb2de9a57561461d4ffe0af6e1e3
SHA171d45cc47f0d5fdbd5e1acc216f9aebfd4859b32
SHA256c4b468c55ae9f97d10246a362663e6df0d9c67e23f68f6b1172373c5ffafbd18
SHA512c797d1f7bd137a0f47185f0c5f657a961a3e2cb24b818fa37a81f928ccd44f48679266294ff50d4d2f89c6026c36a4cd344d083a9fe555246bc8e5926c9d22df
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1012016.exeFilesize
356KB
MD5d648bb2de9a57561461d4ffe0af6e1e3
SHA171d45cc47f0d5fdbd5e1acc216f9aebfd4859b32
SHA256c4b468c55ae9f97d10246a362663e6df0d9c67e23f68f6b1172373c5ffafbd18
SHA512c797d1f7bd137a0f47185f0c5f657a961a3e2cb24b818fa37a81f928ccd44f48679266294ff50d4d2f89c6026c36a4cd344d083a9fe555246bc8e5926c9d22df
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/968-86-0x00000000051B0000-0x00000000051FC000-memory.dmpFilesize
304KB
-
memory/968-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/968-52-0x0000000074180000-0x0000000074930000-memory.dmpFilesize
7.7MB
-
memory/968-82-0x0000000005160000-0x000000000519C000-memory.dmpFilesize
240KB
-
memory/968-58-0x00000000029C0000-0x00000000029C6000-memory.dmpFilesize
24KB
-
memory/968-87-0x0000000074180000-0x0000000074930000-memory.dmpFilesize
7.7MB
-
memory/968-88-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/968-75-0x00000000051A0000-0x00000000051B0000-memory.dmpFilesize
64KB
-
memory/968-71-0x00000000057D0000-0x0000000005DE8000-memory.dmpFilesize
6.1MB
-
memory/968-73-0x00000000052C0000-0x00000000053CA000-memory.dmpFilesize
1.0MB
-
memory/968-78-0x0000000005100000-0x0000000005112000-memory.dmpFilesize
72KB
-
memory/1016-39-0x00007FFE5D3C0000-0x00007FFE5DE81000-memory.dmpFilesize
10.8MB
-
memory/1016-37-0x00007FFE5D3C0000-0x00007FFE5DE81000-memory.dmpFilesize
10.8MB
-
memory/1016-36-0x00007FFE5D3C0000-0x00007FFE5DE81000-memory.dmpFilesize
10.8MB
-
memory/1016-35-0x0000000000300000-0x000000000030A000-memory.dmpFilesize
40KB
-
memory/4896-47-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4896-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4896-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4896-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB