Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 19:44
Static task
static1
Behavioral task
behavioral1
Sample
2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exe
-
Size
1.0MB
-
MD5
93229405b90e0054dbc7b73b96295e75
-
SHA1
33760ad63e4761c7bcbc8e7e4e3542051c63c713
-
SHA256
2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852
-
SHA512
8dd64623ba39847bffe2965803646921feb3bbb6b744e6c8f107f453be2d24121e70ca24ac094ea4b0b9ffd589cc606d34b17ed6abd25479dfca6ffc63743b0b
-
SSDEEP
24576:dyJb9QdfN5VJ9+IuZlSGeXBuVzaVSd3J4Vi6:4dK5ZuZlSGQBuVzaVSd3n
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3608023.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3608023.exe healer behavioral2/memory/64-35-0x0000000000180000-0x000000000018A000-memory.dmp healer -
Processes:
q3608023.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q3608023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q3608023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q3608023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q3608023.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q3608023.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q3608023.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legota.exet2966859.exeu5656339.exeexplothe.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation t2966859.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation u5656339.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation explothe.exe -
Executes dropped EXE 16 IoCs
Processes:
z5399014.exez7322637.exez8853900.exez2536624.exeq3608023.exer3196240.exes2130394.exet2966859.exeexplothe.exeu5656339.exelegota.exew7129911.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 340 z5399014.exe 3348 z7322637.exe 2836 z8853900.exe 4372 z2536624.exe 64 q3608023.exe 4896 r3196240.exe 3332 s2130394.exe 2760 t2966859.exe 4268 explothe.exe 488 u5656339.exe 3324 legota.exe 116 w7129911.exe 636 explothe.exe 1876 legota.exe 1572 explothe.exe 4532 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4816 rundll32.exe 4524 rundll32.exe -
Processes:
q3608023.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q3608023.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exez5399014.exez7322637.exez8853900.exez2536624.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z5399014.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z7322637.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z8853900.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z2536624.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r3196240.exes2130394.exedescription pid process target process PID 4896 set thread context of 1520 4896 r3196240.exe AppLaunch.exe PID 3332 set thread context of 3064 3332 s2130394.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 416 4896 WerFault.exe r3196240.exe 1068 1520 WerFault.exe AppLaunch.exe 3204 3332 WerFault.exe s2130394.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4768 schtasks.exe 100 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q3608023.exepid process 64 q3608023.exe 64 q3608023.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q3608023.exedescription pid process Token: SeDebugPrivilege 64 q3608023.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exez5399014.exez7322637.exez8853900.exez2536624.exer3196240.exes2130394.exet2966859.exeu5656339.exeexplothe.exelegota.exedescription pid process target process PID 4888 wrote to memory of 340 4888 2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exe z5399014.exe PID 4888 wrote to memory of 340 4888 2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exe z5399014.exe PID 4888 wrote to memory of 340 4888 2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exe z5399014.exe PID 340 wrote to memory of 3348 340 z5399014.exe z7322637.exe PID 340 wrote to memory of 3348 340 z5399014.exe z7322637.exe PID 340 wrote to memory of 3348 340 z5399014.exe z7322637.exe PID 3348 wrote to memory of 2836 3348 z7322637.exe z8853900.exe PID 3348 wrote to memory of 2836 3348 z7322637.exe z8853900.exe PID 3348 wrote to memory of 2836 3348 z7322637.exe z8853900.exe PID 2836 wrote to memory of 4372 2836 z8853900.exe z2536624.exe PID 2836 wrote to memory of 4372 2836 z8853900.exe z2536624.exe PID 2836 wrote to memory of 4372 2836 z8853900.exe z2536624.exe PID 4372 wrote to memory of 64 4372 z2536624.exe q3608023.exe PID 4372 wrote to memory of 64 4372 z2536624.exe q3608023.exe PID 4372 wrote to memory of 4896 4372 z2536624.exe r3196240.exe PID 4372 wrote to memory of 4896 4372 z2536624.exe r3196240.exe PID 4372 wrote to memory of 4896 4372 z2536624.exe r3196240.exe PID 4896 wrote to memory of 956 4896 r3196240.exe AppLaunch.exe PID 4896 wrote to memory of 956 4896 r3196240.exe AppLaunch.exe PID 4896 wrote to memory of 956 4896 r3196240.exe AppLaunch.exe PID 4896 wrote to memory of 1520 4896 r3196240.exe AppLaunch.exe PID 4896 wrote to memory of 1520 4896 r3196240.exe AppLaunch.exe PID 4896 wrote to memory of 1520 4896 r3196240.exe AppLaunch.exe PID 4896 wrote to memory of 1520 4896 r3196240.exe AppLaunch.exe PID 4896 wrote to memory of 1520 4896 r3196240.exe AppLaunch.exe PID 4896 wrote to memory of 1520 4896 r3196240.exe AppLaunch.exe PID 4896 wrote to memory of 1520 4896 r3196240.exe AppLaunch.exe PID 4896 wrote to memory of 1520 4896 r3196240.exe AppLaunch.exe PID 4896 wrote to memory of 1520 4896 r3196240.exe AppLaunch.exe PID 4896 wrote to memory of 1520 4896 r3196240.exe AppLaunch.exe PID 2836 wrote to memory of 3332 2836 z8853900.exe s2130394.exe PID 2836 wrote to memory of 3332 2836 z8853900.exe s2130394.exe PID 2836 wrote to memory of 3332 2836 z8853900.exe s2130394.exe PID 3332 wrote to memory of 3064 3332 s2130394.exe AppLaunch.exe PID 3332 wrote to memory of 3064 3332 s2130394.exe AppLaunch.exe PID 3332 wrote to memory of 3064 3332 s2130394.exe AppLaunch.exe PID 3332 wrote to memory of 3064 3332 s2130394.exe AppLaunch.exe PID 3332 wrote to memory of 3064 3332 s2130394.exe AppLaunch.exe PID 3332 wrote to memory of 3064 3332 s2130394.exe AppLaunch.exe PID 3332 wrote to memory of 3064 3332 s2130394.exe AppLaunch.exe PID 3332 wrote to memory of 3064 3332 s2130394.exe AppLaunch.exe PID 3348 wrote to memory of 2760 3348 z7322637.exe t2966859.exe PID 3348 wrote to memory of 2760 3348 z7322637.exe t2966859.exe PID 3348 wrote to memory of 2760 3348 z7322637.exe t2966859.exe PID 2760 wrote to memory of 4268 2760 t2966859.exe explothe.exe PID 2760 wrote to memory of 4268 2760 t2966859.exe explothe.exe PID 2760 wrote to memory of 4268 2760 t2966859.exe explothe.exe PID 340 wrote to memory of 488 340 z5399014.exe u5656339.exe PID 340 wrote to memory of 488 340 z5399014.exe u5656339.exe PID 340 wrote to memory of 488 340 z5399014.exe u5656339.exe PID 488 wrote to memory of 3324 488 u5656339.exe legota.exe PID 488 wrote to memory of 3324 488 u5656339.exe legota.exe PID 488 wrote to memory of 3324 488 u5656339.exe legota.exe PID 4268 wrote to memory of 4768 4268 explothe.exe schtasks.exe PID 4268 wrote to memory of 4768 4268 explothe.exe schtasks.exe PID 4268 wrote to memory of 4768 4268 explothe.exe schtasks.exe PID 4888 wrote to memory of 116 4888 2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exe w7129911.exe PID 4888 wrote to memory of 116 4888 2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exe w7129911.exe PID 4888 wrote to memory of 116 4888 2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exe w7129911.exe PID 4268 wrote to memory of 828 4268 explothe.exe cmd.exe PID 4268 wrote to memory of 828 4268 explothe.exe cmd.exe PID 4268 wrote to memory of 828 4268 explothe.exe cmd.exe PID 3324 wrote to memory of 100 3324 legota.exe schtasks.exe PID 3324 wrote to memory of 100 3324 legota.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exe"C:\Users\Admin\AppData\Local\Temp\2fa4d4e3649f73f9aa4d42ca74ffc1758fce4ce9f4ceccd8aab7b336f4ac0852_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5399014.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5399014.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:340 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7322637.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7322637.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8853900.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8853900.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2536624.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2536624.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3608023.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3608023.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:64 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3196240.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3196240.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:956
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:1520
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1520 -s 5408⤵
- Program crash
PID:1068 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4896 -s 1407⤵
- Program crash
PID:416 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2130394.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2130394.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:3064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3332 -s 1406⤵
- Program crash
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2966859.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2966859.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:4768 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:828
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4700
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:3108
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:4212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2520
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:3264
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:4120
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5656339.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5656339.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:488 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:100 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:4256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1996
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:704
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:1276
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4420
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:2500
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:1368
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7129911.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7129911.exe2⤵
- Executes dropped EXE
PID:116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4896 -ip 48961⤵PID:1708
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1520 -ip 15201⤵PID:3280
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3332 -ip 33321⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:636
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:1876
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:1572
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4532
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7129911.exeFilesize
23KB
MD50ba970aa7c47aa818c31018889465be0
SHA12c8d8ce35352d7a55e5eb7f5dfa10b94bf18e1df
SHA256bc49522edeb92e1a7421a52c194bf72984e52c51376d752ae4cea47345f3ba44
SHA51249b2f789cc396006d10e45d5b1ca3384b1dac5ea5e57e8a3bccb99fbb49a7595920235db839cbde0fe189230bd26226065e1d720b7ce79b54502a2d1a426727b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7129911.exeFilesize
23KB
MD50ba970aa7c47aa818c31018889465be0
SHA12c8d8ce35352d7a55e5eb7f5dfa10b94bf18e1df
SHA256bc49522edeb92e1a7421a52c194bf72984e52c51376d752ae4cea47345f3ba44
SHA51249b2f789cc396006d10e45d5b1ca3384b1dac5ea5e57e8a3bccb99fbb49a7595920235db839cbde0fe189230bd26226065e1d720b7ce79b54502a2d1a426727b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5399014.exeFilesize
971KB
MD522ce3b94d1aba04e788e7e0b4109f9f2
SHA1ef9de4967d577ec19bbbd0cd444a1f602afbb0bf
SHA2566ded00d62e2c42785f686448fd50d07073482dccba5b4c24e2c79aaa451da267
SHA512ff6067ba650c26458a6786bf9837068bc8ca6b7863b43dabba05fe5bdb5f5d57088a6ac015383e537a7a0f3a8dcff6f6054b56b0b0e62f29d99cba71be137d29
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5399014.exeFilesize
971KB
MD522ce3b94d1aba04e788e7e0b4109f9f2
SHA1ef9de4967d577ec19bbbd0cd444a1f602afbb0bf
SHA2566ded00d62e2c42785f686448fd50d07073482dccba5b4c24e2c79aaa451da267
SHA512ff6067ba650c26458a6786bf9837068bc8ca6b7863b43dabba05fe5bdb5f5d57088a6ac015383e537a7a0f3a8dcff6f6054b56b0b0e62f29d99cba71be137d29
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5656339.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5656339.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7322637.exeFilesize
789KB
MD50facc0c3b6e3dc79e8c4313fd337e7cf
SHA12c2232b7d27107831a2800e6d430284a7296fa5f
SHA256cb2a16ece3834c36e056d546adf3a83af0de95223660aafdd06bc54db868facf
SHA512168d2466cbb919bae4facdb41d128a916d98c650f38c37b37fe2f66ac4fb5eb1f1348cb4fb9ddce99c02edcbd8442d54a2035cb38e2d1a51089e6dfecb2806c6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7322637.exeFilesize
789KB
MD50facc0c3b6e3dc79e8c4313fd337e7cf
SHA12c2232b7d27107831a2800e6d430284a7296fa5f
SHA256cb2a16ece3834c36e056d546adf3a83af0de95223660aafdd06bc54db868facf
SHA512168d2466cbb919bae4facdb41d128a916d98c650f38c37b37fe2f66ac4fb5eb1f1348cb4fb9ddce99c02edcbd8442d54a2035cb38e2d1a51089e6dfecb2806c6
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2966859.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t2966859.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8853900.exeFilesize
606KB
MD54a3c2aa4eb12f08efe3d35921108fea2
SHA186b7980c8d339ee5c111694d77792fc88634053a
SHA2565877508c2cfbcb9a004be21f18f5a875ae42eaddcf490d07c473b3e71f0394ae
SHA512e47087d74cc33a022ebdfc1e0c3e89f93f1e1912d3d16decc3501d7e54ca57328b1721f4712580e1e5177ea9bfdc6ae9410ea8f3e981b53968a245cfebd88c87
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z8853900.exeFilesize
606KB
MD54a3c2aa4eb12f08efe3d35921108fea2
SHA186b7980c8d339ee5c111694d77792fc88634053a
SHA2565877508c2cfbcb9a004be21f18f5a875ae42eaddcf490d07c473b3e71f0394ae
SHA512e47087d74cc33a022ebdfc1e0c3e89f93f1e1912d3d16decc3501d7e54ca57328b1721f4712580e1e5177ea9bfdc6ae9410ea8f3e981b53968a245cfebd88c87
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2130394.exeFilesize
390KB
MD56d79072601b186b50540610fc2dd14d4
SHA164ea322b965ba26d4addf3ec68619d0d72dcaf47
SHA256075999e70c1194175746378d13cc5d9451cba42ce98339cfcc733d746f89dcf1
SHA51212fe3a80bb7471d643764f820b890df515eeb282cf1d060b2ee7f02dce53e7bbe86ff166fd3b4f0fb791f2d91fe4043211aa0fb602a65938952561573d7713ce
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2130394.exeFilesize
390KB
MD56d79072601b186b50540610fc2dd14d4
SHA164ea322b965ba26d4addf3ec68619d0d72dcaf47
SHA256075999e70c1194175746378d13cc5d9451cba42ce98339cfcc733d746f89dcf1
SHA51212fe3a80bb7471d643764f820b890df515eeb282cf1d060b2ee7f02dce53e7bbe86ff166fd3b4f0fb791f2d91fe4043211aa0fb602a65938952561573d7713ce
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2536624.exeFilesize
335KB
MD568e8ffec10bddc0f7135b95e720d380a
SHA18e1bd6b151f7aedcd64e38c5ab35ff50ba45901e
SHA2563b9fdd1d3b3f85f4164c00034142b6fadba98a58d75ec80aeb8012bd87c26bdf
SHA51202588c8d9fb544fd90c82913aba7f570e9afaf00634829f18142bc4edcab9a648ee110058189e91582e39dbea826ce7274cb8086b8c03475685eb29c0de28137
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2536624.exeFilesize
335KB
MD568e8ffec10bddc0f7135b95e720d380a
SHA18e1bd6b151f7aedcd64e38c5ab35ff50ba45901e
SHA2563b9fdd1d3b3f85f4164c00034142b6fadba98a58d75ec80aeb8012bd87c26bdf
SHA51202588c8d9fb544fd90c82913aba7f570e9afaf00634829f18142bc4edcab9a648ee110058189e91582e39dbea826ce7274cb8086b8c03475685eb29c0de28137
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3608023.exeFilesize
11KB
MD59f37ac9732f227a7cb4d38a101cd95b6
SHA1036648d141f75044fb6fb2e4e965b4ca791f7e43
SHA256d98f9db749585792ba75ec9d29da3f8d74ebff739621f207386a06794c710d0c
SHA512928c7b0b4d29e11aca8ce81c1e0580c8572f0c79b5faff1970b718eb19eb7a4ec3897e1ae1ac04a70c55d6029211c2ba9f51750efb4c52e40043fde4486e87b1
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3608023.exeFilesize
11KB
MD59f37ac9732f227a7cb4d38a101cd95b6
SHA1036648d141f75044fb6fb2e4e965b4ca791f7e43
SHA256d98f9db749585792ba75ec9d29da3f8d74ebff739621f207386a06794c710d0c
SHA512928c7b0b4d29e11aca8ce81c1e0580c8572f0c79b5faff1970b718eb19eb7a4ec3897e1ae1ac04a70c55d6029211c2ba9f51750efb4c52e40043fde4486e87b1
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3196240.exeFilesize
356KB
MD58c9def56fbfd6ab21c2b64d9a1105ea4
SHA1fd7f4d1a8838160f1401379d7784af8b6193c93e
SHA256df0def8f6cfb478f6a0574c13adea26857331c29090624e1a56b2c24dad0e592
SHA5124fa864f10a052deed7359af45f469af55e2e4fa2b68f20a33a767b0b026e29b8c1957ab0d36c82ede178265566402501fc9c50fcbac6a180a0363063705ff97e
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3196240.exeFilesize
356KB
MD58c9def56fbfd6ab21c2b64d9a1105ea4
SHA1fd7f4d1a8838160f1401379d7784af8b6193c93e
SHA256df0def8f6cfb478f6a0574c13adea26857331c29090624e1a56b2c24dad0e592
SHA5124fa864f10a052deed7359af45f469af55e2e4fa2b68f20a33a767b0b026e29b8c1957ab0d36c82ede178265566402501fc9c50fcbac6a180a0363063705ff97e
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/64-39-0x00007FF96A900000-0x00007FF96B3C1000-memory.dmpFilesize
10.8MB
-
memory/64-37-0x00007FF96A900000-0x00007FF96B3C1000-memory.dmpFilesize
10.8MB
-
memory/64-35-0x0000000000180000-0x000000000018A000-memory.dmpFilesize
40KB
-
memory/64-36-0x00007FF96A900000-0x00007FF96B3C1000-memory.dmpFilesize
10.8MB
-
memory/1520-47-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1520-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1520-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1520-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3064-87-0x00000000744C0000-0x0000000074C70000-memory.dmpFilesize
7.7MB
-
memory/3064-81-0x00000000056B0000-0x0000000005CC8000-memory.dmpFilesize
6.1MB
-
memory/3064-58-0x0000000002980000-0x0000000002986000-memory.dmpFilesize
24KB
-
memory/3064-82-0x00000000051A0000-0x00000000052AA000-memory.dmpFilesize
1.0MB
-
memory/3064-88-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3064-83-0x0000000004F80000-0x0000000004F90000-memory.dmpFilesize
64KB
-
memory/3064-86-0x00000000052B0000-0x00000000052FC000-memory.dmpFilesize
304KB
-
memory/3064-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3064-52-0x00000000744C0000-0x0000000074C70000-memory.dmpFilesize
7.7MB
-
memory/3064-85-0x0000000005110000-0x000000000514C000-memory.dmpFilesize
240KB
-
memory/3064-84-0x00000000050B0000-0x00000000050C2000-memory.dmpFilesize
72KB