Analysis
-
max time kernel
137s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
01-10-2023 20:51
Static task
static1
Behavioral task
behavioral1
Sample
ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788_JC.exe
-
Size
994KB
-
MD5
e21b7afdeb96d1c7ab452794105ee343
-
SHA1
03f0176dafd9f4abc84381b4bb4a721da5626f0f
-
SHA256
ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788
-
SHA512
b4e87b5c12de70f839f2d05f6b71289f5bde8ae709e016b95bce37d734bed35ea1cacde0a0a0e1391fc8a82b2f6c56e4292d76fe2e45240050bf8c75a92678e7
-
SSDEEP
24576:QyRyqLjY0wDw8RzIZXPFgWuTvQ5VEq7WQ41/9A8Wi6UM:XlL80wDw8CZXPFbEvQ58Q4N9qU
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0716229.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0716229.exe healer behavioral2/memory/2444-35-0x0000000000BD0000-0x0000000000BDA000-memory.dmp healer -
Processes:
q0716229.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q0716229.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q0716229.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q0716229.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q0716229.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q0716229.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q0716229.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t1096746.exeexplothe.exeu1696738.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation t1096746.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation u1696738.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z6716101.exez7204723.exez1832919.exez9054191.exeq0716229.exer5378458.exes5807422.exet1096746.exeexplothe.exeu1696738.exelegota.exew4463192.exelegota.exeexplothe.exelegota.exeexplothe.exepid process 1848 z6716101.exe 4144 z7204723.exe 1240 z1832919.exe 3472 z9054191.exe 2444 q0716229.exe 2948 r5378458.exe 4204 s5807422.exe 4912 t1096746.exe 4796 explothe.exe 3116 u1696738.exe 4404 legota.exe 2040 w4463192.exe 4912 legota.exe 3548 explothe.exe 4308 legota.exe 4396 explothe.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 448 rundll32.exe 1464 rundll32.exe -
Processes:
q0716229.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q0716229.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788_JC.exez6716101.exez7204723.exez1832919.exez9054191.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z6716101.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z7204723.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z1832919.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z9054191.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r5378458.exes5807422.exedescription pid process target process PID 2948 set thread context of 1112 2948 r5378458.exe AppLaunch.exe PID 4204 set thread context of 2624 4204 s5807422.exe AppLaunch.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 3740 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1072 2948 WerFault.exe r5378458.exe 4108 1112 WerFault.exe AppLaunch.exe 4132 4204 WerFault.exe s5807422.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1484 schtasks.exe 5024 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q0716229.exepid process 2444 q0716229.exe 2444 q0716229.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q0716229.exedescription pid process Token: SeDebugPrivilege 2444 q0716229.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788_JC.exez6716101.exez7204723.exez1832919.exez9054191.exer5378458.exes5807422.exet1096746.exeexplothe.execmd.exeu1696738.exedescription pid process target process PID 4252 wrote to memory of 1848 4252 ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788_JC.exe z6716101.exe PID 4252 wrote to memory of 1848 4252 ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788_JC.exe z6716101.exe PID 4252 wrote to memory of 1848 4252 ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788_JC.exe z6716101.exe PID 1848 wrote to memory of 4144 1848 z6716101.exe z7204723.exe PID 1848 wrote to memory of 4144 1848 z6716101.exe z7204723.exe PID 1848 wrote to memory of 4144 1848 z6716101.exe z7204723.exe PID 4144 wrote to memory of 1240 4144 z7204723.exe z1832919.exe PID 4144 wrote to memory of 1240 4144 z7204723.exe z1832919.exe PID 4144 wrote to memory of 1240 4144 z7204723.exe z1832919.exe PID 1240 wrote to memory of 3472 1240 z1832919.exe z9054191.exe PID 1240 wrote to memory of 3472 1240 z1832919.exe z9054191.exe PID 1240 wrote to memory of 3472 1240 z1832919.exe z9054191.exe PID 3472 wrote to memory of 2444 3472 z9054191.exe q0716229.exe PID 3472 wrote to memory of 2444 3472 z9054191.exe q0716229.exe PID 3472 wrote to memory of 2948 3472 z9054191.exe r5378458.exe PID 3472 wrote to memory of 2948 3472 z9054191.exe r5378458.exe PID 3472 wrote to memory of 2948 3472 z9054191.exe r5378458.exe PID 2948 wrote to memory of 1112 2948 r5378458.exe AppLaunch.exe PID 2948 wrote to memory of 1112 2948 r5378458.exe AppLaunch.exe PID 2948 wrote to memory of 1112 2948 r5378458.exe AppLaunch.exe PID 2948 wrote to memory of 1112 2948 r5378458.exe AppLaunch.exe PID 2948 wrote to memory of 1112 2948 r5378458.exe AppLaunch.exe PID 2948 wrote to memory of 1112 2948 r5378458.exe AppLaunch.exe PID 2948 wrote to memory of 1112 2948 r5378458.exe AppLaunch.exe PID 2948 wrote to memory of 1112 2948 r5378458.exe AppLaunch.exe PID 2948 wrote to memory of 1112 2948 r5378458.exe AppLaunch.exe PID 2948 wrote to memory of 1112 2948 r5378458.exe AppLaunch.exe PID 1240 wrote to memory of 4204 1240 z1832919.exe s5807422.exe PID 1240 wrote to memory of 4204 1240 z1832919.exe s5807422.exe PID 1240 wrote to memory of 4204 1240 z1832919.exe s5807422.exe PID 4204 wrote to memory of 932 4204 s5807422.exe AppLaunch.exe PID 4204 wrote to memory of 932 4204 s5807422.exe AppLaunch.exe PID 4204 wrote to memory of 932 4204 s5807422.exe AppLaunch.exe PID 4204 wrote to memory of 2624 4204 s5807422.exe AppLaunch.exe PID 4204 wrote to memory of 2624 4204 s5807422.exe AppLaunch.exe PID 4204 wrote to memory of 2624 4204 s5807422.exe AppLaunch.exe PID 4204 wrote to memory of 2624 4204 s5807422.exe AppLaunch.exe PID 4204 wrote to memory of 2624 4204 s5807422.exe AppLaunch.exe PID 4204 wrote to memory of 2624 4204 s5807422.exe AppLaunch.exe PID 4204 wrote to memory of 2624 4204 s5807422.exe AppLaunch.exe PID 4204 wrote to memory of 2624 4204 s5807422.exe AppLaunch.exe PID 4144 wrote to memory of 4912 4144 z7204723.exe t1096746.exe PID 4144 wrote to memory of 4912 4144 z7204723.exe t1096746.exe PID 4144 wrote to memory of 4912 4144 z7204723.exe t1096746.exe PID 4912 wrote to memory of 4796 4912 t1096746.exe explothe.exe PID 4912 wrote to memory of 4796 4912 t1096746.exe explothe.exe PID 4912 wrote to memory of 4796 4912 t1096746.exe explothe.exe PID 1848 wrote to memory of 3116 1848 z6716101.exe u1696738.exe PID 1848 wrote to memory of 3116 1848 z6716101.exe u1696738.exe PID 1848 wrote to memory of 3116 1848 z6716101.exe u1696738.exe PID 4796 wrote to memory of 1484 4796 explothe.exe schtasks.exe PID 4796 wrote to memory of 1484 4796 explothe.exe schtasks.exe PID 4796 wrote to memory of 1484 4796 explothe.exe schtasks.exe PID 4796 wrote to memory of 1268 4796 explothe.exe cmd.exe PID 4796 wrote to memory of 1268 4796 explothe.exe cmd.exe PID 4796 wrote to memory of 1268 4796 explothe.exe cmd.exe PID 1268 wrote to memory of 4980 1268 cmd.exe cmd.exe PID 1268 wrote to memory of 4980 1268 cmd.exe cmd.exe PID 1268 wrote to memory of 4980 1268 cmd.exe cmd.exe PID 3116 wrote to memory of 4404 3116 u1696738.exe legota.exe PID 3116 wrote to memory of 4404 3116 u1696738.exe legota.exe PID 3116 wrote to memory of 4404 3116 u1696738.exe legota.exe PID 1268 wrote to memory of 4640 1268 cmd.exe cacls.exe PID 1268 wrote to memory of 4640 1268 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788_JC.exe"C:\Users\Admin\AppData\Local\Temp\ed067e1d3a1df58da03c77e1bfba668fc9f4aa81e6802ae2626c6fa87de0a788_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6716101.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6716101.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7204723.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7204723.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1832919.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1832919.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9054191.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9054191.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0716229.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0716229.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5378458.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5378458.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:1112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1112 -s 5408⤵
- Program crash
PID:4108 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2948 -s 1487⤵
- Program crash
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5807422.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5807422.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:932
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:2624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 5806⤵
- Program crash
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1096746.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1096746.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:1484 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4980
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:4640
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:2676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1648
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:1520
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:2388
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:448 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1696738.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1696738.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:4404 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:5024 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:2848
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:704
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:228
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:2796
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2376
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:1064
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:232
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4463192.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4463192.exe2⤵
- Executes dropped EXE
PID:2040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2948 -ip 29481⤵PID:3108
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1112 -ip 11121⤵PID:4392
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4204 -ip 42041⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4912
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:3548
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
PID:3740
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4308
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:4396
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4463192.exeFilesize
23KB
MD5b34145960380c58cc1494589d6dfbd69
SHA1bb9fecfc7485061a34389f9085664d40fcc1cff2
SHA256bd2b298a0f3acd7ed1102d942fa60624d1ce05f4cf2fc37df3c673fca9cc8cb9
SHA5123145e0d4a18002db0c58a6ed4e142dc7a9ada511116393f05400aa8b33f6ce51e24ccf6f1d3a4ab2fe8d84d418417aab448cb41fd82a25bffca710838dd6b70b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4463192.exeFilesize
23KB
MD5b34145960380c58cc1494589d6dfbd69
SHA1bb9fecfc7485061a34389f9085664d40fcc1cff2
SHA256bd2b298a0f3acd7ed1102d942fa60624d1ce05f4cf2fc37df3c673fca9cc8cb9
SHA5123145e0d4a18002db0c58a6ed4e142dc7a9ada511116393f05400aa8b33f6ce51e24ccf6f1d3a4ab2fe8d84d418417aab448cb41fd82a25bffca710838dd6b70b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6716101.exeFilesize
892KB
MD5fbd1b5b071b46be975ca3bcc75c214e8
SHA16c52d98ffe2158a477c253c70014e6b99c78ca96
SHA2569a856835b51b6ee45615d829a3f6ab75a41a9a07c2186b10a30b294d54a76c22
SHA5128f3ac602b2e0b911b1bbdd7cf5ee578d20abaf99570d38302a9ca8ea227015cdf22a88e9c5f1030e225aa27b6168906cedbb4a2fb43da9c4c9c961a6fe5945d0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6716101.exeFilesize
892KB
MD5fbd1b5b071b46be975ca3bcc75c214e8
SHA16c52d98ffe2158a477c253c70014e6b99c78ca96
SHA2569a856835b51b6ee45615d829a3f6ab75a41a9a07c2186b10a30b294d54a76c22
SHA5128f3ac602b2e0b911b1bbdd7cf5ee578d20abaf99570d38302a9ca8ea227015cdf22a88e9c5f1030e225aa27b6168906cedbb4a2fb43da9c4c9c961a6fe5945d0
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1696738.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1696738.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7204723.exeFilesize
709KB
MD5de74f77f52546d9f9514d0dacb1e9928
SHA1fb3e806ed034a3e7eddc3f3675d45e1f4992aa43
SHA25652b97b1763d0178c4f60a491f5caff78c7898aa6b0caf82ed4da29998cb22795
SHA51231390139213b965da7495f753f560cc98f275a07c615137e48921534fcce19f9b802f2baf336d6bb3bdb0ad7d5b2f6b32865b1ac8f19d43aa51dd100b892778f
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7204723.exeFilesize
709KB
MD5de74f77f52546d9f9514d0dacb1e9928
SHA1fb3e806ed034a3e7eddc3f3675d45e1f4992aa43
SHA25652b97b1763d0178c4f60a491f5caff78c7898aa6b0caf82ed4da29998cb22795
SHA51231390139213b965da7495f753f560cc98f275a07c615137e48921534fcce19f9b802f2baf336d6bb3bdb0ad7d5b2f6b32865b1ac8f19d43aa51dd100b892778f
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1096746.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1096746.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1832919.exeFilesize
526KB
MD5cae4fcb30d8f32e3f50a65555ac5d561
SHA1c5c40c9ab32176d83ee98101e8cc2a955d43c305
SHA256de2f19a565fa32ed7d060a1f4adc828bb85c0832442be29a82e2f343d4834e16
SHA5129c846434ededc341ac07fb521a44cfd24271163f533766b07e0b64fce9423b298db49dcc8cc0c23e0b680e8d7f17a98ef2d4906995c471d87e2665fe649c5dd3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1832919.exeFilesize
526KB
MD5cae4fcb30d8f32e3f50a65555ac5d561
SHA1c5c40c9ab32176d83ee98101e8cc2a955d43c305
SHA256de2f19a565fa32ed7d060a1f4adc828bb85c0832442be29a82e2f343d4834e16
SHA5129c846434ededc341ac07fb521a44cfd24271163f533766b07e0b64fce9423b298db49dcc8cc0c23e0b680e8d7f17a98ef2d4906995c471d87e2665fe649c5dd3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5807422.exeFilesize
310KB
MD5b58a10ed6731e7d354afb7d40a090168
SHA1471ba1aee2df750b2c82e93888870553c7a59aab
SHA2565145fba54defed0a9811c9d92989a54524fc3fe3b670819c70d73db39e2abe1a
SHA5127e8f39871100b2848e37291d14d1cdf46d3a7a827b6ef70d830c3f59533360926c53435673c0ea2d313f1b3e0098bc502e347b1ba8f710629af43cdb661f4e1d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s5807422.exeFilesize
310KB
MD5b58a10ed6731e7d354afb7d40a090168
SHA1471ba1aee2df750b2c82e93888870553c7a59aab
SHA2565145fba54defed0a9811c9d92989a54524fc3fe3b670819c70d73db39e2abe1a
SHA5127e8f39871100b2848e37291d14d1cdf46d3a7a827b6ef70d830c3f59533360926c53435673c0ea2d313f1b3e0098bc502e347b1ba8f710629af43cdb661f4e1d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9054191.exeFilesize
295KB
MD570cf3569f2b0a2c4c950f5041bfff616
SHA1c43bae9b84ce97117e91478749605390543c400c
SHA2561a910a365af953fe641b1e262723a26ea315ec8282d8f0d400c8b23a817efbc2
SHA512e33cbcccb2324ffcdf65cd995724a5f73510962c9d16a51f10f72d09b11f3d3d152cdaa35a90c078e59c24ad226dd66a7f4318e3d7d8d387403ad1657131616c
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9054191.exeFilesize
295KB
MD570cf3569f2b0a2c4c950f5041bfff616
SHA1c43bae9b84ce97117e91478749605390543c400c
SHA2561a910a365af953fe641b1e262723a26ea315ec8282d8f0d400c8b23a817efbc2
SHA512e33cbcccb2324ffcdf65cd995724a5f73510962c9d16a51f10f72d09b11f3d3d152cdaa35a90c078e59c24ad226dd66a7f4318e3d7d8d387403ad1657131616c
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0716229.exeFilesize
11KB
MD5c1c020c59cdf379c115377423ebcd969
SHA1156ff2c61339f776ce26be8f4489fbb5966ec1f7
SHA2562990ab23d14cb70a564db14a77dd09a8afff17f1f344d4163042860879ed430d
SHA512994e5cd7be3d64988c5d795afef7f8b92fb3c335291fefc9b2b4f8a99e037f3c42fe2728bc31453ddd2bee3a6d41325f1b1743cf813780eb9fa91212b9c71ad5
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0716229.exeFilesize
11KB
MD5c1c020c59cdf379c115377423ebcd969
SHA1156ff2c61339f776ce26be8f4489fbb5966ec1f7
SHA2562990ab23d14cb70a564db14a77dd09a8afff17f1f344d4163042860879ed430d
SHA512994e5cd7be3d64988c5d795afef7f8b92fb3c335291fefc9b2b4f8a99e037f3c42fe2728bc31453ddd2bee3a6d41325f1b1743cf813780eb9fa91212b9c71ad5
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5378458.exeFilesize
276KB
MD5459ee600f860b8e77f1a113d975c089e
SHA1a188d6630eb2a234a9171ac931138549f7fcc3b9
SHA25616d7c988780a8d65bd5afbe4f4b973781f2d9d5fdd99d7b8876b04a19c21fdd9
SHA512bd1533cd29cdfca1c271ae415464747b0c15575a2ded3630a863a07ea4c9eb04e3e7b835fa3d7c362a58eb706bfa3b1bbb546402a77a0b82526f50e3f9d4bfb8
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5378458.exeFilesize
276KB
MD5459ee600f860b8e77f1a113d975c089e
SHA1a188d6630eb2a234a9171ac931138549f7fcc3b9
SHA25616d7c988780a8d65bd5afbe4f4b973781f2d9d5fdd99d7b8876b04a19c21fdd9
SHA512bd1533cd29cdfca1c271ae415464747b0c15575a2ded3630a863a07ea4c9eb04e3e7b835fa3d7c362a58eb706bfa3b1bbb546402a77a0b82526f50e3f9d4bfb8
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1112-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1112-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1112-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1112-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2444-38-0x00007FFFCD850000-0x00007FFFCE311000-memory.dmpFilesize
10.8MB
-
memory/2444-36-0x00007FFFCD850000-0x00007FFFCE311000-memory.dmpFilesize
10.8MB
-
memory/2444-35-0x0000000000BD0000-0x0000000000BDA000-memory.dmpFilesize
40KB
-
memory/2624-59-0x0000000005560000-0x000000000566A000-memory.dmpFilesize
1.0MB
-
memory/2624-87-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/2624-86-0x0000000073DC0000-0x0000000074570000-memory.dmpFilesize
7.7MB
-
memory/2624-70-0x00000000054F0000-0x000000000553C000-memory.dmpFilesize
304KB
-
memory/2624-66-0x00000000054B0000-0x00000000054EC000-memory.dmpFilesize
240KB
-
memory/2624-61-0x0000000005450000-0x0000000005462000-memory.dmpFilesize
72KB
-
memory/2624-62-0x0000000005340000-0x0000000005350000-memory.dmpFilesize
64KB
-
memory/2624-58-0x0000000005A70000-0x0000000006088000-memory.dmpFilesize
6.1MB
-
memory/2624-52-0x0000000001470000-0x0000000001476000-memory.dmpFilesize
24KB
-
memory/2624-51-0x0000000073DC0000-0x0000000074570000-memory.dmpFilesize
7.7MB
-
memory/2624-50-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB