Analysis
-
max time kernel
148s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 21:39
Static task
static1
Behavioral task
behavioral1
Sample
45ede1ad7d5fa517ca0f5b0234466a6aed3488d6ed6e4d452e8dbba5fe99da3f_JC.exe
Resource
win7-20230831-en
General
-
Target
45ede1ad7d5fa517ca0f5b0234466a6aed3488d6ed6e4d452e8dbba5fe99da3f_JC.exe
-
Size
1.1MB
-
MD5
8eaf57d1a220c028a4cad696bd9715bc
-
SHA1
34818d7102377c1549cbd4381e94f68a45aa59c4
-
SHA256
45ede1ad7d5fa517ca0f5b0234466a6aed3488d6ed6e4d452e8dbba5fe99da3f
-
SHA512
fe59bd9730e637a4d9dd283af65609ec9db2d0b4a77a295fff44e42dab233afc0ec2930085040cf033bc30204726f85f8bb471cb11da4081500d7965080ad7c1
-
SSDEEP
24576:ryPVTH+7s4HTL/9EC6/NqBUoGhpA8DxH2VB4HOZ3tVpOOzkwPYV9VR3A:e9KNHThEC6/NIGHV64idVppwiYlR
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3864-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3864-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3864-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3864-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3916-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explothe.exeu6267865.exelegota.exet1374795.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation u6267865.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation t1374795.exe -
Executes dropped EXE 16 IoCs
Processes:
z8463059.exez0231791.exez4422852.exez2474972.exeq3407964.exer8014271.exes4105500.exet1374795.exeexplothe.exeu6267865.exelegota.exew4506094.exelegota.exeexplothe.exelegota.exeexplothe.exepid process 3684 z8463059.exe 3532 z0231791.exe 2752 z4422852.exe 1304 z2474972.exe 1936 q3407964.exe 2888 r8014271.exe 3940 s4105500.exe 4176 t1374795.exe 1036 explothe.exe 3432 u6267865.exe 2108 legota.exe 1996 w4506094.exe 5092 legota.exe 3092 explothe.exe 1416 legota.exe 3776 explothe.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4388 rundll32.exe 1944 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z4422852.exez2474972.exe45ede1ad7d5fa517ca0f5b0234466a6aed3488d6ed6e4d452e8dbba5fe99da3f_JC.exez8463059.exez0231791.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z4422852.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z2474972.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 45ede1ad7d5fa517ca0f5b0234466a6aed3488d6ed6e4d452e8dbba5fe99da3f_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z8463059.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z0231791.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q3407964.exer8014271.exes4105500.exedescription pid process target process PID 1936 set thread context of 3916 1936 q3407964.exe AppLaunch.exe PID 2888 set thread context of 3864 2888 r8014271.exe AppLaunch.exe PID 3940 set thread context of 2040 3940 s4105500.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3876 1936 WerFault.exe q3407964.exe 2496 2888 WerFault.exe r8014271.exe 2804 3864 WerFault.exe AppLaunch.exe 2864 3940 WerFault.exe s4105500.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1776 schtasks.exe 2028 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 3916 AppLaunch.exe 3916 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3916 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
45ede1ad7d5fa517ca0f5b0234466a6aed3488d6ed6e4d452e8dbba5fe99da3f_JC.exez8463059.exez0231791.exez4422852.exez2474972.exeq3407964.exer8014271.exes4105500.exedescription pid process target process PID 4376 wrote to memory of 3684 4376 45ede1ad7d5fa517ca0f5b0234466a6aed3488d6ed6e4d452e8dbba5fe99da3f_JC.exe z8463059.exe PID 4376 wrote to memory of 3684 4376 45ede1ad7d5fa517ca0f5b0234466a6aed3488d6ed6e4d452e8dbba5fe99da3f_JC.exe z8463059.exe PID 4376 wrote to memory of 3684 4376 45ede1ad7d5fa517ca0f5b0234466a6aed3488d6ed6e4d452e8dbba5fe99da3f_JC.exe z8463059.exe PID 3684 wrote to memory of 3532 3684 z8463059.exe z0231791.exe PID 3684 wrote to memory of 3532 3684 z8463059.exe z0231791.exe PID 3684 wrote to memory of 3532 3684 z8463059.exe z0231791.exe PID 3532 wrote to memory of 2752 3532 z0231791.exe z4422852.exe PID 3532 wrote to memory of 2752 3532 z0231791.exe z4422852.exe PID 3532 wrote to memory of 2752 3532 z0231791.exe z4422852.exe PID 2752 wrote to memory of 1304 2752 z4422852.exe z2474972.exe PID 2752 wrote to memory of 1304 2752 z4422852.exe z2474972.exe PID 2752 wrote to memory of 1304 2752 z4422852.exe z2474972.exe PID 1304 wrote to memory of 1936 1304 z2474972.exe q3407964.exe PID 1304 wrote to memory of 1936 1304 z2474972.exe q3407964.exe PID 1304 wrote to memory of 1936 1304 z2474972.exe q3407964.exe PID 1936 wrote to memory of 5092 1936 q3407964.exe AppLaunch.exe PID 1936 wrote to memory of 5092 1936 q3407964.exe AppLaunch.exe PID 1936 wrote to memory of 5092 1936 q3407964.exe AppLaunch.exe PID 1936 wrote to memory of 3916 1936 q3407964.exe AppLaunch.exe PID 1936 wrote to memory of 3916 1936 q3407964.exe AppLaunch.exe PID 1936 wrote to memory of 3916 1936 q3407964.exe AppLaunch.exe PID 1936 wrote to memory of 3916 1936 q3407964.exe AppLaunch.exe PID 1936 wrote to memory of 3916 1936 q3407964.exe AppLaunch.exe PID 1936 wrote to memory of 3916 1936 q3407964.exe AppLaunch.exe PID 1936 wrote to memory of 3916 1936 q3407964.exe AppLaunch.exe PID 1936 wrote to memory of 3916 1936 q3407964.exe AppLaunch.exe PID 1304 wrote to memory of 2888 1304 z2474972.exe r8014271.exe PID 1304 wrote to memory of 2888 1304 z2474972.exe r8014271.exe PID 1304 wrote to memory of 2888 1304 z2474972.exe r8014271.exe PID 2888 wrote to memory of 2500 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 2500 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 2500 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 1292 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 1292 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 1292 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 2304 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 2304 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 2304 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 2332 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 2332 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 2332 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 3864 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 3864 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 3864 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 3864 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 3864 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 3864 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 3864 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 3864 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 3864 2888 r8014271.exe AppLaunch.exe PID 2888 wrote to memory of 3864 2888 r8014271.exe AppLaunch.exe PID 2752 wrote to memory of 3940 2752 z4422852.exe s4105500.exe PID 2752 wrote to memory of 3940 2752 z4422852.exe s4105500.exe PID 2752 wrote to memory of 3940 2752 z4422852.exe s4105500.exe PID 3940 wrote to memory of 2040 3940 s4105500.exe AppLaunch.exe PID 3940 wrote to memory of 2040 3940 s4105500.exe AppLaunch.exe PID 3940 wrote to memory of 2040 3940 s4105500.exe AppLaunch.exe PID 3940 wrote to memory of 2040 3940 s4105500.exe AppLaunch.exe PID 3940 wrote to memory of 2040 3940 s4105500.exe AppLaunch.exe PID 3940 wrote to memory of 2040 3940 s4105500.exe AppLaunch.exe PID 3940 wrote to memory of 2040 3940 s4105500.exe AppLaunch.exe PID 3940 wrote to memory of 2040 3940 s4105500.exe AppLaunch.exe PID 3532 wrote to memory of 4176 3532 z0231791.exe t1374795.exe PID 3532 wrote to memory of 4176 3532 z0231791.exe t1374795.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\45ede1ad7d5fa517ca0f5b0234466a6aed3488d6ed6e4d452e8dbba5fe99da3f_JC.exe"C:\Users\Admin\AppData\Local\Temp\45ede1ad7d5fa517ca0f5b0234466a6aed3488d6ed6e4d452e8dbba5fe99da3f_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8463059.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8463059.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0231791.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0231791.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4422852.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4422852.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2474972.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2474972.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3407964.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3407964.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:5092
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3916 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 5887⤵
- Program crash
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8014271.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8014271.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:2500
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:1292
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:2304
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:2332
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:3864
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3864 -s 5408⤵
- Program crash
PID:2804 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2888 -s 5847⤵
- Program crash
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4105500.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4105500.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:2040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3940 -s 1486⤵
- Program crash
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1374795.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1374795.exe4⤵
- Checks computer location settings
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
PID:1036 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:4752
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3912
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:1208
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:2488
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:4972
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2228
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:1976
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:1776 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6267865.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6267865.exe3⤵
- Checks computer location settings
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:2108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:3380
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:2028 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4506094.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4506094.exe2⤵
- Executes dropped EXE
PID:1996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1936 -ip 19361⤵PID:3592
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2888 -ip 28881⤵PID:1684
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3864 -ip 38641⤵PID:4908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 3940 -ip 39401⤵PID:3568
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"1⤵PID:2840
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"1⤵PID:3876
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"1⤵PID:1820
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E1⤵PID:1936
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E1⤵PID:4884
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"1⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:5092
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:3092
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:1416
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:3776
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4506094.exeFilesize
23KB
MD5d99257499f6e54fdd9b2009dcbe62356
SHA18ec1974dec9bbce0d91b3408f2b80b0c2ec09178
SHA256e8f82c749ea5ab242bf423d8e201c3df4be7de1b1726e6e8fdb73080a8a781b8
SHA5120b19d0fce646963ffb4cba3ed7b576b0b88d611a888815d85e4cd753a9a140bbedb641a9e13a310a3fe6f5a62ff2258213b94b6afc3417165cb9043cb4c2d4f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4506094.exeFilesize
23KB
MD5d99257499f6e54fdd9b2009dcbe62356
SHA18ec1974dec9bbce0d91b3408f2b80b0c2ec09178
SHA256e8f82c749ea5ab242bf423d8e201c3df4be7de1b1726e6e8fdb73080a8a781b8
SHA5120b19d0fce646963ffb4cba3ed7b576b0b88d611a888815d85e4cd753a9a140bbedb641a9e13a310a3fe6f5a62ff2258213b94b6afc3417165cb9043cb4c2d4f2
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8463059.exeFilesize
983KB
MD5350b8b7a40bac66d2c5e29612d0f73b5
SHA15a2ac85d8fa845e1558079bc0393790a2d1c588b
SHA2565d5c63beec1f126695e4d3e76d4fe88883f95b78b6a93351c9126ab67adbefd8
SHA5126071896eb9747449777ef87cf8435f376394cecb957870f8adc08eb64ba4a5d1895881ccf426a68640372b356471551a5b640f7d3889c26582ca7a2c65ae0d8c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z8463059.exeFilesize
983KB
MD5350b8b7a40bac66d2c5e29612d0f73b5
SHA15a2ac85d8fa845e1558079bc0393790a2d1c588b
SHA2565d5c63beec1f126695e4d3e76d4fe88883f95b78b6a93351c9126ab67adbefd8
SHA5126071896eb9747449777ef87cf8435f376394cecb957870f8adc08eb64ba4a5d1895881ccf426a68640372b356471551a5b640f7d3889c26582ca7a2c65ae0d8c
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6267865.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6267865.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0231791.exeFilesize
800KB
MD5aa7776092a550e7e69c7e6ff4672e5c7
SHA1ec187383765dc88a4d593008f909574265ba03ed
SHA2564eab0dbc28d21e3bac1f430e136b6f069952551bd8c65517223f2be31e3026e4
SHA5127f679d1884212bf6ed7d5c636ad74eb4ba5c96b085fb21327346e6feb00e8418f36999a03b244e5b52138451eb72d09c44fa15ec950b36a678bcaa6abad31ff5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0231791.exeFilesize
800KB
MD5aa7776092a550e7e69c7e6ff4672e5c7
SHA1ec187383765dc88a4d593008f909574265ba03ed
SHA2564eab0dbc28d21e3bac1f430e136b6f069952551bd8c65517223f2be31e3026e4
SHA5127f679d1884212bf6ed7d5c636ad74eb4ba5c96b085fb21327346e6feb00e8418f36999a03b244e5b52138451eb72d09c44fa15ec950b36a678bcaa6abad31ff5
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1374795.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t1374795.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4422852.exeFilesize
617KB
MD5ea5dee1d0cf5a8a98a4b8a4928d4602e
SHA1d779607727fbd9a5739291134b645d67898e20e9
SHA256a13790dfc0d21946ac7ec9cf94bb1cf76c1f7200ecde4a8623de5d174a617edb
SHA512da0358fc271a6f078f57241886e91f1c256a0b3efc8fef72de8bde9d2d331655e6aa7bb8d8618c2c0d421224795eed2bef79d91f655a93f8bcf498ef1675202a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4422852.exeFilesize
617KB
MD5ea5dee1d0cf5a8a98a4b8a4928d4602e
SHA1d779607727fbd9a5739291134b645d67898e20e9
SHA256a13790dfc0d21946ac7ec9cf94bb1cf76c1f7200ecde4a8623de5d174a617edb
SHA512da0358fc271a6f078f57241886e91f1c256a0b3efc8fef72de8bde9d2d331655e6aa7bb8d8618c2c0d421224795eed2bef79d91f655a93f8bcf498ef1675202a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4105500.exeFilesize
390KB
MD5da57eaba63c81e92e6e44dfc83507e80
SHA1354c9c0fdd077072efd7fa76b67c32935a3e1aa1
SHA256439c932dca27ca1cbde990a5a996dbba24d862ee3868cd45abcef4f2d89125ab
SHA51269d66ad9a91fe501592b45cbc62bbf74d2a2c2ac6440011a4b28bb2ce2fd72bf8f6b53f4e5c776e3c7784a18d6f86d396d1692fcc92b9093afbc6b3bfd8c7217
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4105500.exeFilesize
390KB
MD5da57eaba63c81e92e6e44dfc83507e80
SHA1354c9c0fdd077072efd7fa76b67c32935a3e1aa1
SHA256439c932dca27ca1cbde990a5a996dbba24d862ee3868cd45abcef4f2d89125ab
SHA51269d66ad9a91fe501592b45cbc62bbf74d2a2c2ac6440011a4b28bb2ce2fd72bf8f6b53f4e5c776e3c7784a18d6f86d396d1692fcc92b9093afbc6b3bfd8c7217
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2474972.exeFilesize
346KB
MD5f2fdb717ef60d377d8dd9cbb782db008
SHA174fb6ca64cc79afda633d4b62283a4766decafa1
SHA256c7b87804ae3044095b6e6d94cf03e1a708289c576eafc7635ac9aae31d631f35
SHA5125e2a7bdbc52c4d1bf3d5437f1923b76295c03d5d3e7b3fc27c38efc8211fbcec6cd8849b8ee7e0a4dc9a1dfd2ccd801e296403fac0d17e9f06a50960be442545
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2474972.exeFilesize
346KB
MD5f2fdb717ef60d377d8dd9cbb782db008
SHA174fb6ca64cc79afda633d4b62283a4766decafa1
SHA256c7b87804ae3044095b6e6d94cf03e1a708289c576eafc7635ac9aae31d631f35
SHA5125e2a7bdbc52c4d1bf3d5437f1923b76295c03d5d3e7b3fc27c38efc8211fbcec6cd8849b8ee7e0a4dc9a1dfd2ccd801e296403fac0d17e9f06a50960be442545
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3407964.exeFilesize
227KB
MD53d1ef6f497bb1773d2f4872f126a8990
SHA19894b6e53295e859db482258911df06466b25870
SHA2567e5f08e134e8e8bab681b433edb1f99862926a52aeae29b0709103d930721884
SHA512cbd31aae81340818d54f26a2c801257d2a66196e4db0bc74539c101061cf2a65e82f01e8299bfa49f414cca9d4be8ff707da8af1873533320367144285404dfc
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3407964.exeFilesize
227KB
MD53d1ef6f497bb1773d2f4872f126a8990
SHA19894b6e53295e859db482258911df06466b25870
SHA2567e5f08e134e8e8bab681b433edb1f99862926a52aeae29b0709103d930721884
SHA512cbd31aae81340818d54f26a2c801257d2a66196e4db0bc74539c101061cf2a65e82f01e8299bfa49f414cca9d4be8ff707da8af1873533320367144285404dfc
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8014271.exeFilesize
356KB
MD52ed01ce820c183d3a4a29916cb870145
SHA1765aca88e96308109ea1ee5624bf9f5f52875c5f
SHA256f4b87924d3abcd3421f86348bed49f27990eddcd5cf811fac19355829da48a4d
SHA512f29d76ab680dcfe4a2a181e07a4a5d4c3541634a42755a63971c404fdefc16e1ae2acbb94bff5d311bb65c75cb2ca3b440509a16d8e1a128f3c63f76611382ef
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r8014271.exeFilesize
356KB
MD52ed01ce820c183d3a4a29916cb870145
SHA1765aca88e96308109ea1ee5624bf9f5f52875c5f
SHA256f4b87924d3abcd3421f86348bed49f27990eddcd5cf811fac19355829da48a4d
SHA512f29d76ab680dcfe4a2a181e07a4a5d4c3541634a42755a63971c404fdefc16e1ae2acbb94bff5d311bb65c75cb2ca3b440509a16d8e1a128f3c63f76611382ef
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/2040-87-0x0000000073EF0000-0x00000000746A0000-memory.dmpFilesize
7.7MB
-
memory/2040-56-0x00000000059D0000-0x0000000005FE8000-memory.dmpFilesize
6.1MB
-
memory/2040-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2040-64-0x00000000053F0000-0x000000000542C000-memory.dmpFilesize
240KB
-
memory/2040-49-0x0000000073EF0000-0x00000000746A0000-memory.dmpFilesize
7.7MB
-
memory/2040-58-0x0000000005260000-0x0000000005272000-memory.dmpFilesize
72KB
-
memory/2040-88-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/2040-59-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/2040-57-0x00000000054C0000-0x00000000055CA000-memory.dmpFilesize
1.0MB
-
memory/2040-74-0x0000000005430000-0x000000000547C000-memory.dmpFilesize
304KB
-
memory/2040-50-0x00000000012E0000-0x00000000012E6000-memory.dmpFilesize
24KB
-
memory/3864-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3864-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3864-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3864-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3916-86-0x0000000073EF0000-0x00000000746A0000-memory.dmpFilesize
7.7MB
-
memory/3916-83-0x0000000073EF0000-0x00000000746A0000-memory.dmpFilesize
7.7MB
-
memory/3916-36-0x0000000073EF0000-0x00000000746A0000-memory.dmpFilesize
7.7MB
-
memory/3916-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB