Analysis
-
max time kernel
141s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 21:40
Static task
static1
Behavioral task
behavioral1
Sample
40e6462c4b45d7f081b00cdcd7c8106ee6fa786e4c06bcbaae181b19e20a994b_JC.exe
Resource
win7-20230831-en
General
-
Target
40e6462c4b45d7f081b00cdcd7c8106ee6fa786e4c06bcbaae181b19e20a994b_JC.exe
-
Size
1.1MB
-
MD5
badb8a1fe2697679c6e714f855f7e3d2
-
SHA1
891999759c2c5752a2def858cbca33cb13a63dd0
-
SHA256
40e6462c4b45d7f081b00cdcd7c8106ee6fa786e4c06bcbaae181b19e20a994b
-
SHA512
671c5fac0deb8ca7c54868438da2315a8170d7a17c85086b868135f8b21601ef6c3ab6371afac0bbdd87fe6a6b2590d5626462c15dd1f1a8f8ff3102b4a62981
-
SSDEEP
24576:WyCHUD206M94Y/FY3ZQAZehWY+I+zofr:llvBSXQ1+J
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1908-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1908-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1908-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1908-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3676-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t0672277.exeexplothe.exeu8293987.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation t0672277.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation u8293987.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z3439702.exez3826702.exez6941248.exez7231219.exeq9065847.exer1647868.exes6660687.exet0672277.exeexplothe.exeu8293987.exelegota.exew3220307.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 1880 z3439702.exe 4140 z3826702.exe 1440 z6941248.exe 4732 z7231219.exe 2012 q9065847.exe 4116 r1647868.exe 3296 s6660687.exe 2120 t0672277.exe 3496 explothe.exe 2556 u8293987.exe 2456 legota.exe 4384 w3220307.exe 2896 explothe.exe 4092 legota.exe 4704 explothe.exe 3988 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 1672 rundll32.exe 1372 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z3439702.exez3826702.exez6941248.exez7231219.exe40e6462c4b45d7f081b00cdcd7c8106ee6fa786e4c06bcbaae181b19e20a994b_JC.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z3439702.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z3826702.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z6941248.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z7231219.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 40e6462c4b45d7f081b00cdcd7c8106ee6fa786e4c06bcbaae181b19e20a994b_JC.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q9065847.exer1647868.exes6660687.exedescription pid process target process PID 2012 set thread context of 3676 2012 q9065847.exe AppLaunch.exe PID 4116 set thread context of 1908 4116 r1647868.exe AppLaunch.exe PID 3296 set thread context of 1332 3296 s6660687.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 912 2012 WerFault.exe q9065847.exe 4924 4116 WerFault.exe r1647868.exe 536 1908 WerFault.exe AppLaunch.exe 3084 3296 WerFault.exe s6660687.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3748 schtasks.exe 4872 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 3676 AppLaunch.exe 3676 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3676 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
40e6462c4b45d7f081b00cdcd7c8106ee6fa786e4c06bcbaae181b19e20a994b_JC.exez3439702.exez3826702.exez6941248.exez7231219.exeq9065847.exer1647868.exes6660687.exet0672277.exeexplothe.exeu8293987.exedescription pid process target process PID 3816 wrote to memory of 1880 3816 40e6462c4b45d7f081b00cdcd7c8106ee6fa786e4c06bcbaae181b19e20a994b_JC.exe z3439702.exe PID 3816 wrote to memory of 1880 3816 40e6462c4b45d7f081b00cdcd7c8106ee6fa786e4c06bcbaae181b19e20a994b_JC.exe z3439702.exe PID 3816 wrote to memory of 1880 3816 40e6462c4b45d7f081b00cdcd7c8106ee6fa786e4c06bcbaae181b19e20a994b_JC.exe z3439702.exe PID 1880 wrote to memory of 4140 1880 z3439702.exe z3826702.exe PID 1880 wrote to memory of 4140 1880 z3439702.exe z3826702.exe PID 1880 wrote to memory of 4140 1880 z3439702.exe z3826702.exe PID 4140 wrote to memory of 1440 4140 z3826702.exe z6941248.exe PID 4140 wrote to memory of 1440 4140 z3826702.exe z6941248.exe PID 4140 wrote to memory of 1440 4140 z3826702.exe z6941248.exe PID 1440 wrote to memory of 4732 1440 z6941248.exe z7231219.exe PID 1440 wrote to memory of 4732 1440 z6941248.exe z7231219.exe PID 1440 wrote to memory of 4732 1440 z6941248.exe z7231219.exe PID 4732 wrote to memory of 2012 4732 z7231219.exe q9065847.exe PID 4732 wrote to memory of 2012 4732 z7231219.exe q9065847.exe PID 4732 wrote to memory of 2012 4732 z7231219.exe q9065847.exe PID 2012 wrote to memory of 3676 2012 q9065847.exe AppLaunch.exe PID 2012 wrote to memory of 3676 2012 q9065847.exe AppLaunch.exe PID 2012 wrote to memory of 3676 2012 q9065847.exe AppLaunch.exe PID 2012 wrote to memory of 3676 2012 q9065847.exe AppLaunch.exe PID 2012 wrote to memory of 3676 2012 q9065847.exe AppLaunch.exe PID 2012 wrote to memory of 3676 2012 q9065847.exe AppLaunch.exe PID 2012 wrote to memory of 3676 2012 q9065847.exe AppLaunch.exe PID 2012 wrote to memory of 3676 2012 q9065847.exe AppLaunch.exe PID 4732 wrote to memory of 4116 4732 z7231219.exe r1647868.exe PID 4732 wrote to memory of 4116 4732 z7231219.exe r1647868.exe PID 4732 wrote to memory of 4116 4732 z7231219.exe r1647868.exe PID 4116 wrote to memory of 1908 4116 r1647868.exe AppLaunch.exe PID 4116 wrote to memory of 1908 4116 r1647868.exe AppLaunch.exe PID 4116 wrote to memory of 1908 4116 r1647868.exe AppLaunch.exe PID 4116 wrote to memory of 1908 4116 r1647868.exe AppLaunch.exe PID 4116 wrote to memory of 1908 4116 r1647868.exe AppLaunch.exe PID 4116 wrote to memory of 1908 4116 r1647868.exe AppLaunch.exe PID 4116 wrote to memory of 1908 4116 r1647868.exe AppLaunch.exe PID 4116 wrote to memory of 1908 4116 r1647868.exe AppLaunch.exe PID 4116 wrote to memory of 1908 4116 r1647868.exe AppLaunch.exe PID 4116 wrote to memory of 1908 4116 r1647868.exe AppLaunch.exe PID 1440 wrote to memory of 3296 1440 z6941248.exe s6660687.exe PID 1440 wrote to memory of 3296 1440 z6941248.exe s6660687.exe PID 1440 wrote to memory of 3296 1440 z6941248.exe s6660687.exe PID 3296 wrote to memory of 1332 3296 s6660687.exe AppLaunch.exe PID 3296 wrote to memory of 1332 3296 s6660687.exe AppLaunch.exe PID 3296 wrote to memory of 1332 3296 s6660687.exe AppLaunch.exe PID 3296 wrote to memory of 1332 3296 s6660687.exe AppLaunch.exe PID 3296 wrote to memory of 1332 3296 s6660687.exe AppLaunch.exe PID 3296 wrote to memory of 1332 3296 s6660687.exe AppLaunch.exe PID 3296 wrote to memory of 1332 3296 s6660687.exe AppLaunch.exe PID 3296 wrote to memory of 1332 3296 s6660687.exe AppLaunch.exe PID 4140 wrote to memory of 2120 4140 z3826702.exe t0672277.exe PID 4140 wrote to memory of 2120 4140 z3826702.exe t0672277.exe PID 4140 wrote to memory of 2120 4140 z3826702.exe t0672277.exe PID 2120 wrote to memory of 3496 2120 t0672277.exe explothe.exe PID 2120 wrote to memory of 3496 2120 t0672277.exe explothe.exe PID 2120 wrote to memory of 3496 2120 t0672277.exe explothe.exe PID 1880 wrote to memory of 2556 1880 z3439702.exe u8293987.exe PID 1880 wrote to memory of 2556 1880 z3439702.exe u8293987.exe PID 1880 wrote to memory of 2556 1880 z3439702.exe u8293987.exe PID 3496 wrote to memory of 3748 3496 explothe.exe schtasks.exe PID 3496 wrote to memory of 3748 3496 explothe.exe schtasks.exe PID 3496 wrote to memory of 3748 3496 explothe.exe schtasks.exe PID 3496 wrote to memory of 4676 3496 explothe.exe cmd.exe PID 3496 wrote to memory of 4676 3496 explothe.exe cmd.exe PID 3496 wrote to memory of 4676 3496 explothe.exe cmd.exe PID 2556 wrote to memory of 2456 2556 u8293987.exe legota.exe PID 2556 wrote to memory of 2456 2556 u8293987.exe legota.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\40e6462c4b45d7f081b00cdcd7c8106ee6fa786e4c06bcbaae181b19e20a994b_JC.exe"C:\Users\Admin\AppData\Local\Temp\40e6462c4b45d7f081b00cdcd7c8106ee6fa786e4c06bcbaae181b19e20a994b_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3439702.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3439702.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3826702.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3826702.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6941248.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6941248.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7231219.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7231219.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9065847.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9065847.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3676 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 1367⤵
- Program crash
PID:912 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1647868.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1647868.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:1908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1908 -s 5408⤵
- Program crash
PID:536 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4116 -s 1367⤵
- Program crash
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6660687.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6660687.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:1332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 1406⤵
- Program crash
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0672277.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0672277.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:3748 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:4676
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3524
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:732
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:2460
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2724
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:2124
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:1544
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8293987.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8293987.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:2456 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:4872 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:4484
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2196
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:3972
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:4984
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2844
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:1564
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:224
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3220307.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3220307.exe2⤵
- Executes dropped EXE
PID:4384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2012 -ip 20121⤵PID:2932
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4116 -ip 41161⤵PID:3200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 1908 -ip 19081⤵PID:5116
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 3296 -ip 32961⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:2896
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4092
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:4704
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:3988
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3220307.exeFilesize
23KB
MD530880c3e02348684b302218364c87a35
SHA13620287249ba749f455cbaf1d495899531b2bd92
SHA2565d808ed07d0d51f6aaf00ed9306e57669552b32f77592dc31e70b0454aa2dc23
SHA512604dcba1150f49225154735de3f79a5d4e1580c03f3e0a04d797bf675e4e74d4bcc86f80d75a7493936f83e99de558fee718282a78185c24eb69115edce2673d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3220307.exeFilesize
23KB
MD530880c3e02348684b302218364c87a35
SHA13620287249ba749f455cbaf1d495899531b2bd92
SHA2565d808ed07d0d51f6aaf00ed9306e57669552b32f77592dc31e70b0454aa2dc23
SHA512604dcba1150f49225154735de3f79a5d4e1580c03f3e0a04d797bf675e4e74d4bcc86f80d75a7493936f83e99de558fee718282a78185c24eb69115edce2673d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3439702.exeFilesize
983KB
MD5f7b59b095127dea9183116a1f46f0637
SHA1b502d1e88c3266e58d70ce1fd4e8436836f1eb7b
SHA25685d663a4a193e120b092ba5e4f08015331f49394fbe742f6c5fb8e92dc7a717b
SHA51256870fa54adca3ae4aac7a4064442bdecb00119e5229fa5630e12aa15c85900facc9361d1c0c5a42d31f8d06f61cd2eca0092936b38178a18b62af245e273af4
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3439702.exeFilesize
983KB
MD5f7b59b095127dea9183116a1f46f0637
SHA1b502d1e88c3266e58d70ce1fd4e8436836f1eb7b
SHA25685d663a4a193e120b092ba5e4f08015331f49394fbe742f6c5fb8e92dc7a717b
SHA51256870fa54adca3ae4aac7a4064442bdecb00119e5229fa5630e12aa15c85900facc9361d1c0c5a42d31f8d06f61cd2eca0092936b38178a18b62af245e273af4
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8293987.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u8293987.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3826702.exeFilesize
800KB
MD5246b4d4cc61af7fd02c81ac2842691f8
SHA142ed6ffa6726fb1878727bbfea50fb13487ae598
SHA25683241bab76ed6b89e3d984d015af072ce79175a1337c47940e3280b2e468aef1
SHA512257a5d7e6d440498af842348f047180134a74a619f693732168f3c360b529d2e3f092d91c65105ecabebb8dd7de99381af4527fd0b7bc02dad70b48373fb71da
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3826702.exeFilesize
800KB
MD5246b4d4cc61af7fd02c81ac2842691f8
SHA142ed6ffa6726fb1878727bbfea50fb13487ae598
SHA25683241bab76ed6b89e3d984d015af072ce79175a1337c47940e3280b2e468aef1
SHA512257a5d7e6d440498af842348f047180134a74a619f693732168f3c360b529d2e3f092d91c65105ecabebb8dd7de99381af4527fd0b7bc02dad70b48373fb71da
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0672277.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0672277.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6941248.exeFilesize
617KB
MD5feacb5e8881608dc6f0f9d7623f6a103
SHA1ba2702116b17c2dac5d6f275267e235677ac3982
SHA256cf1046198c8b11d9ed24d0494fecb52866539fc2905065ef25f114d66ed37bd1
SHA512ee117ce44bff950414ce2fababaad568a0c17c57b6cd7b4478654975e7be6b66bbe4a18210f6ba2c2dd355c3216d708f9bbf8503e01c1ebc3266970f34db1b8a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6941248.exeFilesize
617KB
MD5feacb5e8881608dc6f0f9d7623f6a103
SHA1ba2702116b17c2dac5d6f275267e235677ac3982
SHA256cf1046198c8b11d9ed24d0494fecb52866539fc2905065ef25f114d66ed37bd1
SHA512ee117ce44bff950414ce2fababaad568a0c17c57b6cd7b4478654975e7be6b66bbe4a18210f6ba2c2dd355c3216d708f9bbf8503e01c1ebc3266970f34db1b8a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6660687.exeFilesize
390KB
MD5541ad6c348f5734200d38da1da994e48
SHA1f834c147346d90887f5432e6f689832fd29458ef
SHA256eaa8058238e0fe4aeed9b2bb672d7211a7882f46cb1daf0593390ae9e7de7666
SHA512b231fc0bc566d380567a77f3796a60e4ee7d8d35e1ca5662b01d748f69f347a78955b9e28f4ea855918c3c52781322309a520e2df56055aa36a10f32eb6a005c
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6660687.exeFilesize
390KB
MD5541ad6c348f5734200d38da1da994e48
SHA1f834c147346d90887f5432e6f689832fd29458ef
SHA256eaa8058238e0fe4aeed9b2bb672d7211a7882f46cb1daf0593390ae9e7de7666
SHA512b231fc0bc566d380567a77f3796a60e4ee7d8d35e1ca5662b01d748f69f347a78955b9e28f4ea855918c3c52781322309a520e2df56055aa36a10f32eb6a005c
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7231219.exeFilesize
346KB
MD54a295dd7f99af95b4567623c80bc956a
SHA175981ddd29dc322493e9931df4210695977a4856
SHA25692309537c8511bf2aef47d3ba07a88fb9f0186d6b63d43f3c5a92de98783e7e4
SHA5122768771d9de11b998de52d706dde97b4e2f9097bbcdfedceb62eb5b21b1eabeebe9bc6ce9987a63dbdc4f1dc499e166aa6f46f2fa01c71fa1a2142ef6860604f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7231219.exeFilesize
346KB
MD54a295dd7f99af95b4567623c80bc956a
SHA175981ddd29dc322493e9931df4210695977a4856
SHA25692309537c8511bf2aef47d3ba07a88fb9f0186d6b63d43f3c5a92de98783e7e4
SHA5122768771d9de11b998de52d706dde97b4e2f9097bbcdfedceb62eb5b21b1eabeebe9bc6ce9987a63dbdc4f1dc499e166aa6f46f2fa01c71fa1a2142ef6860604f
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9065847.exeFilesize
227KB
MD58beac6a08960ebdbf6ceb3125d5beb33
SHA185245a73345caad6dff0191f4e2a3cf4dae83d3b
SHA25644ae8e025531148f7c52cf5b99ec15deba72b7d22e5778b9b90071ce59d18dca
SHA5124f0fc375220378d5663f68c65c019f72c2eac440d43b9afacb61dd7d82eae58c3061e95c46025fcbcbec0c345e56093bb05841b403b74f36890f8d29c6612582
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q9065847.exeFilesize
227KB
MD58beac6a08960ebdbf6ceb3125d5beb33
SHA185245a73345caad6dff0191f4e2a3cf4dae83d3b
SHA25644ae8e025531148f7c52cf5b99ec15deba72b7d22e5778b9b90071ce59d18dca
SHA5124f0fc375220378d5663f68c65c019f72c2eac440d43b9afacb61dd7d82eae58c3061e95c46025fcbcbec0c345e56093bb05841b403b74f36890f8d29c6612582
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1647868.exeFilesize
356KB
MD57b62b6d4e37294c96fb3270fe0c0ee35
SHA14990640b9e93f968ad8880682423b0d9451ae24a
SHA256aa8bb2145a75dc024f34459f435dc2c69438827fb3d27bfd3c0476d688cf56cf
SHA512ac0bde9ba31db53bd34cf6c9f3f5fd6e26a84533dd1a99f1c1f2942b7ddf545ad28be81cef86a1aa41aadc16290d39e90e796cf89556ba91fc629a4c95ac433e
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r1647868.exeFilesize
356KB
MD57b62b6d4e37294c96fb3270fe0c0ee35
SHA14990640b9e93f968ad8880682423b0d9451ae24a
SHA256aa8bb2145a75dc024f34459f435dc2c69438827fb3d27bfd3c0476d688cf56cf
SHA512ac0bde9ba31db53bd34cf6c9f3f5fd6e26a84533dd1a99f1c1f2942b7ddf545ad28be81cef86a1aa41aadc16290d39e90e796cf89556ba91fc629a4c95ac433e
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1332-51-0x0000000000C10000-0x0000000000C16000-memory.dmpFilesize
24KB
-
memory/1332-69-0x0000000004E60000-0x0000000004E9C000-memory.dmpFilesize
240KB
-
memory/1332-66-0x0000000002780000-0x0000000002792000-memory.dmpFilesize
72KB
-
memory/1332-85-0x0000000004ED0000-0x0000000004F1C000-memory.dmpFilesize
304KB
-
memory/1332-61-0x0000000004FE0000-0x00000000050EA000-memory.dmpFilesize
1.0MB
-
memory/1332-60-0x00000000054F0000-0x0000000005B08000-memory.dmpFilesize
6.1MB
-
memory/1332-88-0x00000000741E0000-0x0000000074990000-memory.dmpFilesize
7.7MB
-
memory/1332-65-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/1332-90-0x0000000004EC0000-0x0000000004ED0000-memory.dmpFilesize
64KB
-
memory/1332-49-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1332-50-0x00000000741E0000-0x0000000074990000-memory.dmpFilesize
7.7MB
-
memory/1908-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1908-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1908-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1908-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3676-37-0x00000000741E0000-0x0000000074990000-memory.dmpFilesize
7.7MB
-
memory/3676-58-0x00000000741E0000-0x0000000074990000-memory.dmpFilesize
7.7MB
-
memory/3676-36-0x00000000741E0000-0x0000000074990000-memory.dmpFilesize
7.7MB
-
memory/3676-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB