Analysis
-
max time kernel
166s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 21:41
Static task
static1
Behavioral task
behavioral1
Sample
2d35c6027e35619f91d84948e53357617f7c31780b29f23ad5bc46e52de5563c_JC.exe
Resource
win7-20230831-en
General
-
Target
2d35c6027e35619f91d84948e53357617f7c31780b29f23ad5bc46e52de5563c_JC.exe
-
Size
1.1MB
-
MD5
b6993ec4efe8c5c7cb57cb14ad2d228b
-
SHA1
8ca71391f2dbc6cb03927f66c9fc67faea4d6166
-
SHA256
2d35c6027e35619f91d84948e53357617f7c31780b29f23ad5bc46e52de5563c
-
SHA512
82830e3cc9167125d3c59a10bb44af340f8bb0ee20a42e84092920f64164c2790b54fa60661b8c5c44dd74d0b3c48a8f02fedc97be164e16ea0bbf241c74b23b
-
SSDEEP
24576:tyouCM/s7ZlZW63sUiGEKn+bb4GN8PXwoaVjpLjM4z3U6Um:IpCC68Up+pRo6jMsU6U
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1004-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1004-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1004-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1004-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2620-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t4904189.exeexplothe.exeu2915663.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation t4904189.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation u2915663.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z9609135.exez7246784.exez1462459.exez9564647.exeq3729767.exer7975677.exes7915035.exet4904189.exeexplothe.exeu2915663.exelegota.exew1769106.exelegota.exeexplothe.exelegota.exeexplothe.exepid process 3312 z9609135.exe 4392 z7246784.exe 4408 z1462459.exe 3548 z9564647.exe 4228 q3729767.exe 4368 r7975677.exe 4340 s7915035.exe 676 t4904189.exe 4736 explothe.exe 2228 u2915663.exe 3876 legota.exe 4796 w1769106.exe 4056 legota.exe 4256 explothe.exe 492 legota.exe 3956 explothe.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3084 rundll32.exe 5104 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
2d35c6027e35619f91d84948e53357617f7c31780b29f23ad5bc46e52de5563c_JC.exez9609135.exez7246784.exez1462459.exez9564647.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 2d35c6027e35619f91d84948e53357617f7c31780b29f23ad5bc46e52de5563c_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z9609135.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z7246784.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z1462459.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z9564647.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q3729767.exer7975677.exes7915035.exedescription pid process target process PID 4228 set thread context of 2620 4228 q3729767.exe AppLaunch.exe PID 4368 set thread context of 1004 4368 r7975677.exe AppLaunch.exe PID 4340 set thread context of 448 4340 s7915035.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 2432 4228 WerFault.exe q3729767.exe 4348 4368 WerFault.exe r7975677.exe 1160 1004 WerFault.exe AppLaunch.exe 2948 4340 WerFault.exe s7915035.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3180 schtasks.exe 3436 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 2620 AppLaunch.exe 2620 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2620 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2d35c6027e35619f91d84948e53357617f7c31780b29f23ad5bc46e52de5563c_JC.exez9609135.exez7246784.exez1462459.exez9564647.exeq3729767.exer7975677.exes7915035.exet4904189.exeexplothe.exedescription pid process target process PID 4320 wrote to memory of 3312 4320 2d35c6027e35619f91d84948e53357617f7c31780b29f23ad5bc46e52de5563c_JC.exe z9609135.exe PID 4320 wrote to memory of 3312 4320 2d35c6027e35619f91d84948e53357617f7c31780b29f23ad5bc46e52de5563c_JC.exe z9609135.exe PID 4320 wrote to memory of 3312 4320 2d35c6027e35619f91d84948e53357617f7c31780b29f23ad5bc46e52de5563c_JC.exe z9609135.exe PID 3312 wrote to memory of 4392 3312 z9609135.exe z7246784.exe PID 3312 wrote to memory of 4392 3312 z9609135.exe z7246784.exe PID 3312 wrote to memory of 4392 3312 z9609135.exe z7246784.exe PID 4392 wrote to memory of 4408 4392 z7246784.exe z1462459.exe PID 4392 wrote to memory of 4408 4392 z7246784.exe z1462459.exe PID 4392 wrote to memory of 4408 4392 z7246784.exe z1462459.exe PID 4408 wrote to memory of 3548 4408 z1462459.exe z9564647.exe PID 4408 wrote to memory of 3548 4408 z1462459.exe z9564647.exe PID 4408 wrote to memory of 3548 4408 z1462459.exe z9564647.exe PID 3548 wrote to memory of 4228 3548 z9564647.exe q3729767.exe PID 3548 wrote to memory of 4228 3548 z9564647.exe q3729767.exe PID 3548 wrote to memory of 4228 3548 z9564647.exe q3729767.exe PID 4228 wrote to memory of 2620 4228 q3729767.exe AppLaunch.exe PID 4228 wrote to memory of 2620 4228 q3729767.exe AppLaunch.exe PID 4228 wrote to memory of 2620 4228 q3729767.exe AppLaunch.exe PID 4228 wrote to memory of 2620 4228 q3729767.exe AppLaunch.exe PID 4228 wrote to memory of 2620 4228 q3729767.exe AppLaunch.exe PID 4228 wrote to memory of 2620 4228 q3729767.exe AppLaunch.exe PID 4228 wrote to memory of 2620 4228 q3729767.exe AppLaunch.exe PID 4228 wrote to memory of 2620 4228 q3729767.exe AppLaunch.exe PID 3548 wrote to memory of 4368 3548 z9564647.exe r7975677.exe PID 3548 wrote to memory of 4368 3548 z9564647.exe r7975677.exe PID 3548 wrote to memory of 4368 3548 z9564647.exe r7975677.exe PID 4368 wrote to memory of 2628 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 2628 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 2628 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 4804 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 4804 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 4804 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 1004 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 1004 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 1004 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 1004 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 1004 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 1004 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 1004 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 1004 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 1004 4368 r7975677.exe AppLaunch.exe PID 4368 wrote to memory of 1004 4368 r7975677.exe AppLaunch.exe PID 4408 wrote to memory of 4340 4408 z1462459.exe s7915035.exe PID 4408 wrote to memory of 4340 4408 z1462459.exe s7915035.exe PID 4408 wrote to memory of 4340 4408 z1462459.exe s7915035.exe PID 4340 wrote to memory of 448 4340 s7915035.exe AppLaunch.exe PID 4340 wrote to memory of 448 4340 s7915035.exe AppLaunch.exe PID 4340 wrote to memory of 448 4340 s7915035.exe AppLaunch.exe PID 4340 wrote to memory of 448 4340 s7915035.exe AppLaunch.exe PID 4340 wrote to memory of 448 4340 s7915035.exe AppLaunch.exe PID 4340 wrote to memory of 448 4340 s7915035.exe AppLaunch.exe PID 4340 wrote to memory of 448 4340 s7915035.exe AppLaunch.exe PID 4340 wrote to memory of 448 4340 s7915035.exe AppLaunch.exe PID 4392 wrote to memory of 676 4392 z7246784.exe t4904189.exe PID 4392 wrote to memory of 676 4392 z7246784.exe t4904189.exe PID 4392 wrote to memory of 676 4392 z7246784.exe t4904189.exe PID 676 wrote to memory of 4736 676 t4904189.exe explothe.exe PID 676 wrote to memory of 4736 676 t4904189.exe explothe.exe PID 676 wrote to memory of 4736 676 t4904189.exe explothe.exe PID 3312 wrote to memory of 2228 3312 z9609135.exe u2915663.exe PID 3312 wrote to memory of 2228 3312 z9609135.exe u2915663.exe PID 3312 wrote to memory of 2228 3312 z9609135.exe u2915663.exe PID 4736 wrote to memory of 3180 4736 explothe.exe schtasks.exe PID 4736 wrote to memory of 3180 4736 explothe.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d35c6027e35619f91d84948e53357617f7c31780b29f23ad5bc46e52de5563c_JC.exe"C:\Users\Admin\AppData\Local\Temp\2d35c6027e35619f91d84948e53357617f7c31780b29f23ad5bc46e52de5563c_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9609135.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9609135.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7246784.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7246784.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1462459.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1462459.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9564647.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9564647.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3729767.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3729767.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 567⤵
- Program crash
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7975677.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7975677.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:2628
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:4804
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:1004
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 5408⤵
- Program crash
PID:1160 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4368 -s 6047⤵
- Program crash
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7915035.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7915035.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 5846⤵
- Program crash
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4904189.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4904189.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
PID:3180 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:4312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1608
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵PID:3584
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵PID:4536
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4992
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:2580
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:2432
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2915663.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2915663.exe3⤵
- Checks computer location settings
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3876 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:3436 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:1304
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2296
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:756
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:1236
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4740
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:1376
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:2060
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1769106.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1769106.exe2⤵
- Executes dropped EXE
PID:4796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4228 -ip 42281⤵PID:1496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4368 -ip 43681⤵PID:3288
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1004 -ip 10041⤵PID:2064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4340 -ip 43401⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4056
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:4256
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:492
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
PID:3956
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1769106.exeFilesize
23KB
MD5bf69433c9b766a9b160a14653ca80d48
SHA1621e4c6017cabf899dcb5d4552e9144beb4063a7
SHA256338017c50863f50902e00335d47bb0561d79a111aaa7cda9d06f7fcfbc41f6b4
SHA512e35bad754949d3f5fe332cfad54e219ec7c91a7f3441cc5775d47177592d40ffcf029f2c1c781ca85f87103bea033f6967700bdb7e3944a5d9dae8268dec757e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w1769106.exeFilesize
23KB
MD5bf69433c9b766a9b160a14653ca80d48
SHA1621e4c6017cabf899dcb5d4552e9144beb4063a7
SHA256338017c50863f50902e00335d47bb0561d79a111aaa7cda9d06f7fcfbc41f6b4
SHA512e35bad754949d3f5fe332cfad54e219ec7c91a7f3441cc5775d47177592d40ffcf029f2c1c781ca85f87103bea033f6967700bdb7e3944a5d9dae8268dec757e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9609135.exeFilesize
981KB
MD53d2c446c9ae466b22727740e698f9f01
SHA1cb1ff4695ff558ada26d24737e67d54b599b6f64
SHA256d38caf8d6d8da5ac132c633d60ba933b0945f56ed8932939132c1003b786cdea
SHA512908f12ba82229aa184d992bd19d16664bb2719f7a5c29ea88dad60be44b7d7bee166f4bc03b458b43e60f403aececcb3ae1c7c9b5aa8bf2067a72c0e339144f5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9609135.exeFilesize
981KB
MD53d2c446c9ae466b22727740e698f9f01
SHA1cb1ff4695ff558ada26d24737e67d54b599b6f64
SHA256d38caf8d6d8da5ac132c633d60ba933b0945f56ed8932939132c1003b786cdea
SHA512908f12ba82229aa184d992bd19d16664bb2719f7a5c29ea88dad60be44b7d7bee166f4bc03b458b43e60f403aececcb3ae1c7c9b5aa8bf2067a72c0e339144f5
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2915663.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2915663.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7246784.exeFilesize
799KB
MD5ed4128a7b0b824e1f8d0212a6ea27d43
SHA1d1a1010682bf8d1be13efdd57adad3d80425cddd
SHA25663902c0e786d2266100a13f5778ec1c53161333b843d024db1e5f82df133f7e3
SHA51243228d8924572a1cf3f5134b1147dcbd1ac3ec9dca76476583bad65818023f32bdf862efbf73df8681f57102e8b202d2d566ee0469608923ebde99b5e2c6fee2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7246784.exeFilesize
799KB
MD5ed4128a7b0b824e1f8d0212a6ea27d43
SHA1d1a1010682bf8d1be13efdd57adad3d80425cddd
SHA25663902c0e786d2266100a13f5778ec1c53161333b843d024db1e5f82df133f7e3
SHA51243228d8924572a1cf3f5134b1147dcbd1ac3ec9dca76476583bad65818023f32bdf862efbf73df8681f57102e8b202d2d566ee0469608923ebde99b5e2c6fee2
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4904189.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4904189.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1462459.exeFilesize
616KB
MD5165084f946f2567081ee5853613b0392
SHA126cda3b1137181ec15e65e66ae0aae08af168af9
SHA256a736a634a6682aee4d408becd9757b6ae98c73bdb6a5516fae011dbf26a330f5
SHA5122b2ea1de81a52771a794042e7c0ef7891435c78876e0b3b8e32bea7c443c7a0abda8c4aeb7beeac0daa22cb61c724d613ac74a63935637e3a8059ebe4d859f90
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1462459.exeFilesize
616KB
MD5165084f946f2567081ee5853613b0392
SHA126cda3b1137181ec15e65e66ae0aae08af168af9
SHA256a736a634a6682aee4d408becd9757b6ae98c73bdb6a5516fae011dbf26a330f5
SHA5122b2ea1de81a52771a794042e7c0ef7891435c78876e0b3b8e32bea7c443c7a0abda8c4aeb7beeac0daa22cb61c724d613ac74a63935637e3a8059ebe4d859f90
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7915035.exeFilesize
390KB
MD5306a6f1a237c67b7d1092f0e57ffb113
SHA1bee17f7ee614ce93c4503a99beded8b223933076
SHA2567b5c21b2c978d2a3a4952b569903e114c420cbf26f9def9a1bd93ff462e82421
SHA5123b550d30e80d046e44476d157cb2be573d92f3b77c9b12fd4508453a26a1e80650fe4e90da0652bc9f9e91080b9009e08a8d59771e510ff1598bc3423e01c5cb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7915035.exeFilesize
390KB
MD5306a6f1a237c67b7d1092f0e57ffb113
SHA1bee17f7ee614ce93c4503a99beded8b223933076
SHA2567b5c21b2c978d2a3a4952b569903e114c420cbf26f9def9a1bd93ff462e82421
SHA5123b550d30e80d046e44476d157cb2be573d92f3b77c9b12fd4508453a26a1e80650fe4e90da0652bc9f9e91080b9009e08a8d59771e510ff1598bc3423e01c5cb
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9564647.exeFilesize
346KB
MD534d5bc93cdd736157324ef5e05f552b9
SHA1181c21206817fdcf3e6c1ef87a388fb228885f77
SHA25632019428d6015fae23ba18a91f83442ab67dcbf0d2b3832e8c7de84557e1044b
SHA512c69d30f2fe45eeb8657e43eb525168e7b980eeb584abbf53d031dd07c0224bc5795269611874b891320850e33da84dff246c23300c4c48931eeb07725a49ffe1
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9564647.exeFilesize
346KB
MD534d5bc93cdd736157324ef5e05f552b9
SHA1181c21206817fdcf3e6c1ef87a388fb228885f77
SHA25632019428d6015fae23ba18a91f83442ab67dcbf0d2b3832e8c7de84557e1044b
SHA512c69d30f2fe45eeb8657e43eb525168e7b980eeb584abbf53d031dd07c0224bc5795269611874b891320850e33da84dff246c23300c4c48931eeb07725a49ffe1
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3729767.exeFilesize
227KB
MD5de78addc1e228ffbb8f8e08cb320baa6
SHA17cd6c24a3de9165225951a8107aaaca05f58e95d
SHA2563498aef634918e63a7ceda3d5a314d021a2ddadbfa935ebfd3729f91f6438752
SHA51239b58a283bcc6b2d2e51aa7f95d62990a3e82c36686a5d84f970bc3c2a612d5bf6ca4076d57e73316340322d5d223b9529cd58e25b3fed8ecb45e6d6d39598d8
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q3729767.exeFilesize
227KB
MD5de78addc1e228ffbb8f8e08cb320baa6
SHA17cd6c24a3de9165225951a8107aaaca05f58e95d
SHA2563498aef634918e63a7ceda3d5a314d021a2ddadbfa935ebfd3729f91f6438752
SHA51239b58a283bcc6b2d2e51aa7f95d62990a3e82c36686a5d84f970bc3c2a612d5bf6ca4076d57e73316340322d5d223b9529cd58e25b3fed8ecb45e6d6d39598d8
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7975677.exeFilesize
356KB
MD5ed86ec2a5af1ec907d39fc317903b52a
SHA16848ee6095c9f0f30a7f1670fe26086d5f2a487e
SHA2561bdd29aba3919f7f18c07918964aa82c6d91af0db6b489d813d36822c30f344b
SHA512760ae6a6387385c58f99ff143f40573d32ba5bc2299252a03bd6bd26e4defa1eb52aa18ec0fff8b82abea0e376585aaa2808009e1912604a3b519bd513594042
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7975677.exeFilesize
356KB
MD5ed86ec2a5af1ec907d39fc317903b52a
SHA16848ee6095c9f0f30a7f1670fe26086d5f2a487e
SHA2561bdd29aba3919f7f18c07918964aa82c6d91af0db6b489d813d36822c30f344b
SHA512760ae6a6387385c58f99ff143f40573d32ba5bc2299252a03bd6bd26e4defa1eb52aa18ec0fff8b82abea0e376585aaa2808009e1912604a3b519bd513594042
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/448-50-0x0000000073F20000-0x00000000746D0000-memory.dmpFilesize
7.7MB
-
memory/448-59-0x0000000005570000-0x0000000005580000-memory.dmpFilesize
64KB
-
memory/448-49-0x0000000002CE0000-0x0000000002CE6000-memory.dmpFilesize
24KB
-
memory/448-56-0x0000000005BA0000-0x00000000061B8000-memory.dmpFilesize
6.1MB
-
memory/448-57-0x0000000005690000-0x000000000579A000-memory.dmpFilesize
1.0MB
-
memory/448-87-0x0000000073F20000-0x00000000746D0000-memory.dmpFilesize
7.7MB
-
memory/448-88-0x0000000005570000-0x0000000005580000-memory.dmpFilesize
64KB
-
memory/448-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/448-58-0x0000000005580000-0x0000000005592000-memory.dmpFilesize
72KB
-
memory/448-65-0x0000000005620000-0x000000000566C000-memory.dmpFilesize
304KB
-
memory/448-61-0x00000000055A0000-0x00000000055DC000-memory.dmpFilesize
240KB
-
memory/1004-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1004-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1004-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1004-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2620-86-0x0000000073F20000-0x00000000746D0000-memory.dmpFilesize
7.7MB
-
memory/2620-84-0x0000000073F20000-0x00000000746D0000-memory.dmpFilesize
7.7MB
-
memory/2620-36-0x0000000073F20000-0x00000000746D0000-memory.dmpFilesize
7.7MB
-
memory/2620-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB