Analysis
-
max time kernel
141s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2023 21:03
Static task
static1
Behavioral task
behavioral1
Sample
ae1acfbe0694a8320a99f624c4045284c415ea8737f951b6931786b0bc456dbb.exe
Resource
win7-20230831-en
General
-
Target
ae1acfbe0694a8320a99f624c4045284c415ea8737f951b6931786b0bc456dbb.exe
-
Size
994KB
-
MD5
b40c35ff4d31b02fa5af30c8a1bee06b
-
SHA1
a6b054a5c2fabac04d3435b48fea24f88ca6f6ba
-
SHA256
ae1acfbe0694a8320a99f624c4045284c415ea8737f951b6931786b0bc456dbb
-
SHA512
3e4ffa1400192d4f562d95d7fa15aedf2fd30c3f626a45cd6377e65f7d0f58369491e6996e40fb1e1082e4ace54768885195b079bb7659105918103a188dec8a
-
SSDEEP
24576:ay3c+bKefyGX7Dze6IZJCqBNB019eaMGaEgUUo/Z:hM+lXSketXeX
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4760-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4760-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4760-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4760-46-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7571701.exe healer C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7571701.exe healer behavioral2/memory/1156-35-0x00000000001C0000-0x00000000001CA000-memory.dmp healer -
Processes:
q7571701.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection q7571701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" q7571701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" q7571701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" q7571701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" q7571701.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" q7571701.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legota.exet4091527.exeexplothe.exeu2690012.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation t4091527.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation u2690012.exe -
Executes dropped EXE 16 IoCs
Processes:
z9744320.exez4702737.exez2600862.exez6557727.exeq7571701.exer0665445.exes9838339.exet4091527.exeexplothe.exeu2690012.exelegota.exew9653131.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 5092 z9744320.exe 1888 z4702737.exe 4104 z2600862.exe 4856 z6557727.exe 1156 q7571701.exe 3260 r0665445.exe 1720 s9838339.exe 3708 t4091527.exe 4280 explothe.exe 4520 u2690012.exe 548 legota.exe 2784 w9653131.exe 3616 explothe.exe 3676 legota.exe 4528 explothe.exe 3712 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 2820 rundll32.exe 3220 rundll32.exe -
Processes:
q7571701.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" q7571701.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z4702737.exez2600862.exez6557727.exeae1acfbe0694a8320a99f624c4045284c415ea8737f951b6931786b0bc456dbb.exez9744320.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z4702737.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z2600862.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z6557727.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ae1acfbe0694a8320a99f624c4045284c415ea8737f951b6931786b0bc456dbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z9744320.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
r0665445.exes9838339.exedescription pid process target process PID 3260 set thread context of 4760 3260 r0665445.exe AppLaunch.exe PID 1720 set thread context of 2200 1720 s9838339.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 336 4760 WerFault.exe AppLaunch.exe 2340 3260 WerFault.exe r0665445.exe 1976 1720 WerFault.exe s9838339.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2456 schtasks.exe 4560 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
q7571701.exepid process 1156 q7571701.exe 1156 q7571701.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
q7571701.exedescription pid process Token: SeDebugPrivilege 1156 q7571701.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ae1acfbe0694a8320a99f624c4045284c415ea8737f951b6931786b0bc456dbb.exez9744320.exez4702737.exez2600862.exez6557727.exer0665445.exes9838339.exet4091527.exeexplothe.exeu2690012.exedescription pid process target process PID 2852 wrote to memory of 5092 2852 ae1acfbe0694a8320a99f624c4045284c415ea8737f951b6931786b0bc456dbb.exe z9744320.exe PID 2852 wrote to memory of 5092 2852 ae1acfbe0694a8320a99f624c4045284c415ea8737f951b6931786b0bc456dbb.exe z9744320.exe PID 2852 wrote to memory of 5092 2852 ae1acfbe0694a8320a99f624c4045284c415ea8737f951b6931786b0bc456dbb.exe z9744320.exe PID 5092 wrote to memory of 1888 5092 z9744320.exe z4702737.exe PID 5092 wrote to memory of 1888 5092 z9744320.exe z4702737.exe PID 5092 wrote to memory of 1888 5092 z9744320.exe z4702737.exe PID 1888 wrote to memory of 4104 1888 z4702737.exe z2600862.exe PID 1888 wrote to memory of 4104 1888 z4702737.exe z2600862.exe PID 1888 wrote to memory of 4104 1888 z4702737.exe z2600862.exe PID 4104 wrote to memory of 4856 4104 z2600862.exe z6557727.exe PID 4104 wrote to memory of 4856 4104 z2600862.exe z6557727.exe PID 4104 wrote to memory of 4856 4104 z2600862.exe z6557727.exe PID 4856 wrote to memory of 1156 4856 z6557727.exe q7571701.exe PID 4856 wrote to memory of 1156 4856 z6557727.exe q7571701.exe PID 4856 wrote to memory of 3260 4856 z6557727.exe r0665445.exe PID 4856 wrote to memory of 3260 4856 z6557727.exe r0665445.exe PID 4856 wrote to memory of 3260 4856 z6557727.exe r0665445.exe PID 3260 wrote to memory of 3232 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 3232 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 3232 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 756 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 756 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 756 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 4760 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 4760 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 4760 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 4760 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 4760 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 4760 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 4760 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 4760 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 4760 3260 r0665445.exe AppLaunch.exe PID 3260 wrote to memory of 4760 3260 r0665445.exe AppLaunch.exe PID 4104 wrote to memory of 1720 4104 z2600862.exe s9838339.exe PID 4104 wrote to memory of 1720 4104 z2600862.exe s9838339.exe PID 4104 wrote to memory of 1720 4104 z2600862.exe s9838339.exe PID 1720 wrote to memory of 4272 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 4272 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 4272 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 5020 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 5020 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 5020 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 2200 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 2200 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 2200 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 2200 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 2200 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 2200 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 2200 1720 s9838339.exe AppLaunch.exe PID 1720 wrote to memory of 2200 1720 s9838339.exe AppLaunch.exe PID 1888 wrote to memory of 3708 1888 z4702737.exe t4091527.exe PID 1888 wrote to memory of 3708 1888 z4702737.exe t4091527.exe PID 1888 wrote to memory of 3708 1888 z4702737.exe t4091527.exe PID 3708 wrote to memory of 4280 3708 t4091527.exe explothe.exe PID 3708 wrote to memory of 4280 3708 t4091527.exe explothe.exe PID 3708 wrote to memory of 4280 3708 t4091527.exe explothe.exe PID 5092 wrote to memory of 4520 5092 z9744320.exe u2690012.exe PID 5092 wrote to memory of 4520 5092 z9744320.exe u2690012.exe PID 5092 wrote to memory of 4520 5092 z9744320.exe u2690012.exe PID 4280 wrote to memory of 2456 4280 explothe.exe schtasks.exe PID 4280 wrote to memory of 2456 4280 explothe.exe schtasks.exe PID 4280 wrote to memory of 2456 4280 explothe.exe schtasks.exe PID 4520 wrote to memory of 548 4520 u2690012.exe legota.exe PID 4520 wrote to memory of 548 4520 u2690012.exe legota.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae1acfbe0694a8320a99f624c4045284c415ea8737f951b6931786b0bc456dbb.exe"C:\Users\Admin\AppData\Local\Temp\ae1acfbe0694a8320a99f624c4045284c415ea8737f951b6931786b0bc456dbb.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9744320.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9744320.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4702737.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4702737.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2600862.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2600862.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6557727.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6557727.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7571701.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7571701.exe6⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0665445.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0665445.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4760 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3260 -s 6047⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9838339.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9838339.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 5926⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4091527.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4091527.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2690012.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2690012.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9653131.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9653131.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3260 -ip 32601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4760 -ip 47601⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1720 -ip 17201⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9653131.exeFilesize
23KB
MD5eed3d8ee252a5a24754fb2f54501f69f
SHA127c0eb7025d123cb117299cc8f1eca54b26c9f36
SHA2562c62e977003aa285513f5374cc0c4632579780397bbd7aaedc85edcbf5e79f17
SHA51219c3c59745e795d16f2ecfc9190e5f7596a1b4ddaabc221c3d5e3986fbafd4896642b9da441aae4cb0871de205a85a51d80d3844d2f3cfcee1786f17cc122243
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w9653131.exeFilesize
23KB
MD5eed3d8ee252a5a24754fb2f54501f69f
SHA127c0eb7025d123cb117299cc8f1eca54b26c9f36
SHA2562c62e977003aa285513f5374cc0c4632579780397bbd7aaedc85edcbf5e79f17
SHA51219c3c59745e795d16f2ecfc9190e5f7596a1b4ddaabc221c3d5e3986fbafd4896642b9da441aae4cb0871de205a85a51d80d3844d2f3cfcee1786f17cc122243
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9744320.exeFilesize
892KB
MD595aed7ea133de6b77ca35ab593a90d20
SHA13bf13d9c34177754a62394636b337f4b1e0712d1
SHA25647c47724e0e39e1ec5d07bad6aa14127de9176e62ff34503bc22552079f80ba9
SHA512dd1ef82e54e22cc742e6138f0bf539ac2067aa2a36adfff9ccac40966fee7081cf8f205798daf710ce61650cc21985db660ae40100180b83bada455b3d669e33
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9744320.exeFilesize
892KB
MD595aed7ea133de6b77ca35ab593a90d20
SHA13bf13d9c34177754a62394636b337f4b1e0712d1
SHA25647c47724e0e39e1ec5d07bad6aa14127de9176e62ff34503bc22552079f80ba9
SHA512dd1ef82e54e22cc742e6138f0bf539ac2067aa2a36adfff9ccac40966fee7081cf8f205798daf710ce61650cc21985db660ae40100180b83bada455b3d669e33
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2690012.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u2690012.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4702737.exeFilesize
709KB
MD505de0102565a05d8b7b59c93d6da3475
SHA16e3c6adec93944c95f9fea85110b683287063978
SHA256b6ae8ed180b9cbe5a71096658bab270b1083da0b668c9f9705bee4e635ac12b9
SHA512f0e97ef0f3cf0c1c194266eb761d7475fadc7bfc003e23a23faa3d7301c75e3cfd4bd70e37fbc04a3c6be68217f6bfb53a420ecdbf546056854a322b5ce8d418
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4702737.exeFilesize
709KB
MD505de0102565a05d8b7b59c93d6da3475
SHA16e3c6adec93944c95f9fea85110b683287063978
SHA256b6ae8ed180b9cbe5a71096658bab270b1083da0b668c9f9705bee4e635ac12b9
SHA512f0e97ef0f3cf0c1c194266eb761d7475fadc7bfc003e23a23faa3d7301c75e3cfd4bd70e37fbc04a3c6be68217f6bfb53a420ecdbf546056854a322b5ce8d418
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4091527.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4091527.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2600862.exeFilesize
527KB
MD52e656137785dde63234b4dd4c9207487
SHA1dff29582543d8d00f78389b4938af24460e73d7e
SHA256cc83b6dd9e6e61857bd1026266f5dd5484a09adea698a55bbf5c967b96fe6dbb
SHA5122fffafbcf1494eab70c90aa474f2b896e23dd15e5bd8c06b7ca1dda6c25791bb15bec8f5b26bc1ce4f03e678b2ba72c4813defb541f786de00d07664e7e4ec00
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2600862.exeFilesize
527KB
MD52e656137785dde63234b4dd4c9207487
SHA1dff29582543d8d00f78389b4938af24460e73d7e
SHA256cc83b6dd9e6e61857bd1026266f5dd5484a09adea698a55bbf5c967b96fe6dbb
SHA5122fffafbcf1494eab70c90aa474f2b896e23dd15e5bd8c06b7ca1dda6c25791bb15bec8f5b26bc1ce4f03e678b2ba72c4813defb541f786de00d07664e7e4ec00
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9838339.exeFilesize
310KB
MD5a2c79e0a0fe2fc76dabf5123ff800c01
SHA1a6f0672b762da3e8e80910fa4d23a070d2a0f0e2
SHA256c1d009e5f2891da9c0e60aa4609fc9dac508a0a8f67eb2a68994b9813a791109
SHA512b293078db55ddef729e929f0b2bb6c6326f6bffbcdc1bc6eb90b23c377a2a38cac60018ffe7b9c00c592bd84400c6db6cff1dba8c6bd92362fd4666b5ac32f14
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9838339.exeFilesize
310KB
MD5a2c79e0a0fe2fc76dabf5123ff800c01
SHA1a6f0672b762da3e8e80910fa4d23a070d2a0f0e2
SHA256c1d009e5f2891da9c0e60aa4609fc9dac508a0a8f67eb2a68994b9813a791109
SHA512b293078db55ddef729e929f0b2bb6c6326f6bffbcdc1bc6eb90b23c377a2a38cac60018ffe7b9c00c592bd84400c6db6cff1dba8c6bd92362fd4666b5ac32f14
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6557727.exeFilesize
296KB
MD5e50842ad4f8890cc350bd17a6ea238eb
SHA129e522c976e42d885257f69f172a189df54823da
SHA2569d909ffe7a25a7682ae941062f85c523aa0cdaa0d51159c8bbf44101c60847aa
SHA512fa7fe34304e7d35c3e76c790030ff617882f50140c726dbb5ebc331561df0d088d9ce103c2d815a9c04bba6da44b0d408fafa6aaa0c48570fcde3cb550b9d110
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z6557727.exeFilesize
296KB
MD5e50842ad4f8890cc350bd17a6ea238eb
SHA129e522c976e42d885257f69f172a189df54823da
SHA2569d909ffe7a25a7682ae941062f85c523aa0cdaa0d51159c8bbf44101c60847aa
SHA512fa7fe34304e7d35c3e76c790030ff617882f50140c726dbb5ebc331561df0d088d9ce103c2d815a9c04bba6da44b0d408fafa6aaa0c48570fcde3cb550b9d110
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7571701.exeFilesize
11KB
MD506cc4542497dc61345ce9eb7eb7ee4b5
SHA1874d20f23b41d45591162e386e3c4ec7e40f88eb
SHA2564717ae79c1619a589e6183f1ca268649cde6950b8b21080a2af0fe94ccd4ee64
SHA512b6fdf0d94126f980ed2fff6b8646a27ef25c0f4ef569ab660e06c7701899e0365eb9af8ee3aeb7de3d3da1e75e979a17bba5dcdcb75020ee53bc39ca3f12181a
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7571701.exeFilesize
11KB
MD506cc4542497dc61345ce9eb7eb7ee4b5
SHA1874d20f23b41d45591162e386e3c4ec7e40f88eb
SHA2564717ae79c1619a589e6183f1ca268649cde6950b8b21080a2af0fe94ccd4ee64
SHA512b6fdf0d94126f980ed2fff6b8646a27ef25c0f4ef569ab660e06c7701899e0365eb9af8ee3aeb7de3d3da1e75e979a17bba5dcdcb75020ee53bc39ca3f12181a
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0665445.exeFilesize
276KB
MD5f7d3a3df0f5bbb0b722b9346afb484d4
SHA1558773a9dfcc7004898c155f5a20d30cb745013d
SHA256fad573c8ea55eb79d30e721d45a564084d82ee8e28c35fcc49ee02e8f98891bd
SHA512a983ed516c7c27aa53e4141a80ec930f33c9c03fe611c4d47a1bbd7b7c22320a3676c612e782c7b0c64c4f90cfa14d677a23698aa4532603e3e0d052f859ba04
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0665445.exeFilesize
276KB
MD5f7d3a3df0f5bbb0b722b9346afb484d4
SHA1558773a9dfcc7004898c155f5a20d30cb745013d
SHA256fad573c8ea55eb79d30e721d45a564084d82ee8e28c35fcc49ee02e8f98891bd
SHA512a983ed516c7c27aa53e4141a80ec930f33c9c03fe611c4d47a1bbd7b7c22320a3676c612e782c7b0c64c4f90cfa14d677a23698aa4532603e3e0d052f859ba04
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1156-38-0x00007FFD59150000-0x00007FFD59C11000-memory.dmpFilesize
10.8MB
-
memory/1156-35-0x00000000001C0000-0x00000000001CA000-memory.dmpFilesize
40KB
-
memory/1156-36-0x00007FFD59150000-0x00007FFD59C11000-memory.dmpFilesize
10.8MB
-
memory/2200-65-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/2200-81-0x000000000A950000-0x000000000A99C000-memory.dmpFilesize
304KB
-
memory/2200-50-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2200-88-0x00000000742C0000-0x0000000074A70000-memory.dmpFilesize
7.7MB
-
memory/2200-89-0x00000000052A0000-0x00000000052B0000-memory.dmpFilesize
64KB
-
memory/2200-52-0x0000000001310000-0x0000000001316000-memory.dmpFilesize
24KB
-
memory/2200-64-0x000000000A770000-0x000000000A782000-memory.dmpFilesize
72KB
-
memory/2200-68-0x000000000A7D0000-0x000000000A80C000-memory.dmpFilesize
240KB
-
memory/2200-51-0x00000000742C0000-0x0000000074A70000-memory.dmpFilesize
7.7MB
-
memory/2200-63-0x000000000A840000-0x000000000A94A000-memory.dmpFilesize
1.0MB
-
memory/2200-60-0x000000000AD50000-0x000000000B368000-memory.dmpFilesize
6.1MB
-
memory/4760-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4760-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4760-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4760-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB