Analysis
-
max time kernel
171s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:17
Static task
static1
Behavioral task
behavioral1
Sample
d9fefaf017bcb31b2d6fdbd90c1c9ff4b02a2e63e391295171b9a34af42adfdd_JC.exe
Resource
win7-20230831-en
General
-
Target
d9fefaf017bcb31b2d6fdbd90c1c9ff4b02a2e63e391295171b9a34af42adfdd_JC.exe
-
Size
1.1MB
-
MD5
3fd18610b9c31eb6fc450bf626d7ea7d
-
SHA1
1b0513f783036323dfc340d03b2a27474eaa6ce9
-
SHA256
d9fefaf017bcb31b2d6fdbd90c1c9ff4b02a2e63e391295171b9a34af42adfdd
-
SHA512
e7d1dbf5fe24d14105555b3147e7e617f8de3f3913948e88dc43c17826eebeaff6f26e7920ccb82cf6cfc960d1a06031b1b5ac26cc029e11743bf6580cb63fc2
-
SSDEEP
24576:6yxRJaqQK1f3tXmFIQT2kff9kCnwIFpYu5cw5oMpq:BZaqFENrfvwOOulp
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3444-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3444-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3444-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3444-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2284-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t3151960.exeexplonde.exeu9248947.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation t3151960.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation u9248947.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z4215849.exez4780114.exez9539404.exez2924053.exeq8620071.exer4760521.exes7587084.exet3151960.exeexplonde.exeu9248947.exelegota.exew7453607.exeexplonde.exelegota.exeexplonde.exelegota.exepid process 3128 z4215849.exe 400 z4780114.exe 3704 z9539404.exe 4788 z2924053.exe 2984 q8620071.exe 4900 r4760521.exe 4884 s7587084.exe 4548 t3151960.exe 3516 explonde.exe 2668 u9248947.exe 2832 legota.exe 2204 w7453607.exe 1172 explonde.exe 3716 legota.exe 908 explonde.exe 4196 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3504 rundll32.exe 2012 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
d9fefaf017bcb31b2d6fdbd90c1c9ff4b02a2e63e391295171b9a34af42adfdd_JC.exez4215849.exez4780114.exez9539404.exez2924053.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" d9fefaf017bcb31b2d6fdbd90c1c9ff4b02a2e63e391295171b9a34af42adfdd_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z4215849.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z4780114.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z9539404.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z2924053.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q8620071.exer4760521.exes7587084.exedescription pid process target process PID 2984 set thread context of 2284 2984 q8620071.exe AppLaunch.exe PID 4900 set thread context of 3444 4900 r4760521.exe AppLaunch.exe PID 4884 set thread context of 2440 4884 s7587084.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1576 2984 WerFault.exe q8620071.exe 4228 4900 WerFault.exe r4760521.exe 1976 3444 WerFault.exe AppLaunch.exe 4508 4884 WerFault.exe s7587084.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3460 schtasks.exe 4368 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 2284 AppLaunch.exe 2284 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2284 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d9fefaf017bcb31b2d6fdbd90c1c9ff4b02a2e63e391295171b9a34af42adfdd_JC.exez4215849.exez4780114.exez9539404.exez2924053.exeq8620071.exer4760521.exes7587084.exet3151960.exeexplonde.exedescription pid process target process PID 3200 wrote to memory of 3128 3200 d9fefaf017bcb31b2d6fdbd90c1c9ff4b02a2e63e391295171b9a34af42adfdd_JC.exe z4215849.exe PID 3200 wrote to memory of 3128 3200 d9fefaf017bcb31b2d6fdbd90c1c9ff4b02a2e63e391295171b9a34af42adfdd_JC.exe z4215849.exe PID 3200 wrote to memory of 3128 3200 d9fefaf017bcb31b2d6fdbd90c1c9ff4b02a2e63e391295171b9a34af42adfdd_JC.exe z4215849.exe PID 3128 wrote to memory of 400 3128 z4215849.exe z4780114.exe PID 3128 wrote to memory of 400 3128 z4215849.exe z4780114.exe PID 3128 wrote to memory of 400 3128 z4215849.exe z4780114.exe PID 400 wrote to memory of 3704 400 z4780114.exe z9539404.exe PID 400 wrote to memory of 3704 400 z4780114.exe z9539404.exe PID 400 wrote to memory of 3704 400 z4780114.exe z9539404.exe PID 3704 wrote to memory of 4788 3704 z9539404.exe z2924053.exe PID 3704 wrote to memory of 4788 3704 z9539404.exe z2924053.exe PID 3704 wrote to memory of 4788 3704 z9539404.exe z2924053.exe PID 4788 wrote to memory of 2984 4788 z2924053.exe q8620071.exe PID 4788 wrote to memory of 2984 4788 z2924053.exe q8620071.exe PID 4788 wrote to memory of 2984 4788 z2924053.exe q8620071.exe PID 2984 wrote to memory of 2284 2984 q8620071.exe AppLaunch.exe PID 2984 wrote to memory of 2284 2984 q8620071.exe AppLaunch.exe PID 2984 wrote to memory of 2284 2984 q8620071.exe AppLaunch.exe PID 2984 wrote to memory of 2284 2984 q8620071.exe AppLaunch.exe PID 2984 wrote to memory of 2284 2984 q8620071.exe AppLaunch.exe PID 2984 wrote to memory of 2284 2984 q8620071.exe AppLaunch.exe PID 2984 wrote to memory of 2284 2984 q8620071.exe AppLaunch.exe PID 2984 wrote to memory of 2284 2984 q8620071.exe AppLaunch.exe PID 4788 wrote to memory of 4900 4788 z2924053.exe r4760521.exe PID 4788 wrote to memory of 4900 4788 z2924053.exe r4760521.exe PID 4788 wrote to memory of 4900 4788 z2924053.exe r4760521.exe PID 4900 wrote to memory of 3444 4900 r4760521.exe AppLaunch.exe PID 4900 wrote to memory of 3444 4900 r4760521.exe AppLaunch.exe PID 4900 wrote to memory of 3444 4900 r4760521.exe AppLaunch.exe PID 4900 wrote to memory of 3444 4900 r4760521.exe AppLaunch.exe PID 4900 wrote to memory of 3444 4900 r4760521.exe AppLaunch.exe PID 4900 wrote to memory of 3444 4900 r4760521.exe AppLaunch.exe PID 4900 wrote to memory of 3444 4900 r4760521.exe AppLaunch.exe PID 4900 wrote to memory of 3444 4900 r4760521.exe AppLaunch.exe PID 4900 wrote to memory of 3444 4900 r4760521.exe AppLaunch.exe PID 4900 wrote to memory of 3444 4900 r4760521.exe AppLaunch.exe PID 3704 wrote to memory of 4884 3704 z9539404.exe s7587084.exe PID 3704 wrote to memory of 4884 3704 z9539404.exe s7587084.exe PID 3704 wrote to memory of 4884 3704 z9539404.exe s7587084.exe PID 4884 wrote to memory of 4236 4884 s7587084.exe AppLaunch.exe PID 4884 wrote to memory of 4236 4884 s7587084.exe AppLaunch.exe PID 4884 wrote to memory of 4236 4884 s7587084.exe AppLaunch.exe PID 4884 wrote to memory of 2440 4884 s7587084.exe AppLaunch.exe PID 4884 wrote to memory of 2440 4884 s7587084.exe AppLaunch.exe PID 4884 wrote to memory of 2440 4884 s7587084.exe AppLaunch.exe PID 4884 wrote to memory of 2440 4884 s7587084.exe AppLaunch.exe PID 4884 wrote to memory of 2440 4884 s7587084.exe AppLaunch.exe PID 4884 wrote to memory of 2440 4884 s7587084.exe AppLaunch.exe PID 4884 wrote to memory of 2440 4884 s7587084.exe AppLaunch.exe PID 4884 wrote to memory of 2440 4884 s7587084.exe AppLaunch.exe PID 400 wrote to memory of 4548 400 z4780114.exe t3151960.exe PID 400 wrote to memory of 4548 400 z4780114.exe t3151960.exe PID 400 wrote to memory of 4548 400 z4780114.exe t3151960.exe PID 4548 wrote to memory of 3516 4548 t3151960.exe explonde.exe PID 4548 wrote to memory of 3516 4548 t3151960.exe explonde.exe PID 4548 wrote to memory of 3516 4548 t3151960.exe explonde.exe PID 3128 wrote to memory of 2668 3128 z4215849.exe u9248947.exe PID 3128 wrote to memory of 2668 3128 z4215849.exe u9248947.exe PID 3128 wrote to memory of 2668 3128 z4215849.exe u9248947.exe PID 3516 wrote to memory of 4368 3516 explonde.exe schtasks.exe PID 3516 wrote to memory of 4368 3516 explonde.exe schtasks.exe PID 3516 wrote to memory of 4368 3516 explonde.exe schtasks.exe PID 3516 wrote to memory of 4952 3516 explonde.exe cmd.exe PID 3516 wrote to memory of 4952 3516 explonde.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9fefaf017bcb31b2d6fdbd90c1c9ff4b02a2e63e391295171b9a34af42adfdd_JC.exe"C:\Users\Admin\AppData\Local\Temp\d9fefaf017bcb31b2d6fdbd90c1c9ff4b02a2e63e391295171b9a34af42adfdd_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4215849.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4215849.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4780114.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4780114.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9539404.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9539404.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2924053.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2924053.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8620071.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8620071.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 5647⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4760521.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4760521.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3444 -s 5488⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4900 -s 5647⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7587084.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7587084.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 5646⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3151960.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3151960.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9248947.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9248947.exe3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7453607.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7453607.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2984 -ip 29841⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4900 -ip 49001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3444 -ip 34441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4884 -ip 48841⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7453607.exeFilesize
22KB
MD5d6511c2a539ccdf206de2b01168b69ef
SHA1b4004a8bd77117e51308923c9b9e0daa252a148a
SHA256dfddb781aca1f4c03077bd67748ab72b9df4441ab410a0d7d8208fb03cefdca0
SHA512577c2208f861d01d4d719f3c42e0f98beace5c8e6f57c7b8930fa34fa50e46a79d214bbdb4bc73b9aef970ed3337badd92505143bfde0571ae372e0bc28ec892
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w7453607.exeFilesize
22KB
MD5d6511c2a539ccdf206de2b01168b69ef
SHA1b4004a8bd77117e51308923c9b9e0daa252a148a
SHA256dfddb781aca1f4c03077bd67748ab72b9df4441ab410a0d7d8208fb03cefdca0
SHA512577c2208f861d01d4d719f3c42e0f98beace5c8e6f57c7b8930fa34fa50e46a79d214bbdb4bc73b9aef970ed3337badd92505143bfde0571ae372e0bc28ec892
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4215849.exeFilesize
997KB
MD5b03e47b75eb28e1899cd39fc4c56c96f
SHA146b0f39c2995b7a19a1c18df4f9236f55f40b50d
SHA256261eb1abd2c3f94c1ca0e9dd3f8c2ed02671b4d69bc0913d1fb558690c396081
SHA512961f0eda2ddf44f5379cff62292bf7a6cb2cfa1bd4fe5bb64c90cfd079d9157d7dd3b5fab32da8ee2e69a3aae56d7adbae3bdf35ec2177802be7f6f521a3947e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z4215849.exeFilesize
997KB
MD5b03e47b75eb28e1899cd39fc4c56c96f
SHA146b0f39c2995b7a19a1c18df4f9236f55f40b50d
SHA256261eb1abd2c3f94c1ca0e9dd3f8c2ed02671b4d69bc0913d1fb558690c396081
SHA512961f0eda2ddf44f5379cff62292bf7a6cb2cfa1bd4fe5bb64c90cfd079d9157d7dd3b5fab32da8ee2e69a3aae56d7adbae3bdf35ec2177802be7f6f521a3947e
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9248947.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9248947.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4780114.exeFilesize
814KB
MD5c7e22224e90b9aefbe40173021b5bf78
SHA106f43f749a314a268f3182f5ba77003621f14949
SHA2567d08d3fde33a5dd82864206e8f3275208e3850934690b673aa6c7d0c3ed9e4f8
SHA512f471e0dbeeed3a713ae85406497442f4cbf3b4f5814a38fa51edfdc3ca78d90a1f1464f7f8cd4fdab7fd562b29f76875e83380378020e004a576ca78c36bdf5b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z4780114.exeFilesize
814KB
MD5c7e22224e90b9aefbe40173021b5bf78
SHA106f43f749a314a268f3182f5ba77003621f14949
SHA2567d08d3fde33a5dd82864206e8f3275208e3850934690b673aa6c7d0c3ed9e4f8
SHA512f471e0dbeeed3a713ae85406497442f4cbf3b4f5814a38fa51edfdc3ca78d90a1f1464f7f8cd4fdab7fd562b29f76875e83380378020e004a576ca78c36bdf5b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3151960.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3151960.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9539404.exeFilesize
631KB
MD58720ddee8599f350f8efeb71506d7adc
SHA1c6f7ad32bd368edc95b2dcbbddf9448b1840ac87
SHA2568d93a47c80e14623dd86ec1d776cc989967fab4900de7eba7fc8f010c338b128
SHA51243847f8fff75be03976385b5efa36c8ff96563b06c12c71134323a56ae77bd811d4802610163cd885d535d96d0ae5a049d7b4b892574c8a887feeabdd5dbb69a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9539404.exeFilesize
631KB
MD58720ddee8599f350f8efeb71506d7adc
SHA1c6f7ad32bd368edc95b2dcbbddf9448b1840ac87
SHA2568d93a47c80e14623dd86ec1d776cc989967fab4900de7eba7fc8f010c338b128
SHA51243847f8fff75be03976385b5efa36c8ff96563b06c12c71134323a56ae77bd811d4802610163cd885d535d96d0ae5a049d7b4b892574c8a887feeabdd5dbb69a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7587084.exeFilesize
413KB
MD5cadc38bba478d09d47cc952f9962d8ca
SHA1b25391422097360f8c61a8f55f55543ab08fcc24
SHA256fc86ea4c072d03a33d3f7ddab29cb8ad8f5f8eeff68b699a9e6d71e43629ff6c
SHA5126286b48720109ffb1499b7928dc3996ff2b78a08e0739d615e034c8347e57538cacaa4ef2775d0cf4fd0f959394783866683ebfdc6c638d021215a0902e082e2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7587084.exeFilesize
413KB
MD5cadc38bba478d09d47cc952f9962d8ca
SHA1b25391422097360f8c61a8f55f55543ab08fcc24
SHA256fc86ea4c072d03a33d3f7ddab29cb8ad8f5f8eeff68b699a9e6d71e43629ff6c
SHA5126286b48720109ffb1499b7928dc3996ff2b78a08e0739d615e034c8347e57538cacaa4ef2775d0cf4fd0f959394783866683ebfdc6c638d021215a0902e082e2
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2924053.exeFilesize
354KB
MD55e56f2be8f48cd561c9bbd8bc436d7bc
SHA132ec7c517d7eeb41fb1b9bf13327c99c39e0a227
SHA25683609e14c1c46aa013cb0245488d0ae94c59fabbff0026cd482e0f21c511c8c0
SHA5125873ab9ad0901dad996dd66f5728971fa14a6bf3f530698a564373827ec8b6ac44671269b71fb7eff42a5a5eb8282dd3ba8446de54d6954d6c5aa78edcc13a0a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2924053.exeFilesize
354KB
MD55e56f2be8f48cd561c9bbd8bc436d7bc
SHA132ec7c517d7eeb41fb1b9bf13327c99c39e0a227
SHA25683609e14c1c46aa013cb0245488d0ae94c59fabbff0026cd482e0f21c511c8c0
SHA5125873ab9ad0901dad996dd66f5728971fa14a6bf3f530698a564373827ec8b6ac44671269b71fb7eff42a5a5eb8282dd3ba8446de54d6954d6c5aa78edcc13a0a
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8620071.exeFilesize
250KB
MD5f99508626180b53bf30b0ce7817bd697
SHA188704f91de6d7012eb1a4f1ead6a1f12384f906b
SHA256ef1073c8a8b000de7f8cc8b228c2537b12869f3110f8f48ef4e6b45b347e9fcd
SHA512ce0bccad878003c0198cd658018be45f54a7a0aa4b1d3ab22dfbaaa361b16ce3d85b8faea466b5f703031753d48976cb4488d96639258b952a671f874555f396
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8620071.exeFilesize
250KB
MD5f99508626180b53bf30b0ce7817bd697
SHA188704f91de6d7012eb1a4f1ead6a1f12384f906b
SHA256ef1073c8a8b000de7f8cc8b228c2537b12869f3110f8f48ef4e6b45b347e9fcd
SHA512ce0bccad878003c0198cd658018be45f54a7a0aa4b1d3ab22dfbaaa361b16ce3d85b8faea466b5f703031753d48976cb4488d96639258b952a671f874555f396
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4760521.exeFilesize
379KB
MD50e031cd3d9b8a8377f2eca17374c3754
SHA1a1e874e244ddfc573e0d2bd477588fd50f7e0803
SHA256c2bd6b43049a5757902f094aaf698e7e2959a252d35cdd656801cff6e141233d
SHA51268fd01b992299a624d9732d9042993f9af8619682d058bf2fc4a14bf8eaa8842eb60952f4433b6137e80c5a9b8168340b97a6f12bac25eca033dfc530815d016
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4760521.exeFilesize
379KB
MD50e031cd3d9b8a8377f2eca17374c3754
SHA1a1e874e244ddfc573e0d2bd477588fd50f7e0803
SHA256c2bd6b43049a5757902f094aaf698e7e2959a252d35cdd656801cff6e141233d
SHA51268fd01b992299a624d9732d9042993f9af8619682d058bf2fc4a14bf8eaa8842eb60952f4433b6137e80c5a9b8168340b97a6f12bac25eca033dfc530815d016
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/2284-86-0x0000000074130000-0x00000000748E0000-memory.dmpFilesize
7.7MB
-
memory/2284-36-0x0000000074130000-0x00000000748E0000-memory.dmpFilesize
7.7MB
-
memory/2284-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2284-84-0x0000000074130000-0x00000000748E0000-memory.dmpFilesize
7.7MB
-
memory/2440-63-0x000000000AB80000-0x000000000AB92000-memory.dmpFilesize
72KB
-
memory/2440-87-0x0000000074130000-0x00000000748E0000-memory.dmpFilesize
7.7MB
-
memory/2440-88-0x0000000005600000-0x0000000005610000-memory.dmpFilesize
64KB
-
memory/2440-80-0x000000000AD60000-0x000000000ADAC000-memory.dmpFilesize
304KB
-
memory/2440-74-0x000000000ABE0000-0x000000000AC1C000-memory.dmpFilesize
240KB
-
memory/2440-62-0x0000000005600000-0x0000000005610000-memory.dmpFilesize
64KB
-
memory/2440-58-0x000000000AC50000-0x000000000AD5A000-memory.dmpFilesize
1.0MB
-
memory/2440-56-0x000000000B0F0000-0x000000000B708000-memory.dmpFilesize
6.1MB
-
memory/2440-50-0x0000000003090000-0x0000000003096000-memory.dmpFilesize
24KB
-
memory/2440-49-0x0000000074130000-0x00000000748E0000-memory.dmpFilesize
7.7MB
-
memory/2440-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3444-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3444-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3444-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3444-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB