Analysis
-
max time kernel
157s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:25
Static task
static1
Behavioral task
behavioral1
Sample
8e991fd53bfbf56f68daa6982e8a0eabd97395ec62423756e143700a31707eca_JC.exe
Resource
win7-20230831-en
General
-
Target
8e991fd53bfbf56f68daa6982e8a0eabd97395ec62423756e143700a31707eca_JC.exe
-
Size
1.0MB
-
MD5
f858d733e3ac90ac114d23886adefb37
-
SHA1
a42269dbfb0ebaa657318d4ad2c7ecbf780dbbd2
-
SHA256
8e991fd53bfbf56f68daa6982e8a0eabd97395ec62423756e143700a31707eca
-
SHA512
9873d6aa7a97922fd5140e1ab752b818c4654df070313585407dbd6fe1de091445d2c733f73ac35a5875930046d860d84bc45232d900e3021a3a8696664c8c07
-
SSDEEP
24576:nysvVRbp6rhzCQMCV8McBSEJuDU08gNBi6haT:ysvVRbpK9MCV8MT3k
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3236-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3236-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3236-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3236-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2380-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t8597020.exeexplonde.exeu5620499.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation t8597020.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation u5620499.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z1002506.exez5320390.exez4553266.exez2236609.exeq5030059.exer5820649.exes6278822.exet8597020.exeexplonde.exeu5620499.exelegota.exew0936230.exelegota.exeexplonde.exelegota.exeexplonde.exepid process 4316 z1002506.exe 5080 z5320390.exe 336 z4553266.exe 3224 z2236609.exe 4500 q5030059.exe 980 r5820649.exe 4892 s6278822.exe 1064 t8597020.exe 3976 explonde.exe 496 u5620499.exe 1032 legota.exe 2828 w0936230.exe 1088 legota.exe 4620 explonde.exe 1800 legota.exe 1384 explonde.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 5072 rundll32.exe 2464 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z4553266.exez2236609.exe8e991fd53bfbf56f68daa6982e8a0eabd97395ec62423756e143700a31707eca_JC.exez1002506.exez5320390.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z4553266.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z2236609.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 8e991fd53bfbf56f68daa6982e8a0eabd97395ec62423756e143700a31707eca_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z1002506.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z5320390.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q5030059.exer5820649.exes6278822.exedescription pid process target process PID 4500 set thread context of 2380 4500 q5030059.exe AppLaunch.exe PID 980 set thread context of 3236 980 r5820649.exe AppLaunch.exe PID 4892 set thread context of 4792 4892 s6278822.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1060 4500 WerFault.exe q5030059.exe 1520 980 WerFault.exe r5820649.exe 4776 3236 WerFault.exe AppLaunch.exe 4856 4892 WerFault.exe s6278822.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2044 schtasks.exe 3364 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 2380 AppLaunch.exe 2380 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2380 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8e991fd53bfbf56f68daa6982e8a0eabd97395ec62423756e143700a31707eca_JC.exez1002506.exez5320390.exez4553266.exez2236609.exeq5030059.exer5820649.exes6278822.exet8597020.exeexplonde.exeu5620499.exedescription pid process target process PID 4664 wrote to memory of 4316 4664 8e991fd53bfbf56f68daa6982e8a0eabd97395ec62423756e143700a31707eca_JC.exe z1002506.exe PID 4664 wrote to memory of 4316 4664 8e991fd53bfbf56f68daa6982e8a0eabd97395ec62423756e143700a31707eca_JC.exe z1002506.exe PID 4664 wrote to memory of 4316 4664 8e991fd53bfbf56f68daa6982e8a0eabd97395ec62423756e143700a31707eca_JC.exe z1002506.exe PID 4316 wrote to memory of 5080 4316 z1002506.exe z5320390.exe PID 4316 wrote to memory of 5080 4316 z1002506.exe z5320390.exe PID 4316 wrote to memory of 5080 4316 z1002506.exe z5320390.exe PID 5080 wrote to memory of 336 5080 z5320390.exe z4553266.exe PID 5080 wrote to memory of 336 5080 z5320390.exe z4553266.exe PID 5080 wrote to memory of 336 5080 z5320390.exe z4553266.exe PID 336 wrote to memory of 3224 336 z4553266.exe z2236609.exe PID 336 wrote to memory of 3224 336 z4553266.exe z2236609.exe PID 336 wrote to memory of 3224 336 z4553266.exe z2236609.exe PID 3224 wrote to memory of 4500 3224 z2236609.exe q5030059.exe PID 3224 wrote to memory of 4500 3224 z2236609.exe q5030059.exe PID 3224 wrote to memory of 4500 3224 z2236609.exe q5030059.exe PID 4500 wrote to memory of 2380 4500 q5030059.exe AppLaunch.exe PID 4500 wrote to memory of 2380 4500 q5030059.exe AppLaunch.exe PID 4500 wrote to memory of 2380 4500 q5030059.exe AppLaunch.exe PID 4500 wrote to memory of 2380 4500 q5030059.exe AppLaunch.exe PID 4500 wrote to memory of 2380 4500 q5030059.exe AppLaunch.exe PID 4500 wrote to memory of 2380 4500 q5030059.exe AppLaunch.exe PID 4500 wrote to memory of 2380 4500 q5030059.exe AppLaunch.exe PID 4500 wrote to memory of 2380 4500 q5030059.exe AppLaunch.exe PID 3224 wrote to memory of 980 3224 z2236609.exe r5820649.exe PID 3224 wrote to memory of 980 3224 z2236609.exe r5820649.exe PID 3224 wrote to memory of 980 3224 z2236609.exe r5820649.exe PID 980 wrote to memory of 3236 980 r5820649.exe AppLaunch.exe PID 980 wrote to memory of 3236 980 r5820649.exe AppLaunch.exe PID 980 wrote to memory of 3236 980 r5820649.exe AppLaunch.exe PID 980 wrote to memory of 3236 980 r5820649.exe AppLaunch.exe PID 980 wrote to memory of 3236 980 r5820649.exe AppLaunch.exe PID 980 wrote to memory of 3236 980 r5820649.exe AppLaunch.exe PID 980 wrote to memory of 3236 980 r5820649.exe AppLaunch.exe PID 980 wrote to memory of 3236 980 r5820649.exe AppLaunch.exe PID 980 wrote to memory of 3236 980 r5820649.exe AppLaunch.exe PID 980 wrote to memory of 3236 980 r5820649.exe AppLaunch.exe PID 336 wrote to memory of 4892 336 z4553266.exe s6278822.exe PID 336 wrote to memory of 4892 336 z4553266.exe s6278822.exe PID 336 wrote to memory of 4892 336 z4553266.exe s6278822.exe PID 4892 wrote to memory of 4792 4892 s6278822.exe AppLaunch.exe PID 4892 wrote to memory of 4792 4892 s6278822.exe AppLaunch.exe PID 4892 wrote to memory of 4792 4892 s6278822.exe AppLaunch.exe PID 4892 wrote to memory of 4792 4892 s6278822.exe AppLaunch.exe PID 4892 wrote to memory of 4792 4892 s6278822.exe AppLaunch.exe PID 4892 wrote to memory of 4792 4892 s6278822.exe AppLaunch.exe PID 4892 wrote to memory of 4792 4892 s6278822.exe AppLaunch.exe PID 4892 wrote to memory of 4792 4892 s6278822.exe AppLaunch.exe PID 5080 wrote to memory of 1064 5080 z5320390.exe t8597020.exe PID 5080 wrote to memory of 1064 5080 z5320390.exe t8597020.exe PID 5080 wrote to memory of 1064 5080 z5320390.exe t8597020.exe PID 1064 wrote to memory of 3976 1064 t8597020.exe explonde.exe PID 1064 wrote to memory of 3976 1064 t8597020.exe explonde.exe PID 1064 wrote to memory of 3976 1064 t8597020.exe explonde.exe PID 4316 wrote to memory of 496 4316 z1002506.exe u5620499.exe PID 4316 wrote to memory of 496 4316 z1002506.exe u5620499.exe PID 4316 wrote to memory of 496 4316 z1002506.exe u5620499.exe PID 3976 wrote to memory of 3364 3976 explonde.exe schtasks.exe PID 3976 wrote to memory of 3364 3976 explonde.exe schtasks.exe PID 3976 wrote to memory of 3364 3976 explonde.exe schtasks.exe PID 496 wrote to memory of 1032 496 u5620499.exe legota.exe PID 496 wrote to memory of 1032 496 u5620499.exe legota.exe PID 496 wrote to memory of 1032 496 u5620499.exe legota.exe PID 3976 wrote to memory of 4740 3976 explonde.exe cmd.exe PID 3976 wrote to memory of 4740 3976 explonde.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e991fd53bfbf56f68daa6982e8a0eabd97395ec62423756e143700a31707eca_JC.exe"C:\Users\Admin\AppData\Local\Temp\8e991fd53bfbf56f68daa6982e8a0eabd97395ec62423756e143700a31707eca_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1002506.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1002506.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5320390.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5320390.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4553266.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4553266.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2236609.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2236609.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5030059.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5030059.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2380 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4500 -s 1367⤵
- Program crash
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5820649.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5820649.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:3236
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3236 -s 5408⤵
- Program crash
PID:4776 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 980 -s 1527⤵
- Program crash
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6278822.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6278822.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:4792
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 5846⤵
- Program crash
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8597020.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8597020.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
PID:3364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:4740
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:984
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵PID:1816
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵PID:2680
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:4776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:2596
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:684
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5620499.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5620499.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:496 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:1032 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:2044 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:2080
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2600
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:2916
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:3964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:4800
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:904
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:4616
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0936230.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0936230.exe2⤵
- Executes dropped EXE
PID:2828
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4500 -ip 45001⤵PID:2044
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 980 -ip 9801⤵PID:1408
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3236 -ip 32361⤵PID:3476
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4892 -ip 48921⤵PID:992
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:1088
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:4620
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:1800
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:1384
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0936230.exeFilesize
22KB
MD566d770356fea971b595ff4b9bc0d0805
SHA11147b6bca0b674d2c6be2a70c60376f881b4a8a9
SHA256b16a10b3304bbbf67bc2a137d5b45dd08a4e3e49669b61828230040ef9bf2d65
SHA5122f6ccd0b4c2dc2dfe4642ad53b727b398466c3073fcbc88c30cf929c9d57e5019050129f5efb1f4c55180b4de2b711ed5ec067ba32e84af2506eb414c5ed1e37
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0936230.exeFilesize
22KB
MD566d770356fea971b595ff4b9bc0d0805
SHA11147b6bca0b674d2c6be2a70c60376f881b4a8a9
SHA256b16a10b3304bbbf67bc2a137d5b45dd08a4e3e49669b61828230040ef9bf2d65
SHA5122f6ccd0b4c2dc2dfe4642ad53b727b398466c3073fcbc88c30cf929c9d57e5019050129f5efb1f4c55180b4de2b711ed5ec067ba32e84af2506eb414c5ed1e37
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1002506.exeFilesize
965KB
MD583ec9dc874c883ee64e710d68c77bb2e
SHA134832f64d83633adc970e1fff16a188be156f5a7
SHA256466f72e285f15625ee9bb9dd7980de459faab60c25b4d6d885cd2b4e99a77383
SHA5129b20a0ca632aa996cd5e0059b47f3b26352d0c862f44d3d1e5a33b56bb6ec8573bac10786fd7c0494d9eee0fedab25fb7dff2db3cc43385cad6a7b1b87f0f8c6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1002506.exeFilesize
965KB
MD583ec9dc874c883ee64e710d68c77bb2e
SHA134832f64d83633adc970e1fff16a188be156f5a7
SHA256466f72e285f15625ee9bb9dd7980de459faab60c25b4d6d885cd2b4e99a77383
SHA5129b20a0ca632aa996cd5e0059b47f3b26352d0c862f44d3d1e5a33b56bb6ec8573bac10786fd7c0494d9eee0fedab25fb7dff2db3cc43385cad6a7b1b87f0f8c6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5620499.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u5620499.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5320390.exeFilesize
781KB
MD53be976d598230109deea82dda318f58c
SHA1fc2954a85388a76de6775a7d653bc3d5ca57824f
SHA2562196954d2c5fac1a2b07fc3e65e384de15bc2fb6b59ac4958e23ba6268f30c6d
SHA512c54909dbb088788819af00c30f22bf58d732140e18655a28e3d92f1fac990033507ec342dd1eaf2895e800c61a464ef4a54dd6567f11a6563ecdfee0ec7db7a7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z5320390.exeFilesize
781KB
MD53be976d598230109deea82dda318f58c
SHA1fc2954a85388a76de6775a7d653bc3d5ca57824f
SHA2562196954d2c5fac1a2b07fc3e65e384de15bc2fb6b59ac4958e23ba6268f30c6d
SHA512c54909dbb088788819af00c30f22bf58d732140e18655a28e3d92f1fac990033507ec342dd1eaf2895e800c61a464ef4a54dd6567f11a6563ecdfee0ec7db7a7
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8597020.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8597020.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4553266.exeFilesize
599KB
MD53e3c3521a9c1291f896d4df235ab7a6e
SHA146fbfdcbffed7d260bd0d6eb4072d7af8c014186
SHA256e10facd196d643f4a9c575c6329dfebebbf1ab2ee7e5b12ed8e2aaf076ac0544
SHA512d1cf263d8aefa0c48f904592ca37d18b76d7092fbdd8a7b34871692e2b695b8fcf47967e43c1728fe80c6ef8d77cd25bd9d9eaf30731ebee24333735889ef19b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z4553266.exeFilesize
599KB
MD53e3c3521a9c1291f896d4df235ab7a6e
SHA146fbfdcbffed7d260bd0d6eb4072d7af8c014186
SHA256e10facd196d643f4a9c575c6329dfebebbf1ab2ee7e5b12ed8e2aaf076ac0544
SHA512d1cf263d8aefa0c48f904592ca37d18b76d7092fbdd8a7b34871692e2b695b8fcf47967e43c1728fe80c6ef8d77cd25bd9d9eaf30731ebee24333735889ef19b
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6278822.exeFilesize
380KB
MD5c0c9bb07323d1d002057a228ca99dff5
SHA1165adead11870a109378729d055ff03a6f19a61c
SHA25605b6c2f67eca05aadf455f09b3e1a3b4e4af13254a619afebbe19f12daea41ab
SHA512b70613a620b19e27b7839a403796895262e2a6cdd1f5edd47ff7ad856e79527d90057603780ce9bf5dd6cd082d5010f0027f56444a70fc5cad37323139f41a65
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s6278822.exeFilesize
380KB
MD5c0c9bb07323d1d002057a228ca99dff5
SHA1165adead11870a109378729d055ff03a6f19a61c
SHA25605b6c2f67eca05aadf455f09b3e1a3b4e4af13254a619afebbe19f12daea41ab
SHA512b70613a620b19e27b7839a403796895262e2a6cdd1f5edd47ff7ad856e79527d90057603780ce9bf5dd6cd082d5010f0027f56444a70fc5cad37323139f41a65
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2236609.exeFilesize
336KB
MD5c7bbcffca8685ff3f658fab1379fb355
SHA1df136588c331d76f5a7bb7eb1c57dadfd015bbfb
SHA2566581d0166aa43c6da2a6ae2539d9822009c15b56bf939db9ac495444e6bd316d
SHA512327a34fb663dcc533b1a4916e90024f661ee6c854eaf477d20195046c773f90254c62e3eae6169585fd46e0c4f81dd569cb101b6b7a2280b1cb13747f7f85b87
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z2236609.exeFilesize
336KB
MD5c7bbcffca8685ff3f658fab1379fb355
SHA1df136588c331d76f5a7bb7eb1c57dadfd015bbfb
SHA2566581d0166aa43c6da2a6ae2539d9822009c15b56bf939db9ac495444e6bd316d
SHA512327a34fb663dcc533b1a4916e90024f661ee6c854eaf477d20195046c773f90254c62e3eae6169585fd46e0c4f81dd569cb101b6b7a2280b1cb13747f7f85b87
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5030059.exeFilesize
217KB
MD54e4a77d4bed30513b22fd5579d07ad54
SHA1f37a1f99c57c7232aee08af4662cf5dcacf4b82e
SHA2565205b0afeaa60ea36180a0a1e091dbbbbb64385f8182f72f10e7f8a5d59ae6c7
SHA51297d6eedee9ac6eb8ab7a444ee2bb9a8e4ae4447a5b8497721dedfbc9de600ae46230ab92931787e5fbbd0e260fbb92d0bb4aa331e8c493a2f3706e23ef85d0be
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q5030059.exeFilesize
217KB
MD54e4a77d4bed30513b22fd5579d07ad54
SHA1f37a1f99c57c7232aee08af4662cf5dcacf4b82e
SHA2565205b0afeaa60ea36180a0a1e091dbbbbb64385f8182f72f10e7f8a5d59ae6c7
SHA51297d6eedee9ac6eb8ab7a444ee2bb9a8e4ae4447a5b8497721dedfbc9de600ae46230ab92931787e5fbbd0e260fbb92d0bb4aa331e8c493a2f3706e23ef85d0be
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5820649.exeFilesize
346KB
MD59a212990181c4e35587b59ceeab0661e
SHA1faf52afeedaadf5b8e741651aca300bc2ca0f473
SHA256f4268d42dec093c68c69b717b0433653f69fcf76e23f25f2b5dfcd867bf5bf5b
SHA512b145cbeb961c7c36416eef93e0097248b4cf346f1233faa599dd74b5fa067200b2173043072e764ae699afc29e6b323c7eef7ee2025d95cdd9e80c261c57980b
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5820649.exeFilesize
346KB
MD59a212990181c4e35587b59ceeab0661e
SHA1faf52afeedaadf5b8e741651aca300bc2ca0f473
SHA256f4268d42dec093c68c69b717b0433653f69fcf76e23f25f2b5dfcd867bf5bf5b
SHA512b145cbeb961c7c36416eef93e0097248b4cf346f1233faa599dd74b5fa067200b2173043072e764ae699afc29e6b323c7eef7ee2025d95cdd9e80c261c57980b
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/2380-59-0x00000000739F0000-0x00000000741A0000-memory.dmpFilesize
7.7MB
-
memory/2380-50-0x00000000739F0000-0x00000000741A0000-memory.dmpFilesize
7.7MB
-
memory/2380-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2380-36-0x00000000739F0000-0x00000000741A0000-memory.dmpFilesize
7.7MB
-
memory/3236-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3236-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3236-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3236-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4792-62-0x0000000005920000-0x0000000005A2A000-memory.dmpFilesize
1.0MB
-
memory/4792-51-0x00000000739F0000-0x00000000741A0000-memory.dmpFilesize
7.7MB
-
memory/4792-52-0x0000000001790000-0x0000000001796000-memory.dmpFilesize
24KB
-
memory/4792-49-0x00000000739F0000-0x00000000741A0000-memory.dmpFilesize
7.7MB
-
memory/4792-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4792-60-0x0000000005E20000-0x0000000006438000-memory.dmpFilesize
6.1MB
-
memory/4792-88-0x00000000056F0000-0x0000000005700000-memory.dmpFilesize
64KB
-
memory/4792-70-0x00000000058B0000-0x00000000058EC000-memory.dmpFilesize
240KB
-
memory/4792-66-0x0000000005850000-0x0000000005862000-memory.dmpFilesize
72KB
-
memory/4792-67-0x00000000056F0000-0x0000000005700000-memory.dmpFilesize
64KB
-
memory/4792-84-0x0000000005A30000-0x0000000005A7C000-memory.dmpFilesize
304KB