Analysis
-
max time kernel
177s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 05:39
Static task
static1
Behavioral task
behavioral1
Sample
9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe
Resource
win7-20230831-en
General
-
Target
9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe
-
Size
1.1MB
-
MD5
a7d03b76859e68022d6e607ce2231599
-
SHA1
fc85348d5a1f2c83602b68f8779d0e730e25a212
-
SHA256
9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670
-
SHA512
39dd00949f684f54ca4281cffe379590b1473d90a052f27452018b7996214ea90697dd994ebd8aa0229b8ffb6cf767b63513a66570d9e343550679616115b505
-
SSDEEP
24576:qyCgx54gqrKq2/SSg2THTnu7Pyn+yW3Mu2SMTerrBEvF:xb6Kq26SnTy7Kn+D3VJy
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.124.1/theme/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explothe.exe
-
strings_key
36a96139c1118a354edf72b1080d4b2f
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1228-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1228-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1228-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1228-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3924-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
explothe.exeu6357463.exelegota.exet5905531.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation explothe.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation u6357463.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation t5905531.exe -
Executes dropped EXE 18 IoCs
Processes:
z5046044.exez0444970.exez0686192.exez9195991.exeq8050929.exer7962078.exes7951332.exet5905531.exeexplothe.exeu6357463.exelegota.exew3606179.exeexplothe.exelegota.exeexplothe.exelegota.exeexplothe.exelegota.exepid process 768 z5046044.exe 3084 z0444970.exe 3520 z0686192.exe 4476 z9195991.exe 496 q8050929.exe 2676 r7962078.exe 4552 s7951332.exe 4320 t5905531.exe 5068 explothe.exe 1248 u6357463.exe 2564 legota.exe 1108 w3606179.exe 3368 explothe.exe 1860 legota.exe 2440 explothe.exe 4068 legota.exe 4900 explothe.exe 2760 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3516 rundll32.exe 4764 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exez5046044.exez0444970.exez0686192.exez9195991.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z5046044.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z0444970.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z0686192.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z9195991.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q8050929.exer7962078.exes7951332.exedescription pid process target process PID 496 set thread context of 3924 496 q8050929.exe AppLaunch.exe PID 2676 set thread context of 1228 2676 r7962078.exe AppLaunch.exe PID 4552 set thread context of 3064 4552 s7951332.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3096 496 WerFault.exe q8050929.exe 4128 2676 WerFault.exe r7962078.exe 3708 1228 WerFault.exe AppLaunch.exe 2080 4552 WerFault.exe s7951332.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2760 schtasks.exe 3692 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 3924 AppLaunch.exe 3924 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3924 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exez5046044.exez0444970.exez0686192.exez9195991.exeq8050929.exer7962078.exes7951332.exet5905531.exeexplothe.exeu6357463.exedescription pid process target process PID 4000 wrote to memory of 768 4000 9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe z5046044.exe PID 4000 wrote to memory of 768 4000 9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe z5046044.exe PID 4000 wrote to memory of 768 4000 9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe z5046044.exe PID 768 wrote to memory of 3084 768 z5046044.exe z0444970.exe PID 768 wrote to memory of 3084 768 z5046044.exe z0444970.exe PID 768 wrote to memory of 3084 768 z5046044.exe z0444970.exe PID 3084 wrote to memory of 3520 3084 z0444970.exe z0686192.exe PID 3084 wrote to memory of 3520 3084 z0444970.exe z0686192.exe PID 3084 wrote to memory of 3520 3084 z0444970.exe z0686192.exe PID 3520 wrote to memory of 4476 3520 z0686192.exe z9195991.exe PID 3520 wrote to memory of 4476 3520 z0686192.exe z9195991.exe PID 3520 wrote to memory of 4476 3520 z0686192.exe z9195991.exe PID 4476 wrote to memory of 496 4476 z9195991.exe q8050929.exe PID 4476 wrote to memory of 496 4476 z9195991.exe q8050929.exe PID 4476 wrote to memory of 496 4476 z9195991.exe q8050929.exe PID 496 wrote to memory of 3924 496 q8050929.exe AppLaunch.exe PID 496 wrote to memory of 3924 496 q8050929.exe AppLaunch.exe PID 496 wrote to memory of 3924 496 q8050929.exe AppLaunch.exe PID 496 wrote to memory of 3924 496 q8050929.exe AppLaunch.exe PID 496 wrote to memory of 3924 496 q8050929.exe AppLaunch.exe PID 496 wrote to memory of 3924 496 q8050929.exe AppLaunch.exe PID 496 wrote to memory of 3924 496 q8050929.exe AppLaunch.exe PID 496 wrote to memory of 3924 496 q8050929.exe AppLaunch.exe PID 4476 wrote to memory of 2676 4476 z9195991.exe r7962078.exe PID 4476 wrote to memory of 2676 4476 z9195991.exe r7962078.exe PID 4476 wrote to memory of 2676 4476 z9195991.exe r7962078.exe PID 2676 wrote to memory of 1228 2676 r7962078.exe AppLaunch.exe PID 2676 wrote to memory of 1228 2676 r7962078.exe AppLaunch.exe PID 2676 wrote to memory of 1228 2676 r7962078.exe AppLaunch.exe PID 2676 wrote to memory of 1228 2676 r7962078.exe AppLaunch.exe PID 2676 wrote to memory of 1228 2676 r7962078.exe AppLaunch.exe PID 2676 wrote to memory of 1228 2676 r7962078.exe AppLaunch.exe PID 2676 wrote to memory of 1228 2676 r7962078.exe AppLaunch.exe PID 2676 wrote to memory of 1228 2676 r7962078.exe AppLaunch.exe PID 2676 wrote to memory of 1228 2676 r7962078.exe AppLaunch.exe PID 2676 wrote to memory of 1228 2676 r7962078.exe AppLaunch.exe PID 3520 wrote to memory of 4552 3520 z0686192.exe s7951332.exe PID 3520 wrote to memory of 4552 3520 z0686192.exe s7951332.exe PID 3520 wrote to memory of 4552 3520 z0686192.exe s7951332.exe PID 4552 wrote to memory of 3064 4552 s7951332.exe AppLaunch.exe PID 4552 wrote to memory of 3064 4552 s7951332.exe AppLaunch.exe PID 4552 wrote to memory of 3064 4552 s7951332.exe AppLaunch.exe PID 4552 wrote to memory of 3064 4552 s7951332.exe AppLaunch.exe PID 4552 wrote to memory of 3064 4552 s7951332.exe AppLaunch.exe PID 4552 wrote to memory of 3064 4552 s7951332.exe AppLaunch.exe PID 4552 wrote to memory of 3064 4552 s7951332.exe AppLaunch.exe PID 4552 wrote to memory of 3064 4552 s7951332.exe AppLaunch.exe PID 3084 wrote to memory of 4320 3084 z0444970.exe t5905531.exe PID 3084 wrote to memory of 4320 3084 z0444970.exe t5905531.exe PID 3084 wrote to memory of 4320 3084 z0444970.exe t5905531.exe PID 4320 wrote to memory of 5068 4320 t5905531.exe explothe.exe PID 4320 wrote to memory of 5068 4320 t5905531.exe explothe.exe PID 4320 wrote to memory of 5068 4320 t5905531.exe explothe.exe PID 768 wrote to memory of 1248 768 z5046044.exe u6357463.exe PID 768 wrote to memory of 1248 768 z5046044.exe u6357463.exe PID 768 wrote to memory of 1248 768 z5046044.exe u6357463.exe PID 5068 wrote to memory of 2760 5068 explothe.exe schtasks.exe PID 5068 wrote to memory of 2760 5068 explothe.exe schtasks.exe PID 5068 wrote to memory of 2760 5068 explothe.exe schtasks.exe PID 1248 wrote to memory of 2564 1248 u6357463.exe legota.exe PID 1248 wrote to memory of 2564 1248 u6357463.exe legota.exe PID 1248 wrote to memory of 2564 1248 u6357463.exe legota.exe PID 5068 wrote to memory of 3144 5068 explothe.exe cmd.exe PID 5068 wrote to memory of 3144 5068 explothe.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe"C:\Users\Admin\AppData\Local\Temp\9e8250d3d4bac84a7a67b04b8cc3855ff64778c4836d0edeaa68787b6fd24670.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5046044.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5046044.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0444970.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0444970.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0686192.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0686192.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9195991.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9195991.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 496 -s 5887⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7962078.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7962078.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2676 -s 1367⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7951332.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7951332.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1486⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5905531.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5905531.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explothe.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explothe.exe" /P "Admin:N"&&CACLS "explothe.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explothe.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6357463.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6357463.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3606179.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3606179.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 496 -ip 4961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2676 -ip 26761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1228 -ip 12281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4552 -ip 45521⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3606179.exeFilesize
23KB
MD581ac4ac55adbf8d786d5088dac496e7f
SHA108b2845dfd9df316af35d1d9622d5d99fc15f367
SHA256ad3820e660441c9643ebe52ae2c3e11e04711c6e03e0aff97253868f0bc381dc
SHA5125b18857c77c6a7d8c20e35cf4c05cc34f8ef54de1cc1e8ecbc6948341a0960eafd986e016c42f050bcfd659b8c307248a56e7d4b91e5b2c84d85f448d5dd83f1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w3606179.exeFilesize
23KB
MD581ac4ac55adbf8d786d5088dac496e7f
SHA108b2845dfd9df316af35d1d9622d5d99fc15f367
SHA256ad3820e660441c9643ebe52ae2c3e11e04711c6e03e0aff97253868f0bc381dc
SHA5125b18857c77c6a7d8c20e35cf4c05cc34f8ef54de1cc1e8ecbc6948341a0960eafd986e016c42f050bcfd659b8c307248a56e7d4b91e5b2c84d85f448d5dd83f1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5046044.exeFilesize
982KB
MD554232f07249fb5a544d5720e6c62aa9d
SHA1f52036fd339b5075901fd16505e598126b243686
SHA2562f11640fdb9372bddf0c63932d10b5e866d0b1271f71311b38ee8bea7fd99397
SHA51254b1876bef1ee953d6545aabd48fd4f4cac8840c307cf488d9388f880e431afa203993c50f10a68ce40bff1cd5fd617e9e5d037da29f2ef99c095fa84d7e8c08
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z5046044.exeFilesize
982KB
MD554232f07249fb5a544d5720e6c62aa9d
SHA1f52036fd339b5075901fd16505e598126b243686
SHA2562f11640fdb9372bddf0c63932d10b5e866d0b1271f71311b38ee8bea7fd99397
SHA51254b1876bef1ee953d6545aabd48fd4f4cac8840c307cf488d9388f880e431afa203993c50f10a68ce40bff1cd5fd617e9e5d037da29f2ef99c095fa84d7e8c08
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6357463.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6357463.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0444970.exeFilesize
799KB
MD514294c81c8b8b0386102fa9fb1469797
SHA117ebdcf68a21652c6f33be5cb7d0ed3ccc4887c6
SHA2566d6e9e1eafc922f037c5688cc4b9139dedc35b5ab74a16f311bbdbcb354b26e0
SHA5122ccfaf6b6c0f591897441cdc3011b346475ae793932d828d273ff6fcc0b073e2edacd990d24ff3eee1f38ecdaa3d81ba98966b3d942a3f63ff1e77e68ad12ef2
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z0444970.exeFilesize
799KB
MD514294c81c8b8b0386102fa9fb1469797
SHA117ebdcf68a21652c6f33be5cb7d0ed3ccc4887c6
SHA2566d6e9e1eafc922f037c5688cc4b9139dedc35b5ab74a16f311bbdbcb354b26e0
SHA5122ccfaf6b6c0f591897441cdc3011b346475ae793932d828d273ff6fcc0b073e2edacd990d24ff3eee1f38ecdaa3d81ba98966b3d942a3f63ff1e77e68ad12ef2
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5905531.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t5905531.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0686192.exeFilesize
616KB
MD5c01b94ebadfb76bf470560b70907f450
SHA141431490b6ded0dd5300d4e1fcaa537ac2010917
SHA256706b573c93b521992ea4f4d65a0e544429ca7bd1bac8fbff46d4d39956146157
SHA512255f764d0b109fbcf6330d0fc6bef9e615f996e1ab8a205d47e2b4b7beca159cf3f6d92f8a7ca863ed2eb92183d845e33b0725907bed841c5307ab81c6899961
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z0686192.exeFilesize
616KB
MD5c01b94ebadfb76bf470560b70907f450
SHA141431490b6ded0dd5300d4e1fcaa537ac2010917
SHA256706b573c93b521992ea4f4d65a0e544429ca7bd1bac8fbff46d4d39956146157
SHA512255f764d0b109fbcf6330d0fc6bef9e615f996e1ab8a205d47e2b4b7beca159cf3f6d92f8a7ca863ed2eb92183d845e33b0725907bed841c5307ab81c6899961
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7951332.exeFilesize
390KB
MD5b73134ba2a728bb5aa10a7f5a2d72012
SHA13507aeede8f19c210f098320c895a66e57c3fbcc
SHA2567711e2c085ff9fc882494dfa95647d66d28888cadad43c7b970024bcfd7a37fd
SHA512d81340bfd12626b0972ba91a7a61ed3d8ee235782bcb1dc580f8a74e4c7552b11e5ce8a7e7d815f7c40d6f3f96540a0ce714db2dbe277e23af71a31d921ce23f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7951332.exeFilesize
390KB
MD5b73134ba2a728bb5aa10a7f5a2d72012
SHA13507aeede8f19c210f098320c895a66e57c3fbcc
SHA2567711e2c085ff9fc882494dfa95647d66d28888cadad43c7b970024bcfd7a37fd
SHA512d81340bfd12626b0972ba91a7a61ed3d8ee235782bcb1dc580f8a74e4c7552b11e5ce8a7e7d815f7c40d6f3f96540a0ce714db2dbe277e23af71a31d921ce23f
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9195991.exeFilesize
346KB
MD546cf22ff85010f3465fee43c58c961e8
SHA1d3f586af918ce224e94fe49b0d0e97eb64c38434
SHA256b6c5a205f41c8e884e65fc69584dbbd730f1c0082d093c549c6daf22661b33f5
SHA5120760d47fd9a3a94b5a06642f0094dffdb5044037812c11102e25ccdd4526aa45b9265824a266ea4fefb960bd8cef1d8264b600c5e352ad881f3fa02ad02283ee
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z9195991.exeFilesize
346KB
MD546cf22ff85010f3465fee43c58c961e8
SHA1d3f586af918ce224e94fe49b0d0e97eb64c38434
SHA256b6c5a205f41c8e884e65fc69584dbbd730f1c0082d093c549c6daf22661b33f5
SHA5120760d47fd9a3a94b5a06642f0094dffdb5044037812c11102e25ccdd4526aa45b9265824a266ea4fefb960bd8cef1d8264b600c5e352ad881f3fa02ad02283ee
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exeFilesize
227KB
MD5714ef2707d69c2905c84b0685f602795
SHA166f34ac301e9ebf012556cad32ea568b78bc087a
SHA256607189be3d5a1eae2bad2746d5bdefda2d3850b88c02b88bf3699cfef446ea15
SHA5121696faee2aa666084611955e6a1cb014255da2b5c5c1c774698278cc6895a3936f637f28b9857c40d05984a5d69430d588149048581dfff54e835c7e333dd9a6
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8050929.exeFilesize
227KB
MD5714ef2707d69c2905c84b0685f602795
SHA166f34ac301e9ebf012556cad32ea568b78bc087a
SHA256607189be3d5a1eae2bad2746d5bdefda2d3850b88c02b88bf3699cfef446ea15
SHA5121696faee2aa666084611955e6a1cb014255da2b5c5c1c774698278cc6895a3936f637f28b9857c40d05984a5d69430d588149048581dfff54e835c7e333dd9a6
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7962078.exeFilesize
356KB
MD5e8ae0cd8eaf031b3bf20c6a6f8c22d99
SHA124e6ec957462d7516d4c80ffc8a346fdcdab5bdb
SHA25621d645de98efa1704b4609c7a99d6e3adde09527fae99627327f6be2ac000f2c
SHA512589590ca77262b470a0f98deecf6ea063192cc43fa6b064ffbc4caba0e6b5b599006c6648e5e9bc6a2acc91325f21a033f6f1c33c69e102c3e1a8232101408ff
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r7962078.exeFilesize
356KB
MD5e8ae0cd8eaf031b3bf20c6a6f8c22d99
SHA124e6ec957462d7516d4c80ffc8a346fdcdab5bdb
SHA25621d645de98efa1704b4609c7a99d6e3adde09527fae99627327f6be2ac000f2c
SHA512589590ca77262b470a0f98deecf6ea063192cc43fa6b064ffbc4caba0e6b5b599006c6648e5e9bc6a2acc91325f21a033f6f1c33c69e102c3e1a8232101408ff
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explothe.exeFilesize
219KB
MD54bd59a6b3207f99fc3435baf3c22bc4e
SHA1ae90587beed289f177f4143a8380ba27109d0a6f
SHA25608e33db08288da47bbbe3a8d65a59e8536b05c464ba91dc66e08f9abd245e236
SHA512ca7517384a5449145a819e45445ff9bbcb27ea1b9e2a63c13ef12e256475e0ccbf05031b5ab5cb83a24b2cdd37d425cc7b9044c660098d39f47f05e95bbb6324
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD5e913b0d252d36f7c9b71268df4f634fb
SHA15ac70d8793712bcd8ede477071146bbb42d3f018
SHA2564cf5b584cf79ac523f645807a65bc153fbeaa564c0e1acb4dac9004fc9d038da
SHA5123ea08f0897c1b7b5859961351eef59840bbf319a6ad7ebe1c9e1b5e2ce25588d7b1a37fd6c5417653521fc73f1f42eb043d0ee6fcd645aa92b8f305d726273b4
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD5a5b509a3fb95cc3c8d89cd39fc2a30fb
SHA15aff4266a9c0f2af440f28aa865cebc5ddb9cd5c
SHA2565f3c80056c7b1104c15d6fee49dac07e665c6ffd0795ad486803641ed619c529
SHA5123cc58d989c461a04f29acbfe03ed05f970b3b3e97e6819962fc5c853f55bce7f7aba0544a712e3a45ee52ab31943c898f6b3684d755b590e3e961ae5ecd1edb9
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1228-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1228-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1228-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1228-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3064-63-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/3064-49-0x00000000028A0000-0x00000000028A6000-memory.dmpFilesize
24KB
-
memory/3064-86-0x0000000073C20000-0x00000000743D0000-memory.dmpFilesize
7.7MB
-
memory/3064-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3064-50-0x0000000073C20000-0x00000000743D0000-memory.dmpFilesize
7.7MB
-
memory/3064-83-0x000000000A560000-0x000000000A5AC000-memory.dmpFilesize
304KB
-
memory/3064-72-0x000000000A510000-0x000000000A54C000-memory.dmpFilesize
240KB
-
memory/3064-62-0x000000000A4B0000-0x000000000A4C2000-memory.dmpFilesize
72KB
-
memory/3064-61-0x000000000A5C0000-0x000000000A6CA000-memory.dmpFilesize
1.0MB
-
memory/3064-57-0x000000000AAD0000-0x000000000B0E8000-memory.dmpFilesize
6.1MB
-
memory/3064-88-0x0000000005120000-0x0000000005130000-memory.dmpFilesize
64KB
-
memory/3924-84-0x0000000073C20000-0x00000000743D0000-memory.dmpFilesize
7.7MB
-
memory/3924-87-0x0000000073C20000-0x00000000743D0000-memory.dmpFilesize
7.7MB
-
memory/3924-36-0x0000000073C20000-0x00000000743D0000-memory.dmpFilesize
7.7MB
-
memory/3924-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB