Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:55
Static task
static1
Behavioral task
behavioral1
Sample
768ebd4958bd7b2f4fd8dad5b2fcd3f083516eb97fd20a09118c90e683d286d3.exe
Resource
win7-20230831-en
General
-
Target
768ebd4958bd7b2f4fd8dad5b2fcd3f083516eb97fd20a09118c90e683d286d3.exe
-
Size
1.3MB
-
MD5
779d2d36f840ad23e8afa4da57856613
-
SHA1
db87117976685f37951e13f86dbbd758868f78be
-
SHA256
768ebd4958bd7b2f4fd8dad5b2fcd3f083516eb97fd20a09118c90e683d286d3
-
SHA512
9164b4b420ea57e153b2c595f5f7ba466afaf08934142379343014cac02312cb96bc62643f6c9a9c02594234f4b1aade4119866b97125205bea425303884e8fc
-
SSDEEP
24576:KyBvGMCL5EfRwNgYDJVUACvT4eJOU4d/armbvvR6/ftxCTDEP4tNvdo:RBv21E4jJ2j4o0vR63txwAQNv
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3788-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3788-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3788-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3788-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1124-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legota.exet4058491.exeexplonde.exeu6244071.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation t4058491.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation u6244071.exe -
Executes dropped EXE 18 IoCs
Processes:
z2849784.exez8654727.exez7951720.exez3832205.exeq4814963.exer3538950.exes4102551.exet4058491.exeexplonde.exeu6244071.exelegota.exew0213248.exelegota.exeexplonde.exelegota.exeexplonde.exelegota.exeexplonde.exepid process 2888 z2849784.exe 1444 z8654727.exe 2232 z7951720.exe 4140 z3832205.exe 3160 q4814963.exe 4700 r3538950.exe 2788 s4102551.exe 5036 t4058491.exe 3068 explonde.exe 2056 u6244071.exe 60 legota.exe 4032 w0213248.exe 4432 legota.exe 4824 explonde.exe 2392 legota.exe 3668 explonde.exe 4140 legota.exe 232 explonde.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4084 rundll32.exe 4784 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z7951720.exez3832205.exe768ebd4958bd7b2f4fd8dad5b2fcd3f083516eb97fd20a09118c90e683d286d3.exez2849784.exez8654727.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z7951720.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z3832205.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 768ebd4958bd7b2f4fd8dad5b2fcd3f083516eb97fd20a09118c90e683d286d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z2849784.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z8654727.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q4814963.exer3538950.exes4102551.exedescription pid process target process PID 3160 set thread context of 1124 3160 q4814963.exe AppLaunch.exe PID 4700 set thread context of 3788 4700 r3538950.exe AppLaunch.exe PID 2788 set thread context of 3624 2788 s4102551.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 560 3160 WerFault.exe q4814963.exe 1964 4700 WerFault.exe r3538950.exe 3152 3788 WerFault.exe AppLaunch.exe 1636 2788 WerFault.exe s4102551.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4004 schtasks.exe 4456 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 1124 AppLaunch.exe 1124 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 1124 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
768ebd4958bd7b2f4fd8dad5b2fcd3f083516eb97fd20a09118c90e683d286d3.exez2849784.exez8654727.exez7951720.exez3832205.exeq4814963.exer3538950.exes4102551.exet4058491.exeexplonde.exeu6244071.exedescription pid process target process PID 1076 wrote to memory of 2888 1076 768ebd4958bd7b2f4fd8dad5b2fcd3f083516eb97fd20a09118c90e683d286d3.exe z2849784.exe PID 1076 wrote to memory of 2888 1076 768ebd4958bd7b2f4fd8dad5b2fcd3f083516eb97fd20a09118c90e683d286d3.exe z2849784.exe PID 1076 wrote to memory of 2888 1076 768ebd4958bd7b2f4fd8dad5b2fcd3f083516eb97fd20a09118c90e683d286d3.exe z2849784.exe PID 2888 wrote to memory of 1444 2888 z2849784.exe z8654727.exe PID 2888 wrote to memory of 1444 2888 z2849784.exe z8654727.exe PID 2888 wrote to memory of 1444 2888 z2849784.exe z8654727.exe PID 1444 wrote to memory of 2232 1444 z8654727.exe z7951720.exe PID 1444 wrote to memory of 2232 1444 z8654727.exe z7951720.exe PID 1444 wrote to memory of 2232 1444 z8654727.exe z7951720.exe PID 2232 wrote to memory of 4140 2232 z7951720.exe z3832205.exe PID 2232 wrote to memory of 4140 2232 z7951720.exe z3832205.exe PID 2232 wrote to memory of 4140 2232 z7951720.exe z3832205.exe PID 4140 wrote to memory of 3160 4140 z3832205.exe q4814963.exe PID 4140 wrote to memory of 3160 4140 z3832205.exe q4814963.exe PID 4140 wrote to memory of 3160 4140 z3832205.exe q4814963.exe PID 3160 wrote to memory of 1124 3160 q4814963.exe AppLaunch.exe PID 3160 wrote to memory of 1124 3160 q4814963.exe AppLaunch.exe PID 3160 wrote to memory of 1124 3160 q4814963.exe AppLaunch.exe PID 3160 wrote to memory of 1124 3160 q4814963.exe AppLaunch.exe PID 3160 wrote to memory of 1124 3160 q4814963.exe AppLaunch.exe PID 3160 wrote to memory of 1124 3160 q4814963.exe AppLaunch.exe PID 3160 wrote to memory of 1124 3160 q4814963.exe AppLaunch.exe PID 3160 wrote to memory of 1124 3160 q4814963.exe AppLaunch.exe PID 4140 wrote to memory of 4700 4140 z3832205.exe r3538950.exe PID 4140 wrote to memory of 4700 4140 z3832205.exe r3538950.exe PID 4140 wrote to memory of 4700 4140 z3832205.exe r3538950.exe PID 4700 wrote to memory of 3788 4700 r3538950.exe AppLaunch.exe PID 4700 wrote to memory of 3788 4700 r3538950.exe AppLaunch.exe PID 4700 wrote to memory of 3788 4700 r3538950.exe AppLaunch.exe PID 4700 wrote to memory of 3788 4700 r3538950.exe AppLaunch.exe PID 4700 wrote to memory of 3788 4700 r3538950.exe AppLaunch.exe PID 4700 wrote to memory of 3788 4700 r3538950.exe AppLaunch.exe PID 4700 wrote to memory of 3788 4700 r3538950.exe AppLaunch.exe PID 4700 wrote to memory of 3788 4700 r3538950.exe AppLaunch.exe PID 4700 wrote to memory of 3788 4700 r3538950.exe AppLaunch.exe PID 4700 wrote to memory of 3788 4700 r3538950.exe AppLaunch.exe PID 2232 wrote to memory of 2788 2232 z7951720.exe s4102551.exe PID 2232 wrote to memory of 2788 2232 z7951720.exe s4102551.exe PID 2232 wrote to memory of 2788 2232 z7951720.exe s4102551.exe PID 2788 wrote to memory of 3624 2788 s4102551.exe AppLaunch.exe PID 2788 wrote to memory of 3624 2788 s4102551.exe AppLaunch.exe PID 2788 wrote to memory of 3624 2788 s4102551.exe AppLaunch.exe PID 2788 wrote to memory of 3624 2788 s4102551.exe AppLaunch.exe PID 2788 wrote to memory of 3624 2788 s4102551.exe AppLaunch.exe PID 2788 wrote to memory of 3624 2788 s4102551.exe AppLaunch.exe PID 2788 wrote to memory of 3624 2788 s4102551.exe AppLaunch.exe PID 2788 wrote to memory of 3624 2788 s4102551.exe AppLaunch.exe PID 1444 wrote to memory of 5036 1444 z8654727.exe t4058491.exe PID 1444 wrote to memory of 5036 1444 z8654727.exe t4058491.exe PID 1444 wrote to memory of 5036 1444 z8654727.exe t4058491.exe PID 5036 wrote to memory of 3068 5036 t4058491.exe explonde.exe PID 5036 wrote to memory of 3068 5036 t4058491.exe explonde.exe PID 5036 wrote to memory of 3068 5036 t4058491.exe explonde.exe PID 2888 wrote to memory of 2056 2888 z2849784.exe u6244071.exe PID 2888 wrote to memory of 2056 2888 z2849784.exe u6244071.exe PID 2888 wrote to memory of 2056 2888 z2849784.exe u6244071.exe PID 3068 wrote to memory of 4004 3068 explonde.exe schtasks.exe PID 3068 wrote to memory of 4004 3068 explonde.exe schtasks.exe PID 3068 wrote to memory of 4004 3068 explonde.exe schtasks.exe PID 3068 wrote to memory of 3688 3068 explonde.exe cmd.exe PID 3068 wrote to memory of 3688 3068 explonde.exe cmd.exe PID 3068 wrote to memory of 3688 3068 explonde.exe cmd.exe PID 2056 wrote to memory of 60 2056 u6244071.exe legota.exe PID 2056 wrote to memory of 60 2056 u6244071.exe legota.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\768ebd4958bd7b2f4fd8dad5b2fcd3f083516eb97fd20a09118c90e683d286d3.exe"C:\Users\Admin\AppData\Local\Temp\768ebd4958bd7b2f4fd8dad5b2fcd3f083516eb97fd20a09118c90e683d286d3.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2849784.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2849784.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8654727.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8654727.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7951720.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7951720.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3832205.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3832205.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4814963.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4814963.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 1607⤵
- Program crash
PID:560 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3538950.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3538950.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:3788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3788 -s 5408⤵
- Program crash
PID:3152 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 5967⤵
- Program crash
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4102551.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4102551.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:3624
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 1486⤵
- Program crash
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4058491.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4058491.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
PID:4004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:3688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3812
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵PID:4532
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵PID:1788
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4472
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:3340
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:4704
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6244071.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6244071.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:60 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:4456 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:4964
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:5096
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:872
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:1256
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:3860
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:1648
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:5048
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0213248.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0213248.exe2⤵
- Executes dropped EXE
PID:4032
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3160 -ip 31601⤵PID:384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4700 -ip 47001⤵PID:4824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3788 -ip 37881⤵PID:1904
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2788 -ip 27881⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4432
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:4824
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:2392
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:3668
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4140
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:232
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0213248.exeFilesize
22KB
MD5e865cc5093056f0aaf469274fc78602f
SHA1e4abe4f5714c61a0d107368e10f8560bb71843f0
SHA25645bc51ce9e476a97e514e578eae620c809b9e5f5ce6a89be7bd01c9281d11a67
SHA5128908a534b50b8432df956f22dd689fb879b07efc27bd7ebb2c12f1595534f4af8cc4b4bff9cd99287e88c1fe3b5be009b1ec743df9ac66689fa843c87ff237ce
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w0213248.exeFilesize
22KB
MD5e865cc5093056f0aaf469274fc78602f
SHA1e4abe4f5714c61a0d107368e10f8560bb71843f0
SHA25645bc51ce9e476a97e514e578eae620c809b9e5f5ce6a89be7bd01c9281d11a67
SHA5128908a534b50b8432df956f22dd689fb879b07efc27bd7ebb2c12f1595534f4af8cc4b4bff9cd99287e88c1fe3b5be009b1ec743df9ac66689fa843c87ff237ce
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2849784.exeFilesize
1.2MB
MD58fd658d636ae1c2c1d78469b10b76511
SHA1c777e8e39e9ae2241a993282b64f6a23439f4f61
SHA2566816ed8339349661afff36f966fde7a24708a1424621521268530cc5bb42f59e
SHA51207b069826a713ae8ac26795bffe89689ed386babfbd77fd40a71fccbe02c750662312ec0b5825e824d1d2d5a2edaa56598187410bf865e7ce4929f3d482bc2d6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z2849784.exeFilesize
1.2MB
MD58fd658d636ae1c2c1d78469b10b76511
SHA1c777e8e39e9ae2241a993282b64f6a23439f4f61
SHA2566816ed8339349661afff36f966fde7a24708a1424621521268530cc5bb42f59e
SHA51207b069826a713ae8ac26795bffe89689ed386babfbd77fd40a71fccbe02c750662312ec0b5825e824d1d2d5a2edaa56598187410bf865e7ce4929f3d482bc2d6
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6244071.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6244071.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8654727.exeFilesize
1.0MB
MD52c677ef0c135229295668d5d21a6190f
SHA161500e317bbb94e03f5af154234f55fe6cc75fee
SHA256a095bed81e3192b98d6d9135fb442d85d3ff51afa8736e3a712fc50cc47ad86f
SHA512a6428f56b48adf9206dc55c2c2857aa36b0425ba978ca2d6c513deccbda06c76881f6279c7fdf02a8b44bcaed855ad377ed35a01d2a48f55badcfaddc1882c76
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8654727.exeFilesize
1.0MB
MD52c677ef0c135229295668d5d21a6190f
SHA161500e317bbb94e03f5af154234f55fe6cc75fee
SHA256a095bed81e3192b98d6d9135fb442d85d3ff51afa8736e3a712fc50cc47ad86f
SHA512a6428f56b48adf9206dc55c2c2857aa36b0425ba978ca2d6c513deccbda06c76881f6279c7fdf02a8b44bcaed855ad377ed35a01d2a48f55badcfaddc1882c76
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4058491.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t4058491.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7951720.exeFilesize
884KB
MD5c1eb898b02970f3a0d44b9bed0e410e1
SHA143318310cc75b9ace0372ea21cc99ea94dfb60aa
SHA25651c2a560752aa87ee48d3d42099d57b388022b021e1fa2251d5829480d5717e9
SHA51266336bf1702e486130df2e838a5ecbdc4bc27d831334b8f25bb0c94b102599a7124cccf79713ac7dd5bafce80d31120dd78326456c181f9e0ac5e59ab16c6745
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z7951720.exeFilesize
884KB
MD5c1eb898b02970f3a0d44b9bed0e410e1
SHA143318310cc75b9ace0372ea21cc99ea94dfb60aa
SHA25651c2a560752aa87ee48d3d42099d57b388022b021e1fa2251d5829480d5717e9
SHA51266336bf1702e486130df2e838a5ecbdc4bc27d831334b8f25bb0c94b102599a7124cccf79713ac7dd5bafce80d31120dd78326456c181f9e0ac5e59ab16c6745
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4102551.exeFilesize
1.0MB
MD5e8b92c65698e148ef466fd076ed2651f
SHA13437179561e65a79d491df7c568334aec7fbaabb
SHA2565e1eaacad5b03dd0c424655a03b3a5b30ce0274e12eb4ef53e6258cd0b2aed71
SHA51292a9f2df6c6a5956516d7ea458614ce8529e249df158a321caeaccfcef8dc96304c0e4b9d5362be3c7f9075ff05a7d50daa75b1ec21e760294503e95092ce24d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4102551.exeFilesize
1.0MB
MD5e8b92c65698e148ef466fd076ed2651f
SHA13437179561e65a79d491df7c568334aec7fbaabb
SHA2565e1eaacad5b03dd0c424655a03b3a5b30ce0274e12eb4ef53e6258cd0b2aed71
SHA51292a9f2df6c6a5956516d7ea458614ce8529e249df158a321caeaccfcef8dc96304c0e4b9d5362be3c7f9075ff05a7d50daa75b1ec21e760294503e95092ce24d
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3832205.exeFilesize
494KB
MD51e8c084172971473ac87ccc676d8a03c
SHA113fae013a0b8f75f388685cd05cf6094997d885a
SHA25618b6bf0f8367bcc34d8f0ad95e7e9bac6ea1da751c0ff4185c7be2cf2651a8c6
SHA512386e8893eed49c5e426e856a680ae3301441f79c78d94a7db3001f2a921abfa512cc6a74d70e6ae003d4a5335ba678aa10cb5e3bea0c824d3460f9f7185405e1
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z3832205.exeFilesize
494KB
MD51e8c084172971473ac87ccc676d8a03c
SHA113fae013a0b8f75f388685cd05cf6094997d885a
SHA25618b6bf0f8367bcc34d8f0ad95e7e9bac6ea1da751c0ff4185c7be2cf2651a8c6
SHA512386e8893eed49c5e426e856a680ae3301441f79c78d94a7db3001f2a921abfa512cc6a74d70e6ae003d4a5335ba678aa10cb5e3bea0c824d3460f9f7185405e1
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4814963.exeFilesize
860KB
MD508e54e55501db7846d9adcb489c57398
SHA179382abee3f32f1e33d7112dc1dcf0f7cb85ba00
SHA2565a9f8513a7a0687f34f18acbd60a44d3ec981aa6c429059ce329338b500fe19d
SHA51255164c3828d1d1cef18edb86fa5ce296ed4e0958583a018cb4c848dec2dc6a53c5f3d507cff2de65b0f662308726e6302c4f21342d752b59d73d5aef4dc45956
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q4814963.exeFilesize
860KB
MD508e54e55501db7846d9adcb489c57398
SHA179382abee3f32f1e33d7112dc1dcf0f7cb85ba00
SHA2565a9f8513a7a0687f34f18acbd60a44d3ec981aa6c429059ce329338b500fe19d
SHA51255164c3828d1d1cef18edb86fa5ce296ed4e0958583a018cb4c848dec2dc6a53c5f3d507cff2de65b0f662308726e6302c4f21342d752b59d73d5aef4dc45956
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3538950.exeFilesize
1016KB
MD5097aa39e64c1f30d8c8815a67200bc63
SHA144d8943c8622e277cdadbaf5a9201d73dd4c1e4d
SHA25615426ed92cdfe65c9a03b33d70d03dc1aef239a4cb905f2c38f64456c0fe7884
SHA512cb543aa7887d9d4f50726b5f9a96b1e39dd2217a5f16316af0b12ecea821bd70c666631501ed0867780268fb0bb9caa5f7749ec80578c06593c6aaa2e259fae8
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r3538950.exeFilesize
1016KB
MD5097aa39e64c1f30d8c8815a67200bc63
SHA144d8943c8622e277cdadbaf5a9201d73dd4c1e4d
SHA25615426ed92cdfe65c9a03b33d70d03dc1aef239a4cb905f2c38f64456c0fe7884
SHA512cb543aa7887d9d4f50726b5f9a96b1e39dd2217a5f16316af0b12ecea821bd70c666631501ed0867780268fb0bb9caa5f7749ec80578c06593c6aaa2e259fae8
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1124-36-0x0000000073C90000-0x0000000074440000-memory.dmpFilesize
7.7MB
-
memory/1124-84-0x0000000073C90000-0x0000000074440000-memory.dmpFilesize
7.7MB
-
memory/1124-86-0x0000000073C90000-0x0000000074440000-memory.dmpFilesize
7.7MB
-
memory/1124-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3624-59-0x0000000005180000-0x0000000005192000-memory.dmpFilesize
72KB
-
memory/3624-88-0x0000000005030000-0x0000000005040000-memory.dmpFilesize
64KB
-
memory/3624-87-0x0000000073C90000-0x0000000074440000-memory.dmpFilesize
7.7MB
-
memory/3624-77-0x0000000005360000-0x00000000053AC000-memory.dmpFilesize
304KB
-
memory/3624-64-0x00000000051E0000-0x000000000521C000-memory.dmpFilesize
240KB
-
memory/3624-58-0x0000000005030000-0x0000000005040000-memory.dmpFilesize
64KB
-
memory/3624-57-0x0000000005250000-0x000000000535A000-memory.dmpFilesize
1.0MB
-
memory/3624-56-0x0000000005760000-0x0000000005D78000-memory.dmpFilesize
6.1MB
-
memory/3624-50-0x00000000074C0000-0x00000000074C6000-memory.dmpFilesize
24KB
-
memory/3624-49-0x0000000073C90000-0x0000000074440000-memory.dmpFilesize
7.7MB
-
memory/3624-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3788-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3788-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3788-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3788-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB