Analysis
-
max time kernel
152s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:56
Static task
static1
Behavioral task
behavioral1
Sample
22ac29f53b2c49b0af864821e46fa98b0590b4c616525360d9dde552efbacd0f.exe
Resource
win7-20230831-en
General
-
Target
22ac29f53b2c49b0af864821e46fa98b0590b4c616525360d9dde552efbacd0f.exe
-
Size
1.3MB
-
MD5
00ee0c88efb995962014749fb3802749
-
SHA1
0dab9ff1aad2a0ab52d3c7d89c50dc8f1b2d3ec4
-
SHA256
22ac29f53b2c49b0af864821e46fa98b0590b4c616525360d9dde552efbacd0f
-
SHA512
d1221f5decfc03e7f27c410d24a9759d28744c81745aecf1e0022188fec03e42f040390344f9004287027790fb77dab14d00c47f197c63dd50d373bba75c0582
-
SSDEEP
24576:oyChV4MxgmtzgMHJ9P5vnThJ8dE1A7GRgLrwQ1Q4r5BonzG8vRFL:vLMVzgMp9dT4dDGRgLkQ1QyrKVp
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4140-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4140-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4140-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4140-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4488-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t3852540.exeexplonde.exeu0294859.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation t3852540.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation u0294859.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z7267817.exez2220124.exez1084637.exez5140034.exeq0075553.exer5010541.exes1304113.exet3852540.exeexplonde.exeu0294859.exelegota.exew4602513.exeexplonde.exelegota.exeexplonde.exelegota.exepid process 2776 z7267817.exe 3196 z2220124.exe 1196 z1084637.exe 3544 z5140034.exe 1976 q0075553.exe 1052 r5010541.exe 3036 s1304113.exe 1948 t3852540.exe 2632 explonde.exe 2552 u0294859.exe 3772 legota.exe 4996 w4602513.exe 496 explonde.exe 1956 legota.exe 3664 explonde.exe 496 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 2248 rundll32.exe 4940 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
22ac29f53b2c49b0af864821e46fa98b0590b4c616525360d9dde552efbacd0f.exez7267817.exez2220124.exez1084637.exez5140034.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 22ac29f53b2c49b0af864821e46fa98b0590b4c616525360d9dde552efbacd0f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z7267817.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z2220124.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z1084637.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z5140034.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q0075553.exer5010541.exes1304113.exedescription pid process target process PID 1976 set thread context of 4488 1976 q0075553.exe AppLaunch.exe PID 1052 set thread context of 4140 1052 r5010541.exe AppLaunch.exe PID 3036 set thread context of 4048 3036 s1304113.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 5060 1976 WerFault.exe q0075553.exe 2120 1052 WerFault.exe r5010541.exe 1860 4140 WerFault.exe AppLaunch.exe 2816 3036 WerFault.exe s1304113.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4628 schtasks.exe 3676 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 4488 AppLaunch.exe 4488 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 4488 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
22ac29f53b2c49b0af864821e46fa98b0590b4c616525360d9dde552efbacd0f.exez7267817.exez2220124.exez1084637.exez5140034.exeq0075553.exer5010541.exes1304113.exet3852540.exeexplonde.exeu0294859.exedescription pid process target process PID 2124 wrote to memory of 2776 2124 22ac29f53b2c49b0af864821e46fa98b0590b4c616525360d9dde552efbacd0f.exe z7267817.exe PID 2124 wrote to memory of 2776 2124 22ac29f53b2c49b0af864821e46fa98b0590b4c616525360d9dde552efbacd0f.exe z7267817.exe PID 2124 wrote to memory of 2776 2124 22ac29f53b2c49b0af864821e46fa98b0590b4c616525360d9dde552efbacd0f.exe z7267817.exe PID 2776 wrote to memory of 3196 2776 z7267817.exe z2220124.exe PID 2776 wrote to memory of 3196 2776 z7267817.exe z2220124.exe PID 2776 wrote to memory of 3196 2776 z7267817.exe z2220124.exe PID 3196 wrote to memory of 1196 3196 z2220124.exe z1084637.exe PID 3196 wrote to memory of 1196 3196 z2220124.exe z1084637.exe PID 3196 wrote to memory of 1196 3196 z2220124.exe z1084637.exe PID 1196 wrote to memory of 3544 1196 z1084637.exe z5140034.exe PID 1196 wrote to memory of 3544 1196 z1084637.exe z5140034.exe PID 1196 wrote to memory of 3544 1196 z1084637.exe z5140034.exe PID 3544 wrote to memory of 1976 3544 z5140034.exe q0075553.exe PID 3544 wrote to memory of 1976 3544 z5140034.exe q0075553.exe PID 3544 wrote to memory of 1976 3544 z5140034.exe q0075553.exe PID 1976 wrote to memory of 4488 1976 q0075553.exe AppLaunch.exe PID 1976 wrote to memory of 4488 1976 q0075553.exe AppLaunch.exe PID 1976 wrote to memory of 4488 1976 q0075553.exe AppLaunch.exe PID 1976 wrote to memory of 4488 1976 q0075553.exe AppLaunch.exe PID 1976 wrote to memory of 4488 1976 q0075553.exe AppLaunch.exe PID 1976 wrote to memory of 4488 1976 q0075553.exe AppLaunch.exe PID 1976 wrote to memory of 4488 1976 q0075553.exe AppLaunch.exe PID 1976 wrote to memory of 4488 1976 q0075553.exe AppLaunch.exe PID 3544 wrote to memory of 1052 3544 z5140034.exe r5010541.exe PID 3544 wrote to memory of 1052 3544 z5140034.exe r5010541.exe PID 3544 wrote to memory of 1052 3544 z5140034.exe r5010541.exe PID 1052 wrote to memory of 3360 1052 r5010541.exe AppLaunch.exe PID 1052 wrote to memory of 3360 1052 r5010541.exe AppLaunch.exe PID 1052 wrote to memory of 3360 1052 r5010541.exe AppLaunch.exe PID 1052 wrote to memory of 4140 1052 r5010541.exe AppLaunch.exe PID 1052 wrote to memory of 4140 1052 r5010541.exe AppLaunch.exe PID 1052 wrote to memory of 4140 1052 r5010541.exe AppLaunch.exe PID 1052 wrote to memory of 4140 1052 r5010541.exe AppLaunch.exe PID 1052 wrote to memory of 4140 1052 r5010541.exe AppLaunch.exe PID 1052 wrote to memory of 4140 1052 r5010541.exe AppLaunch.exe PID 1052 wrote to memory of 4140 1052 r5010541.exe AppLaunch.exe PID 1052 wrote to memory of 4140 1052 r5010541.exe AppLaunch.exe PID 1052 wrote to memory of 4140 1052 r5010541.exe AppLaunch.exe PID 1052 wrote to memory of 4140 1052 r5010541.exe AppLaunch.exe PID 1196 wrote to memory of 3036 1196 z1084637.exe s1304113.exe PID 1196 wrote to memory of 3036 1196 z1084637.exe s1304113.exe PID 1196 wrote to memory of 3036 1196 z1084637.exe s1304113.exe PID 3036 wrote to memory of 4048 3036 s1304113.exe AppLaunch.exe PID 3036 wrote to memory of 4048 3036 s1304113.exe AppLaunch.exe PID 3036 wrote to memory of 4048 3036 s1304113.exe AppLaunch.exe PID 3036 wrote to memory of 4048 3036 s1304113.exe AppLaunch.exe PID 3036 wrote to memory of 4048 3036 s1304113.exe AppLaunch.exe PID 3036 wrote to memory of 4048 3036 s1304113.exe AppLaunch.exe PID 3036 wrote to memory of 4048 3036 s1304113.exe AppLaunch.exe PID 3036 wrote to memory of 4048 3036 s1304113.exe AppLaunch.exe PID 3196 wrote to memory of 1948 3196 z2220124.exe t3852540.exe PID 3196 wrote to memory of 1948 3196 z2220124.exe t3852540.exe PID 3196 wrote to memory of 1948 3196 z2220124.exe t3852540.exe PID 1948 wrote to memory of 2632 1948 t3852540.exe explonde.exe PID 1948 wrote to memory of 2632 1948 t3852540.exe explonde.exe PID 1948 wrote to memory of 2632 1948 t3852540.exe explonde.exe PID 2776 wrote to memory of 2552 2776 z7267817.exe u0294859.exe PID 2776 wrote to memory of 2552 2776 z7267817.exe u0294859.exe PID 2776 wrote to memory of 2552 2776 z7267817.exe u0294859.exe PID 2632 wrote to memory of 4628 2632 explonde.exe schtasks.exe PID 2632 wrote to memory of 4628 2632 explonde.exe schtasks.exe PID 2632 wrote to memory of 4628 2632 explonde.exe schtasks.exe PID 2552 wrote to memory of 3772 2552 u0294859.exe legota.exe PID 2552 wrote to memory of 3772 2552 u0294859.exe legota.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22ac29f53b2c49b0af864821e46fa98b0590b4c616525360d9dde552efbacd0f.exe"C:\Users\Admin\AppData\Local\Temp\22ac29f53b2c49b0af864821e46fa98b0590b4c616525360d9dde552efbacd0f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7267817.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7267817.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2220124.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2220124.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1084637.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1084637.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5140034.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5140034.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0075553.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0075553.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4488 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 1527⤵
- Program crash
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5010541.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5010541.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:3360
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:4140
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4140 -s 5408⤵
- Program crash
PID:1860 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1052 -s 5847⤵
- Program crash
PID:2120 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1304113.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1304113.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:4048
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 1486⤵
- Program crash
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3852540.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3852540.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
PID:4628 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:1664
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3328
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵PID:2052
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵PID:2312
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1412
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:4216
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:3012
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0294859.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0294859.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:3772 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:3944
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:2772
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1976
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:4020
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:1584
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:2120
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:4224
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:3676 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4602513.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4602513.exe2⤵
- Executes dropped EXE
PID:4996
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1976 -ip 19761⤵PID:3972
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1052 -ip 10521⤵PID:4112
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4140 -ip 41401⤵PID:2636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3036 -ip 30361⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:496
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:1956
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:3664
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:496
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4602513.exeFilesize
22KB
MD59c53f9f0e08f4c7d2821f585b9de701f
SHA1f00e268a4949f32392fa2c750dc6d0af282f5e0e
SHA256be66d7c4d4163cd2cfc9c91bb58c1edb025af106d4ad96c8123c6f40681e7f3f
SHA512b243215cd43cc0e79c2b84b96417da7e6b6b39079ef2821124e4abbb2c608cbbc25572fa4de3ac5c2f6310abfdaae6dd39617f9bef0ff71845b73f379239c597
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4602513.exeFilesize
22KB
MD59c53f9f0e08f4c7d2821f585b9de701f
SHA1f00e268a4949f32392fa2c750dc6d0af282f5e0e
SHA256be66d7c4d4163cd2cfc9c91bb58c1edb025af106d4ad96c8123c6f40681e7f3f
SHA512b243215cd43cc0e79c2b84b96417da7e6b6b39079ef2821124e4abbb2c608cbbc25572fa4de3ac5c2f6310abfdaae6dd39617f9bef0ff71845b73f379239c597
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7267817.exeFilesize
1.2MB
MD52d8854771635e96f36624febe4537c08
SHA12930b5ee4ca7d5b2a7bf038be66566cbcdeb765b
SHA256959a2429a659ab8ee7bb9f8cb978ee51e03cb808d6aa84d419bd7ec501a32e18
SHA512d97a3d7d09cc2c9f08a3e5f858eb6685ccb169075de20544fa6b9c7eebf6898a3b2c21236de854dc5b599b9d9c6193a910c70b73b3062385eff240c679cfc457
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z7267817.exeFilesize
1.2MB
MD52d8854771635e96f36624febe4537c08
SHA12930b5ee4ca7d5b2a7bf038be66566cbcdeb765b
SHA256959a2429a659ab8ee7bb9f8cb978ee51e03cb808d6aa84d419bd7ec501a32e18
SHA512d97a3d7d09cc2c9f08a3e5f858eb6685ccb169075de20544fa6b9c7eebf6898a3b2c21236de854dc5b599b9d9c6193a910c70b73b3062385eff240c679cfc457
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0294859.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u0294859.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2220124.exeFilesize
1.0MB
MD5435bd5e139a61f4b9348799423b0cdd1
SHA1c55f368a4f65eba9fbfbdecdbe66a25060357c03
SHA2563da4a94578b8275bcf520c32029d5da62a314f339af249d74b0ccb8f9e0bb2dd
SHA512a12cced4de6a89322b3ab9f71e2e5dfa1663ef29dd49c3ded51fd374d05abd4d319a597eabf006f3d0512bbc411b9d6ce670211b25fce01acd1c567d3996271b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z2220124.exeFilesize
1.0MB
MD5435bd5e139a61f4b9348799423b0cdd1
SHA1c55f368a4f65eba9fbfbdecdbe66a25060357c03
SHA2563da4a94578b8275bcf520c32029d5da62a314f339af249d74b0ccb8f9e0bb2dd
SHA512a12cced4de6a89322b3ab9f71e2e5dfa1663ef29dd49c3ded51fd374d05abd4d319a597eabf006f3d0512bbc411b9d6ce670211b25fce01acd1c567d3996271b
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3852540.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3852540.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1084637.exeFilesize
890KB
MD59301cb162262c21467e409e34c083b10
SHA1abcf1b431853b7115ae6091b591d5de7a93677ec
SHA2562e1d54b8f901ca82b03038d7e5dd540ac9291ee4e641f4de787e628b930134c1
SHA5128e891e9a6ad6b6375e46beb88ee82fbb681d5ef1299d52c2e0e88f22e53dfe25a4381560a51af169a327b80e56a7c7c7c6fb87efb31bb871ec6781d1f08318c3
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z1084637.exeFilesize
890KB
MD59301cb162262c21467e409e34c083b10
SHA1abcf1b431853b7115ae6091b591d5de7a93677ec
SHA2562e1d54b8f901ca82b03038d7e5dd540ac9291ee4e641f4de787e628b930134c1
SHA5128e891e9a6ad6b6375e46beb88ee82fbb681d5ef1299d52c2e0e88f22e53dfe25a4381560a51af169a327b80e56a7c7c7c6fb87efb31bb871ec6781d1f08318c3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1304113.exeFilesize
1.0MB
MD5170c2d85d4d23434fac6f0490134d271
SHA1c112036ed860c7e78d237ba2e940bcfe0cdde30c
SHA2560377e5b8ec6edd6f4818195aa45ac8010e7dcb5079bec718216e148e21765ac9
SHA512888d144c8c73752d27870cea26a22701d11d63ca4146b7253cd40aa2777873979b8e4ad886cffd5d65d185aba8a16bf52afa774a4ac5bc04324651a3df4bccd3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s1304113.exeFilesize
1.0MB
MD5170c2d85d4d23434fac6f0490134d271
SHA1c112036ed860c7e78d237ba2e940bcfe0cdde30c
SHA2560377e5b8ec6edd6f4818195aa45ac8010e7dcb5079bec718216e148e21765ac9
SHA512888d144c8c73752d27870cea26a22701d11d63ca4146b7253cd40aa2777873979b8e4ad886cffd5d65d185aba8a16bf52afa774a4ac5bc04324651a3df4bccd3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5140034.exeFilesize
499KB
MD53abbfa448b60de10f3fbda079fc1ede1
SHA19be3b2dc46377c0ce21809fffd2bd5a3b88a0b46
SHA256ab46c18d29907aae620962f7302a257d3a5789cd8f58adc2191e1569ec2b64fc
SHA512604374b8fd993806979ac89d65e2710d542c4eed557623db1bb7eeac5b58c139115186d3f49d0b19cf64b0e03d7e2763d4fd9856197fdc2e76ae8a233ac37751
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z5140034.exeFilesize
499KB
MD53abbfa448b60de10f3fbda079fc1ede1
SHA19be3b2dc46377c0ce21809fffd2bd5a3b88a0b46
SHA256ab46c18d29907aae620962f7302a257d3a5789cd8f58adc2191e1569ec2b64fc
SHA512604374b8fd993806979ac89d65e2710d542c4eed557623db1bb7eeac5b58c139115186d3f49d0b19cf64b0e03d7e2763d4fd9856197fdc2e76ae8a233ac37751
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0075553.exeFilesize
860KB
MD59fe4f348592f5abfac13127b76ee54af
SHA1fb3a82f325d56a3e91613d90a253ea11f52c3033
SHA256b07f17bac1312c58426b60c9779a8a6d74c7f4d746021b51438d5967374192dc
SHA5128d65124e66d310129d7c9ac3ab522e0d3df3567317292a486426e22f4edf135f31244983502e91849a408d458de252c3595a5647c19718daf3940a5f91143f59
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q0075553.exeFilesize
860KB
MD59fe4f348592f5abfac13127b76ee54af
SHA1fb3a82f325d56a3e91613d90a253ea11f52c3033
SHA256b07f17bac1312c58426b60c9779a8a6d74c7f4d746021b51438d5967374192dc
SHA5128d65124e66d310129d7c9ac3ab522e0d3df3567317292a486426e22f4edf135f31244983502e91849a408d458de252c3595a5647c19718daf3940a5f91143f59
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5010541.exeFilesize
1016KB
MD58078177861b4615ee055179a999ab29e
SHA1158d24fd37af5447b57d23ff2fc7cfacd6e2b1a8
SHA2562fe3799f6321b28cc6a9583d919c7f65cdff167fb0f1f0ffce5840fa5dba7f29
SHA5127f7775267659793400c3b2ad824bb5c95cee0a505c902d3b897e281072eaee672b085e7d0273f6a39b93eda69320954faf03a1a0bb58c6f44c5eb7173e7213c2
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r5010541.exeFilesize
1016KB
MD58078177861b4615ee055179a999ab29e
SHA1158d24fd37af5447b57d23ff2fc7cfacd6e2b1a8
SHA2562fe3799f6321b28cc6a9583d919c7f65cdff167fb0f1f0ffce5840fa5dba7f29
SHA5127f7775267659793400c3b2ad824bb5c95cee0a505c902d3b897e281072eaee672b085e7d0273f6a39b93eda69320954faf03a1a0bb58c6f44c5eb7173e7213c2
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/4048-87-0x0000000005270000-0x00000000052BC000-memory.dmpFilesize
304KB
-
memory/4048-74-0x00000000052F0000-0x00000000053FA000-memory.dmpFilesize
1.0MB
-
memory/4048-83-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB
-
memory/4048-85-0x0000000005220000-0x000000000525C000-memory.dmpFilesize
240KB
-
memory/4048-86-0x0000000073A90000-0x0000000074240000-memory.dmpFilesize
7.7MB
-
memory/4048-66-0x0000000005800000-0x0000000005E18000-memory.dmpFilesize
6.1MB
-
memory/4048-88-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB
-
memory/4048-51-0x0000000002990000-0x0000000002996000-memory.dmpFilesize
24KB
-
memory/4048-50-0x0000000073A90000-0x0000000074240000-memory.dmpFilesize
7.7MB
-
memory/4048-84-0x0000000004FB0000-0x0000000004FC2000-memory.dmpFilesize
72KB
-
memory/4048-49-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4140-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4140-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4140-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4140-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4488-37-0x0000000073A90000-0x0000000074240000-memory.dmpFilesize
7.7MB
-
memory/4488-64-0x0000000073A90000-0x0000000074240000-memory.dmpFilesize
7.7MB
-
memory/4488-36-0x0000000073A90000-0x0000000074240000-memory.dmpFilesize
7.7MB
-
memory/4488-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB