Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 06:57
Static task
static1
Behavioral task
behavioral1
Sample
a6dfe45b0323f8e48d3549b9086028b76744b783f609ae6902ebbd7c06726e97.exe
Resource
win7-20230831-en
General
-
Target
a6dfe45b0323f8e48d3549b9086028b76744b783f609ae6902ebbd7c06726e97.exe
-
Size
1.3MB
-
MD5
8a2c349dde632cbf07f78b9af319ca42
-
SHA1
1df46cd3ea8880adfb8c1ecf41c716e549719d1b
-
SHA256
a6dfe45b0323f8e48d3549b9086028b76744b783f609ae6902ebbd7c06726e97
-
SHA512
0aad364d841ac05ab7f0e04e17f321ed1435e56d84b35f40aa2f73ea68eb4436df7ff1666f50e614de36a9ce2abb798299f32b6d3c9129fb6ee07e15b4bfd2f9
-
SSDEEP
24576:NyZYFEFI5bMjjyhPAS7QatmmFTkNFfdO/Bfplz7kHx5:oZ0WItXmwQArTkNFk/Bfvz
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1660-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1660-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1660-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1660-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2808-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
u4232664.exelegota.exet6744966.exeexplonde.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation u4232664.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation t6744966.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation explonde.exe -
Executes dropped EXE 16 IoCs
Processes:
z9795548.exez9648676.exez2800240.exez1734636.exeq7618734.exer0212218.exes2871411.exet6744966.exeexplonde.exeu4232664.exelegota.exew4510838.exelegota.exeexplonde.exelegota.exeexplonde.exepid process 4888 z9795548.exe 1664 z9648676.exe 3368 z2800240.exe 1396 z1734636.exe 448 q7618734.exe 4536 r0212218.exe 1648 s2871411.exe 968 t6744966.exe 3764 explonde.exe 4324 u4232664.exe 4232 legota.exe 1448 w4510838.exe 3112 legota.exe 1544 explonde.exe 3376 legota.exe 4800 explonde.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3212 rundll32.exe 2100 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
a6dfe45b0323f8e48d3549b9086028b76744b783f609ae6902ebbd7c06726e97.exez9795548.exez9648676.exez2800240.exez1734636.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" a6dfe45b0323f8e48d3549b9086028b76744b783f609ae6902ebbd7c06726e97.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z9795548.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z9648676.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z2800240.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z1734636.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q7618734.exer0212218.exes2871411.exedescription pid process target process PID 448 set thread context of 2808 448 q7618734.exe AppLaunch.exe PID 4536 set thread context of 1660 4536 r0212218.exe AppLaunch.exe PID 1648 set thread context of 4884 1648 s2871411.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1176 448 WerFault.exe q7618734.exe 724 4536 WerFault.exe r0212218.exe 2136 1660 WerFault.exe AppLaunch.exe 2144 1648 WerFault.exe s2871411.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2964 schtasks.exe 2796 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 2808 AppLaunch.exe 2808 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2808 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a6dfe45b0323f8e48d3549b9086028b76744b783f609ae6902ebbd7c06726e97.exez9795548.exez9648676.exez2800240.exez1734636.exeq7618734.exer0212218.exes2871411.exet6744966.exeexplonde.exeu4232664.exedescription pid process target process PID 4296 wrote to memory of 4888 4296 a6dfe45b0323f8e48d3549b9086028b76744b783f609ae6902ebbd7c06726e97.exe z9795548.exe PID 4296 wrote to memory of 4888 4296 a6dfe45b0323f8e48d3549b9086028b76744b783f609ae6902ebbd7c06726e97.exe z9795548.exe PID 4296 wrote to memory of 4888 4296 a6dfe45b0323f8e48d3549b9086028b76744b783f609ae6902ebbd7c06726e97.exe z9795548.exe PID 4888 wrote to memory of 1664 4888 z9795548.exe z9648676.exe PID 4888 wrote to memory of 1664 4888 z9795548.exe z9648676.exe PID 4888 wrote to memory of 1664 4888 z9795548.exe z9648676.exe PID 1664 wrote to memory of 3368 1664 z9648676.exe z2800240.exe PID 1664 wrote to memory of 3368 1664 z9648676.exe z2800240.exe PID 1664 wrote to memory of 3368 1664 z9648676.exe z2800240.exe PID 3368 wrote to memory of 1396 3368 z2800240.exe z1734636.exe PID 3368 wrote to memory of 1396 3368 z2800240.exe z1734636.exe PID 3368 wrote to memory of 1396 3368 z2800240.exe z1734636.exe PID 1396 wrote to memory of 448 1396 z1734636.exe q7618734.exe PID 1396 wrote to memory of 448 1396 z1734636.exe q7618734.exe PID 1396 wrote to memory of 448 1396 z1734636.exe q7618734.exe PID 448 wrote to memory of 2808 448 q7618734.exe AppLaunch.exe PID 448 wrote to memory of 2808 448 q7618734.exe AppLaunch.exe PID 448 wrote to memory of 2808 448 q7618734.exe AppLaunch.exe PID 448 wrote to memory of 2808 448 q7618734.exe AppLaunch.exe PID 448 wrote to memory of 2808 448 q7618734.exe AppLaunch.exe PID 448 wrote to memory of 2808 448 q7618734.exe AppLaunch.exe PID 448 wrote to memory of 2808 448 q7618734.exe AppLaunch.exe PID 448 wrote to memory of 2808 448 q7618734.exe AppLaunch.exe PID 1396 wrote to memory of 4536 1396 z1734636.exe r0212218.exe PID 1396 wrote to memory of 4536 1396 z1734636.exe r0212218.exe PID 1396 wrote to memory of 4536 1396 z1734636.exe r0212218.exe PID 4536 wrote to memory of 1660 4536 r0212218.exe AppLaunch.exe PID 4536 wrote to memory of 1660 4536 r0212218.exe AppLaunch.exe PID 4536 wrote to memory of 1660 4536 r0212218.exe AppLaunch.exe PID 4536 wrote to memory of 1660 4536 r0212218.exe AppLaunch.exe PID 4536 wrote to memory of 1660 4536 r0212218.exe AppLaunch.exe PID 4536 wrote to memory of 1660 4536 r0212218.exe AppLaunch.exe PID 4536 wrote to memory of 1660 4536 r0212218.exe AppLaunch.exe PID 4536 wrote to memory of 1660 4536 r0212218.exe AppLaunch.exe PID 4536 wrote to memory of 1660 4536 r0212218.exe AppLaunch.exe PID 4536 wrote to memory of 1660 4536 r0212218.exe AppLaunch.exe PID 3368 wrote to memory of 1648 3368 z2800240.exe s2871411.exe PID 3368 wrote to memory of 1648 3368 z2800240.exe s2871411.exe PID 3368 wrote to memory of 1648 3368 z2800240.exe s2871411.exe PID 1648 wrote to memory of 4884 1648 s2871411.exe AppLaunch.exe PID 1648 wrote to memory of 4884 1648 s2871411.exe AppLaunch.exe PID 1648 wrote to memory of 4884 1648 s2871411.exe AppLaunch.exe PID 1648 wrote to memory of 4884 1648 s2871411.exe AppLaunch.exe PID 1648 wrote to memory of 4884 1648 s2871411.exe AppLaunch.exe PID 1648 wrote to memory of 4884 1648 s2871411.exe AppLaunch.exe PID 1648 wrote to memory of 4884 1648 s2871411.exe AppLaunch.exe PID 1648 wrote to memory of 4884 1648 s2871411.exe AppLaunch.exe PID 1664 wrote to memory of 968 1664 z9648676.exe t6744966.exe PID 1664 wrote to memory of 968 1664 z9648676.exe t6744966.exe PID 1664 wrote to memory of 968 1664 z9648676.exe t6744966.exe PID 968 wrote to memory of 3764 968 t6744966.exe explonde.exe PID 968 wrote to memory of 3764 968 t6744966.exe explonde.exe PID 968 wrote to memory of 3764 968 t6744966.exe explonde.exe PID 4888 wrote to memory of 4324 4888 z9795548.exe u4232664.exe PID 4888 wrote to memory of 4324 4888 z9795548.exe u4232664.exe PID 4888 wrote to memory of 4324 4888 z9795548.exe u4232664.exe PID 3764 wrote to memory of 2964 3764 explonde.exe schtasks.exe PID 3764 wrote to memory of 2964 3764 explonde.exe schtasks.exe PID 3764 wrote to memory of 2964 3764 explonde.exe schtasks.exe PID 3764 wrote to memory of 4956 3764 explonde.exe cmd.exe PID 3764 wrote to memory of 4956 3764 explonde.exe cmd.exe PID 3764 wrote to memory of 4956 3764 explonde.exe cmd.exe PID 4324 wrote to memory of 4232 4324 u4232664.exe legota.exe PID 4324 wrote to memory of 4232 4324 u4232664.exe legota.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6dfe45b0323f8e48d3549b9086028b76744b783f609ae6902ebbd7c06726e97.exe"C:\Users\Admin\AppData\Local\Temp\a6dfe45b0323f8e48d3549b9086028b76744b783f609ae6902ebbd7c06726e97.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9795548.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9795548.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9648676.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9648676.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2800240.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2800240.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1734636.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1734636.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7618734.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7618734.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 6087⤵
- Program crash
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0212218.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0212218.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:1660
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1660 -s 5408⤵
- Program crash
PID:2136 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4536 -s 1527⤵
- Program crash
PID:724 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2871411.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2871411.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:4884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1648 -s 1526⤵
- Program crash
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6744966.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6744966.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
PID:2964 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:4956
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:1952
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵PID:1528
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵PID:852
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3692
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:3852
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:1316
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4232664.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4232664.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:4232 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
PID:2796 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵PID:3820
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2264
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵PID:4024
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵PID:3716
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵PID:3336
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵PID:2024
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵PID:3568
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4510838.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4510838.exe2⤵
- Executes dropped EXE
PID:1448
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 448 -ip 4481⤵PID:4024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4536 -ip 45361⤵PID:1644
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1660 -ip 16601⤵PID:1168
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1648 -ip 16481⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:3112
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:1544
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:3376
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:4800
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4510838.exeFilesize
22KB
MD50289fbbaab98061d439591c29e1be4c4
SHA184606d9a9d3e3e061c2e2c15421c09aa4ac02ce0
SHA2564241d11e548ab4b9a8b9d8d21d625a5939089e6696fd76827ed5c7451cc03580
SHA5120c044dc2799b4118048ca55e721d1b21131ec1281ea9f39b0eb2899a2c4fea5663cb15ff8fc6e2d8c94fde3a54dbe444e91e96637136cfec022d374e715e5faf
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4510838.exeFilesize
22KB
MD50289fbbaab98061d439591c29e1be4c4
SHA184606d9a9d3e3e061c2e2c15421c09aa4ac02ce0
SHA2564241d11e548ab4b9a8b9d8d21d625a5939089e6696fd76827ed5c7451cc03580
SHA5120c044dc2799b4118048ca55e721d1b21131ec1281ea9f39b0eb2899a2c4fea5663cb15ff8fc6e2d8c94fde3a54dbe444e91e96637136cfec022d374e715e5faf
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9795548.exeFilesize
1.2MB
MD50f1f0cd277c4b6e90d58454a4e769bbc
SHA137cd31fbc7443517bfd981bcfe21089196ea5575
SHA2568a5c43b8d33722f152d3c3b8809383d36de969905d3fd8b6562aecfbd722a94f
SHA512242338e6cb174bb923643e44fc8e64d019d41b419bf04b7770dc533e4e4b190a4d900e0aa3018af28e15a321ee98e0da091e008b91ca7df710552c090c02b83b
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z9795548.exeFilesize
1.2MB
MD50f1f0cd277c4b6e90d58454a4e769bbc
SHA137cd31fbc7443517bfd981bcfe21089196ea5575
SHA2568a5c43b8d33722f152d3c3b8809383d36de969905d3fd8b6562aecfbd722a94f
SHA512242338e6cb174bb923643e44fc8e64d019d41b419bf04b7770dc533e4e4b190a4d900e0aa3018af28e15a321ee98e0da091e008b91ca7df710552c090c02b83b
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4232664.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4232664.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9648676.exeFilesize
1.0MB
MD53f5719cd4b7bf296b9050983967b1a36
SHA1db2b5d25597e84fcd413c84b64b5c93efca180a9
SHA25660777dcd86de090b583138f0906474e74aa5f761f348c37e8f24715afe7ec045
SHA512b136e070ec645f3a8c60bf7de2878ed1920fcd42fece62bb61e2b202453a62a1477484398dad50e347ec7ef283d9c2cd196e5fa869092b9d6e3d9d3d9f42b053
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z9648676.exeFilesize
1.0MB
MD53f5719cd4b7bf296b9050983967b1a36
SHA1db2b5d25597e84fcd413c84b64b5c93efca180a9
SHA25660777dcd86de090b583138f0906474e74aa5f761f348c37e8f24715afe7ec045
SHA512b136e070ec645f3a8c60bf7de2878ed1920fcd42fece62bb61e2b202453a62a1477484398dad50e347ec7ef283d9c2cd196e5fa869092b9d6e3d9d3d9f42b053
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6744966.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t6744966.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2800240.exeFilesize
880KB
MD5e3d4c4e12659eee7c62f459c9daff525
SHA1f0f3b9daf3fbfc835fb5a782f25d697cfdca067a
SHA2565e657fcad90d0f2b20b5357f638eeb153651f419af30960cf0123b77d4846b7d
SHA51210a50669fa1252c01c4d04f07b3679ba6d4491ef29a61a53320afc9c8f9380c9057301fec97617630d58ceea7fac56f2e4786f8147ed7a3d2ca3b90a8c66a28c
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2800240.exeFilesize
880KB
MD5e3d4c4e12659eee7c62f459c9daff525
SHA1f0f3b9daf3fbfc835fb5a782f25d697cfdca067a
SHA2565e657fcad90d0f2b20b5357f638eeb153651f419af30960cf0123b77d4846b7d
SHA51210a50669fa1252c01c4d04f07b3679ba6d4491ef29a61a53320afc9c8f9380c9057301fec97617630d58ceea7fac56f2e4786f8147ed7a3d2ca3b90a8c66a28c
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2871411.exeFilesize
1.0MB
MD5b05b3429a3f31a6a1682fb153bd2e717
SHA1d3e5b04a78dedca1a942000048b528d1aed654ed
SHA25619bab20f9d937c012354be3384015d0dff466212711cfd1566f28122028d794d
SHA512727d046195c6d3eac3daedd5f483e9abfa96edea6cb1d9fa5b401651a8716cb042b1b7c2dee23c53807dacec7cb953a4c96c7187e97881f29e7d5faeea003607
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s2871411.exeFilesize
1.0MB
MD5b05b3429a3f31a6a1682fb153bd2e717
SHA1d3e5b04a78dedca1a942000048b528d1aed654ed
SHA25619bab20f9d937c012354be3384015d0dff466212711cfd1566f28122028d794d
SHA512727d046195c6d3eac3daedd5f483e9abfa96edea6cb1d9fa5b401651a8716cb042b1b7c2dee23c53807dacec7cb953a4c96c7187e97881f29e7d5faeea003607
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1734636.exeFilesize
490KB
MD5a4ae6b7158f63c747ab338b9844c728f
SHA1847259b96f0a7764b3b4a4fc4f0e781b8ac8705f
SHA2566561464a031c21017446bff40aa74b5205d053658dc1ba5fb1d945651f499de6
SHA5127596aec5eba866a184fa3915d68a18064fc1eb64b89a0d20ae87050b36c440a61337e8626e5f5b02c7c60bf6b604c001f91ada62694487d75809c59fa4c32246
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1734636.exeFilesize
490KB
MD5a4ae6b7158f63c747ab338b9844c728f
SHA1847259b96f0a7764b3b4a4fc4f0e781b8ac8705f
SHA2566561464a031c21017446bff40aa74b5205d053658dc1ba5fb1d945651f499de6
SHA5127596aec5eba866a184fa3915d68a18064fc1eb64b89a0d20ae87050b36c440a61337e8626e5f5b02c7c60bf6b604c001f91ada62694487d75809c59fa4c32246
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7618734.exeFilesize
860KB
MD56831f7d57741067e4b0082d7fc4f8e0b
SHA1f72de97cc79f37ae2ca762ef9429f2bb7d8996eb
SHA256ca019474a96dcc3ce3b90298e85b464a86752ff73d94c323621dbd651c7932a6
SHA512d3db9056f4de613eab49eab087d36120e5d03a50da7e7451794241efe1d2a43f9c567ef7b36b178029544b75148feb16e1dabe20fc7daebd6fd5a9713676b014
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7618734.exeFilesize
860KB
MD56831f7d57741067e4b0082d7fc4f8e0b
SHA1f72de97cc79f37ae2ca762ef9429f2bb7d8996eb
SHA256ca019474a96dcc3ce3b90298e85b464a86752ff73d94c323621dbd651c7932a6
SHA512d3db9056f4de613eab49eab087d36120e5d03a50da7e7451794241efe1d2a43f9c567ef7b36b178029544b75148feb16e1dabe20fc7daebd6fd5a9713676b014
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0212218.exeFilesize
1016KB
MD59100f05394f371ad48c0b94255500794
SHA147d2aeb16213878995b463c754e16203f450ad1e
SHA25666e3c8abb8e895041edf8d2e4992c1ff0aefcbcec0f3aaf55fc0ec541f223ad6
SHA512c84e7c5759bb8f72b7061393365c3cf59f59251952bd488ff011d2781b99fbf106ff92c0a24d4f5dd43158cb8a1da8f0822da7adb360776ecb1f6993730118d7
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r0212218.exeFilesize
1016KB
MD59100f05394f371ad48c0b94255500794
SHA147d2aeb16213878995b463c754e16203f450ad1e
SHA25666e3c8abb8e895041edf8d2e4992c1ff0aefcbcec0f3aaf55fc0ec541f223ad6
SHA512c84e7c5759bb8f72b7061393365c3cf59f59251952bd488ff011d2781b99fbf106ff92c0a24d4f5dd43158cb8a1da8f0822da7adb360776ecb1f6993730118d7
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1660-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1660-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1660-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1660-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/2808-47-0x0000000074720000-0x0000000074ED0000-memory.dmpFilesize
7.7MB
-
memory/2808-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/2808-45-0x0000000074720000-0x0000000074ED0000-memory.dmpFilesize
7.7MB
-
memory/2808-36-0x0000000074720000-0x0000000074ED0000-memory.dmpFilesize
7.7MB
-
memory/4884-88-0x0000000074380000-0x0000000074B30000-memory.dmpFilesize
7.7MB
-
memory/4884-77-0x0000000005700000-0x000000000574C000-memory.dmpFilesize
304KB
-
memory/4884-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/4884-54-0x0000000074380000-0x0000000074B30000-memory.dmpFilesize
7.7MB
-
memory/4884-71-0x0000000005540000-0x000000000557C000-memory.dmpFilesize
240KB
-
memory/4884-66-0x00000000055F0000-0x0000000005600000-memory.dmpFilesize
64KB
-
memory/4884-67-0x0000000005520000-0x0000000005532000-memory.dmpFilesize
72KB
-
memory/4884-62-0x0000000005810000-0x000000000591A000-memory.dmpFilesize
1.0MB
-
memory/4884-60-0x0000000005D20000-0x0000000006338000-memory.dmpFilesize
6.1MB
-
memory/4884-89-0x00000000055F0000-0x0000000005600000-memory.dmpFilesize
64KB
-
memory/4884-53-0x00000000012A0000-0x00000000012A6000-memory.dmpFilesize
24KB