Analysis
-
max time kernel
171s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 07:33
Static task
static1
Behavioral task
behavioral1
Sample
f1c959df7dd61d396faee6edf36d31f1616db1fe55520b51c71510f5fb664e56.exe
Resource
win7-20230831-en
General
-
Target
f1c959df7dd61d396faee6edf36d31f1616db1fe55520b51c71510f5fb664e56.exe
-
Size
1.0MB
-
MD5
7d69de281f673e24c3577742cd22fbce
-
SHA1
786dff0bedd5328c81029ff8dc18fb02a735a9c3
-
SHA256
f1c959df7dd61d396faee6edf36d31f1616db1fe55520b51c71510f5fb664e56
-
SHA512
47ccfa0cd0566681b5f7f01c9f164f4a2efb6d93ec44fc3abb3d08effdd5b5b242d7acb91c4fbbffa31cd98c86c0a47d3724741ce5bc59740cd5746a21f5f4d8
-
SSDEEP
24576:uyN1O1iVtHuLP8TeiADSqtPjMHnnkbxu:90YtTelDSAbx
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4012-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4012-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4012-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4012-46-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/556-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legota.exet9478976.exeexplonde.exeu9047334.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation t9478976.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation u9047334.exe -
Executes dropped EXE 16 IoCs
Processes:
z3170072.exez8275413.exez5211261.exez8023864.exeq1205428.exer2464441.exes9545391.exet9478976.exeexplonde.exeu9047334.exelegota.exew6401715.exelegota.exeexplonde.exelegota.exeexplonde.exepid process 3316 z3170072.exe 1276 z8275413.exe 2040 z5211261.exe 3812 z8023864.exe 3776 q1205428.exe 4320 r2464441.exe 4524 s9545391.exe 228 t9478976.exe 2932 explonde.exe 2220 u9047334.exe 3988 legota.exe 1116 w6401715.exe 4676 legota.exe 824 explonde.exe 2384 legota.exe 2648 explonde.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 220 rundll32.exe 4372 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z5211261.exez8023864.exef1c959df7dd61d396faee6edf36d31f1616db1fe55520b51c71510f5fb664e56.exez3170072.exez8275413.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z5211261.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z8023864.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" f1c959df7dd61d396faee6edf36d31f1616db1fe55520b51c71510f5fb664e56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z3170072.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z8275413.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q1205428.exer2464441.exes9545391.exedescription pid process target process PID 3776 set thread context of 556 3776 q1205428.exe AppLaunch.exe PID 4320 set thread context of 4012 4320 r2464441.exe AppLaunch.exe PID 4524 set thread context of 3124 4524 s9545391.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4892 3776 WerFault.exe q1205428.exe 2424 4320 WerFault.exe r2464441.exe 2420 4012 WerFault.exe AppLaunch.exe 4104 4524 WerFault.exe s9545391.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2648 schtasks.exe 1052 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 556 AppLaunch.exe 556 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 556 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f1c959df7dd61d396faee6edf36d31f1616db1fe55520b51c71510f5fb664e56.exez3170072.exez8275413.exez5211261.exez8023864.exeq1205428.exer2464441.exes9545391.exet9478976.exeexplonde.exedescription pid process target process PID 3852 wrote to memory of 3316 3852 f1c959df7dd61d396faee6edf36d31f1616db1fe55520b51c71510f5fb664e56.exe z3170072.exe PID 3852 wrote to memory of 3316 3852 f1c959df7dd61d396faee6edf36d31f1616db1fe55520b51c71510f5fb664e56.exe z3170072.exe PID 3852 wrote to memory of 3316 3852 f1c959df7dd61d396faee6edf36d31f1616db1fe55520b51c71510f5fb664e56.exe z3170072.exe PID 3316 wrote to memory of 1276 3316 z3170072.exe z8275413.exe PID 3316 wrote to memory of 1276 3316 z3170072.exe z8275413.exe PID 3316 wrote to memory of 1276 3316 z3170072.exe z8275413.exe PID 1276 wrote to memory of 2040 1276 z8275413.exe z5211261.exe PID 1276 wrote to memory of 2040 1276 z8275413.exe z5211261.exe PID 1276 wrote to memory of 2040 1276 z8275413.exe z5211261.exe PID 2040 wrote to memory of 3812 2040 z5211261.exe z8023864.exe PID 2040 wrote to memory of 3812 2040 z5211261.exe z8023864.exe PID 2040 wrote to memory of 3812 2040 z5211261.exe z8023864.exe PID 3812 wrote to memory of 3776 3812 z8023864.exe q1205428.exe PID 3812 wrote to memory of 3776 3812 z8023864.exe q1205428.exe PID 3812 wrote to memory of 3776 3812 z8023864.exe q1205428.exe PID 3776 wrote to memory of 556 3776 q1205428.exe AppLaunch.exe PID 3776 wrote to memory of 556 3776 q1205428.exe AppLaunch.exe PID 3776 wrote to memory of 556 3776 q1205428.exe AppLaunch.exe PID 3776 wrote to memory of 556 3776 q1205428.exe AppLaunch.exe PID 3776 wrote to memory of 556 3776 q1205428.exe AppLaunch.exe PID 3776 wrote to memory of 556 3776 q1205428.exe AppLaunch.exe PID 3776 wrote to memory of 556 3776 q1205428.exe AppLaunch.exe PID 3776 wrote to memory of 556 3776 q1205428.exe AppLaunch.exe PID 3812 wrote to memory of 4320 3812 z8023864.exe r2464441.exe PID 3812 wrote to memory of 4320 3812 z8023864.exe r2464441.exe PID 3812 wrote to memory of 4320 3812 z8023864.exe r2464441.exe PID 4320 wrote to memory of 4520 4320 r2464441.exe AppLaunch.exe PID 4320 wrote to memory of 4520 4320 r2464441.exe AppLaunch.exe PID 4320 wrote to memory of 4520 4320 r2464441.exe AppLaunch.exe PID 4320 wrote to memory of 4012 4320 r2464441.exe AppLaunch.exe PID 4320 wrote to memory of 4012 4320 r2464441.exe AppLaunch.exe PID 4320 wrote to memory of 4012 4320 r2464441.exe AppLaunch.exe PID 4320 wrote to memory of 4012 4320 r2464441.exe AppLaunch.exe PID 4320 wrote to memory of 4012 4320 r2464441.exe AppLaunch.exe PID 4320 wrote to memory of 4012 4320 r2464441.exe AppLaunch.exe PID 4320 wrote to memory of 4012 4320 r2464441.exe AppLaunch.exe PID 4320 wrote to memory of 4012 4320 r2464441.exe AppLaunch.exe PID 4320 wrote to memory of 4012 4320 r2464441.exe AppLaunch.exe PID 4320 wrote to memory of 4012 4320 r2464441.exe AppLaunch.exe PID 2040 wrote to memory of 4524 2040 z5211261.exe s9545391.exe PID 2040 wrote to memory of 4524 2040 z5211261.exe s9545391.exe PID 2040 wrote to memory of 4524 2040 z5211261.exe s9545391.exe PID 4524 wrote to memory of 3168 4524 s9545391.exe AppLaunch.exe PID 4524 wrote to memory of 3168 4524 s9545391.exe AppLaunch.exe PID 4524 wrote to memory of 3168 4524 s9545391.exe AppLaunch.exe PID 4524 wrote to memory of 3124 4524 s9545391.exe AppLaunch.exe PID 4524 wrote to memory of 3124 4524 s9545391.exe AppLaunch.exe PID 4524 wrote to memory of 3124 4524 s9545391.exe AppLaunch.exe PID 4524 wrote to memory of 3124 4524 s9545391.exe AppLaunch.exe PID 4524 wrote to memory of 3124 4524 s9545391.exe AppLaunch.exe PID 4524 wrote to memory of 3124 4524 s9545391.exe AppLaunch.exe PID 4524 wrote to memory of 3124 4524 s9545391.exe AppLaunch.exe PID 4524 wrote to memory of 3124 4524 s9545391.exe AppLaunch.exe PID 1276 wrote to memory of 228 1276 z8275413.exe t9478976.exe PID 1276 wrote to memory of 228 1276 z8275413.exe t9478976.exe PID 1276 wrote to memory of 228 1276 z8275413.exe t9478976.exe PID 228 wrote to memory of 2932 228 t9478976.exe explonde.exe PID 228 wrote to memory of 2932 228 t9478976.exe explonde.exe PID 228 wrote to memory of 2932 228 t9478976.exe explonde.exe PID 3316 wrote to memory of 2220 3316 z3170072.exe u9047334.exe PID 3316 wrote to memory of 2220 3316 z3170072.exe u9047334.exe PID 3316 wrote to memory of 2220 3316 z3170072.exe u9047334.exe PID 2932 wrote to memory of 2648 2932 explonde.exe schtasks.exe PID 2932 wrote to memory of 2648 2932 explonde.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1c959df7dd61d396faee6edf36d31f1616db1fe55520b51c71510f5fb664e56.exe"C:\Users\Admin\AppData\Local\Temp\f1c959df7dd61d396faee6edf36d31f1616db1fe55520b51c71510f5fb664e56.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3170072.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3170072.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8275413.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8275413.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5211261.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5211261.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8023864.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8023864.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1205428.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1205428.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 5847⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2464441.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2464441.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4012 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4320 -s 5847⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9545391.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9545391.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4524 -s 5846⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9478976.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9478976.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9047334.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9047334.exe3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6401715.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6401715.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3776 -ip 37761⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4320 -ip 43201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4012 -ip 40121⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4524 -ip 45241⤵
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.logFilesize
226B
MD5916851e072fbabc4796d8916c5131092
SHA1d48a602229a690c512d5fdaf4c8d77547a88e7a2
SHA2567e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d
SHA51207ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6401715.exeFilesize
22KB
MD551686a7b0c14d37fb510325666d32c94
SHA100d42e73db49559bd887557b85f28767414ef316
SHA256c18a977e6c57f12c2031dd9e39e090d27535d0a51bd0a5e0e7badfd6a7840d00
SHA51257a60b4e263416c539b9fad3cc88cc191bb9641a404e5002eadd857278073dd7502aa7093e72ff91ec3272b9cc034c5bded6ed76a388654961c459a108bb79be
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6401715.exeFilesize
22KB
MD551686a7b0c14d37fb510325666d32c94
SHA100d42e73db49559bd887557b85f28767414ef316
SHA256c18a977e6c57f12c2031dd9e39e090d27535d0a51bd0a5e0e7badfd6a7840d00
SHA51257a60b4e263416c539b9fad3cc88cc191bb9641a404e5002eadd857278073dd7502aa7093e72ff91ec3272b9cc034c5bded6ed76a388654961c459a108bb79be
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3170072.exeFilesize
966KB
MD502b470983f3f1152eb9bd5cfca8619e1
SHA1d37bff759cfecdc0e5eb5f319506ed064b74af0c
SHA256dfe14038a086ce1382b5afadca086bde3ab3eda93d335c241e0e21341879f7b7
SHA5127c489fca1bd7004cc7eecf11566f661b52ea07581e3afb8fba44f87a7e915a8b0516808985152625bcb8d131067d3413ad1e33e797304923bb2d07cb08e920ee
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3170072.exeFilesize
966KB
MD502b470983f3f1152eb9bd5cfca8619e1
SHA1d37bff759cfecdc0e5eb5f319506ed064b74af0c
SHA256dfe14038a086ce1382b5afadca086bde3ab3eda93d335c241e0e21341879f7b7
SHA5127c489fca1bd7004cc7eecf11566f661b52ea07581e3afb8fba44f87a7e915a8b0516808985152625bcb8d131067d3413ad1e33e797304923bb2d07cb08e920ee
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9047334.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u9047334.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8275413.exeFilesize
783KB
MD5a57209ecac5c35ba0916cb8024f18d6c
SHA121613589e7426f76e5776c98e3ab6c46064838cb
SHA256d901e5b948f6d92c9922ed24ce1c240b5407627997b237163c9fb7a5807b544f
SHA512d68ead7dcba40990c910f9aed7112ec3fd92717c86d6b2b589de53c5239a9a70ce8aa3d42d865c497b079dbb9a59ddc76f86b6e4f61717a3c194e41ef966ddb7
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8275413.exeFilesize
783KB
MD5a57209ecac5c35ba0916cb8024f18d6c
SHA121613589e7426f76e5776c98e3ab6c46064838cb
SHA256d901e5b948f6d92c9922ed24ce1c240b5407627997b237163c9fb7a5807b544f
SHA512d68ead7dcba40990c910f9aed7112ec3fd92717c86d6b2b589de53c5239a9a70ce8aa3d42d865c497b079dbb9a59ddc76f86b6e4f61717a3c194e41ef966ddb7
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9478976.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t9478976.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5211261.exeFilesize
600KB
MD54a80a0fcf3e5bb450bb5446e2c1a62a4
SHA104902dee2c0a47187076f0bb45c8c87b4e5b6337
SHA25641c49e8e304ee295c6a27bbffedac289e8c98518b3237b02888761b69668910d
SHA51242d3d9ee74cbe6cacb2b846b75c96775173ededd5b4216ed511a4ffae8f2a727a79d01180d56ee8e0afac443cba32b2a03f51d06d05b69b76a0f3374a68da7c7
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5211261.exeFilesize
600KB
MD54a80a0fcf3e5bb450bb5446e2c1a62a4
SHA104902dee2c0a47187076f0bb45c8c87b4e5b6337
SHA25641c49e8e304ee295c6a27bbffedac289e8c98518b3237b02888761b69668910d
SHA51242d3d9ee74cbe6cacb2b846b75c96775173ededd5b4216ed511a4ffae8f2a727a79d01180d56ee8e0afac443cba32b2a03f51d06d05b69b76a0f3374a68da7c7
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9545391.exeFilesize
380KB
MD5151ca090c2fbe7b78231b41380d61f39
SHA129c94d1ebe9151af36c2000cdce6f078d2f4084c
SHA256a81fdfb021580ce7830da175fd0985fac89f7118d4a6fd444c04fc87cc0522d6
SHA5125ec8f9a35cfe9785b3027eafe6f818a77d1bfaadeb08d25960fb902322198359719fc1e784cdf4225c57034b4aa88f7e2033c744e0d6fa75dce5d2d0825616e3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s9545391.exeFilesize
380KB
MD5151ca090c2fbe7b78231b41380d61f39
SHA129c94d1ebe9151af36c2000cdce6f078d2f4084c
SHA256a81fdfb021580ce7830da175fd0985fac89f7118d4a6fd444c04fc87cc0522d6
SHA5125ec8f9a35cfe9785b3027eafe6f818a77d1bfaadeb08d25960fb902322198359719fc1e784cdf4225c57034b4aa88f7e2033c744e0d6fa75dce5d2d0825616e3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8023864.exeFilesize
338KB
MD514c73626222e5d1af52769747e4b7ec4
SHA1d3dd4bf7d5855c1cfa8c58fe786fb8467dd6c0cc
SHA25683b8b13f747ec5b513bf466f329cd57e0fc90ead65da8e7842b1021e06a9ab2e
SHA512663c831202c4bc77337fb616c67455b6014735c9df46c2f0e708a656f8077d71d6bf893e19a68937a6ff73bf557bf95e8ae11ebcb4f934f0768cac4371c0e3dd
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8023864.exeFilesize
338KB
MD514c73626222e5d1af52769747e4b7ec4
SHA1d3dd4bf7d5855c1cfa8c58fe786fb8467dd6c0cc
SHA25683b8b13f747ec5b513bf466f329cd57e0fc90ead65da8e7842b1021e06a9ab2e
SHA512663c831202c4bc77337fb616c67455b6014735c9df46c2f0e708a656f8077d71d6bf893e19a68937a6ff73bf557bf95e8ae11ebcb4f934f0768cac4371c0e3dd
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1205428.exeFilesize
217KB
MD58a2daddca8b7bf38830d65672f5249f3
SHA1476f4053999ba49eb21b7970da367b37b38a55f2
SHA256571f4ff2383689a10e0d42ef6f1ea2d7de91cf4c5b310c84e755ef744b5fc798
SHA512b4f36b148de5f2515e457f70578743770164a25a254c06ec041ce4d21685ec6277b12f5593a757573a2cce1ca7d436d6204615f136afcd6d1dce0d5c5c932554
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q1205428.exeFilesize
217KB
MD58a2daddca8b7bf38830d65672f5249f3
SHA1476f4053999ba49eb21b7970da367b37b38a55f2
SHA256571f4ff2383689a10e0d42ef6f1ea2d7de91cf4c5b310c84e755ef744b5fc798
SHA512b4f36b148de5f2515e457f70578743770164a25a254c06ec041ce4d21685ec6277b12f5593a757573a2cce1ca7d436d6204615f136afcd6d1dce0d5c5c932554
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2464441.exeFilesize
346KB
MD5779d226668c11b2b0066f94d7e56e1d6
SHA118cd129414a50a92b257e9022adc5d97f62501f8
SHA256e5287372b7f694001853fcc9aa9f8be4d79249731958a77eb31e8a9ea0386b08
SHA512cdf025098f174977c01bd36bc75298b4d4784313b42376c3ec3390994686e7996bdf324654382b565501bb9866b353d14c0a2a0787d1f2d2a3d9414cee4c43fb
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r2464441.exeFilesize
346KB
MD5779d226668c11b2b0066f94d7e56e1d6
SHA118cd129414a50a92b257e9022adc5d97f62501f8
SHA256e5287372b7f694001853fcc9aa9f8be4d79249731958a77eb31e8a9ea0386b08
SHA512cdf025098f174977c01bd36bc75298b4d4784313b42376c3ec3390994686e7996bdf324654382b565501bb9866b353d14c0a2a0787d1f2d2a3d9414cee4c43fb
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/556-37-0x0000000074890000-0x0000000075040000-memory.dmpFilesize
7.7MB
-
memory/556-47-0x0000000074890000-0x0000000075040000-memory.dmpFilesize
7.7MB
-
memory/556-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/556-36-0x0000000074890000-0x0000000075040000-memory.dmpFilesize
7.7MB
-
memory/3124-54-0x0000000002DF0000-0x0000000002DF6000-memory.dmpFilesize
24KB
-
memory/3124-66-0x000000000AB70000-0x000000000AC7A000-memory.dmpFilesize
1.0MB
-
memory/3124-88-0x000000000AC80000-0x000000000ACCC000-memory.dmpFilesize
304KB
-
memory/3124-51-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3124-53-0x0000000073BA0000-0x0000000074350000-memory.dmpFilesize
7.7MB
-
memory/3124-87-0x0000000073BA0000-0x0000000074350000-memory.dmpFilesize
7.7MB
-
memory/3124-64-0x000000000AFF0000-0x000000000B608000-memory.dmpFilesize
6.1MB
-
memory/3124-86-0x000000000AB00000-0x000000000AB3C000-memory.dmpFilesize
240KB
-
memory/3124-69-0x0000000002DE0000-0x0000000002DF0000-memory.dmpFilesize
64KB
-
memory/3124-70-0x000000000AAA0000-0x000000000AAB2000-memory.dmpFilesize
72KB
-
memory/3124-89-0x0000000002DE0000-0x0000000002DF0000-memory.dmpFilesize
64KB
-
memory/4012-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4012-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4012-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4012-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB