Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 07:50
Static task
static1
Behavioral task
behavioral1
Sample
b542ad7d79013b0bb1403479eee3f8daa8b628a007d5dee9b9b788645e67faf2.exe
Resource
win7-20230831-en
General
-
Target
b542ad7d79013b0bb1403479eee3f8daa8b628a007d5dee9b9b788645e67faf2.exe
-
Size
1.3MB
-
MD5
35e589b043e2379b13bf6cda4fd2a833
-
SHA1
d9445b18e5ab976dca52697e68ec46b0a87c6318
-
SHA256
b542ad7d79013b0bb1403479eee3f8daa8b628a007d5dee9b9b788645e67faf2
-
SHA512
3d326bc6bc1e2acc9c617d925d5224aec071b6934658ebb648411d76e70636e989cc857735adc48ff4e1cbc78cbfa49f51009af02574189ef59830b31d615166
-
SSDEEP
24576:VydbGFR5Wpl5n1SHkSMNQKJF6cs1Gcawxk066Trba+vEjvc9tqc4jN:wtuR5KlZ1R/XJF6fgu6+vP9tJq
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4956-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4956-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4956-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4956-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2484-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t3467161.exeexplonde.exeu1057060.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation t3467161.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation u1057060.exe Key value queried \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 18 IoCs
Processes:
z0944375.exez3749307.exez2258073.exez7091633.exeq6842092.exer9141507.exes7575032.exet3467161.exeexplonde.exeu1057060.exelegota.exew2119414.exeexplonde.exelegota.exeexplonde.exelegota.exeexplonde.exelegota.exepid process 4324 z0944375.exe 2560 z3749307.exe 1860 z2258073.exe 2620 z7091633.exe 1608 q6842092.exe 4064 r9141507.exe 4736 s7575032.exe 748 t3467161.exe 2056 explonde.exe 5080 u1057060.exe 3392 legota.exe 4864 w2119414.exe 3120 explonde.exe 3736 legota.exe 4688 explonde.exe 3468 legota.exe 3624 explonde.exe 4956 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3668 rundll32.exe 3812 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
b542ad7d79013b0bb1403479eee3f8daa8b628a007d5dee9b9b788645e67faf2.exez0944375.exez3749307.exez2258073.exez7091633.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b542ad7d79013b0bb1403479eee3f8daa8b628a007d5dee9b9b788645e67faf2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z0944375.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z3749307.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z2258073.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z7091633.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q6842092.exer9141507.exes7575032.exedescription pid process target process PID 1608 set thread context of 2484 1608 q6842092.exe AppLaunch.exe PID 4064 set thread context of 4956 4064 r9141507.exe AppLaunch.exe PID 4736 set thread context of 2132 4736 s7575032.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3368 1608 WerFault.exe q6842092.exe 1240 4064 WerFault.exe r9141507.exe 1960 4956 WerFault.exe AppLaunch.exe 3900 4736 WerFault.exe s7575032.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3816 schtasks.exe 4660 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
AppLaunch.exepid process 2484 AppLaunch.exe 2484 AppLaunch.exe 2484 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 2484 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b542ad7d79013b0bb1403479eee3f8daa8b628a007d5dee9b9b788645e67faf2.exez0944375.exez3749307.exez2258073.exez7091633.exeq6842092.exer9141507.exes7575032.exet3467161.exeexplonde.exedescription pid process target process PID 1392 wrote to memory of 4324 1392 b542ad7d79013b0bb1403479eee3f8daa8b628a007d5dee9b9b788645e67faf2.exe z0944375.exe PID 1392 wrote to memory of 4324 1392 b542ad7d79013b0bb1403479eee3f8daa8b628a007d5dee9b9b788645e67faf2.exe z0944375.exe PID 1392 wrote to memory of 4324 1392 b542ad7d79013b0bb1403479eee3f8daa8b628a007d5dee9b9b788645e67faf2.exe z0944375.exe PID 4324 wrote to memory of 2560 4324 z0944375.exe z3749307.exe PID 4324 wrote to memory of 2560 4324 z0944375.exe z3749307.exe PID 4324 wrote to memory of 2560 4324 z0944375.exe z3749307.exe PID 2560 wrote to memory of 1860 2560 z3749307.exe z2258073.exe PID 2560 wrote to memory of 1860 2560 z3749307.exe z2258073.exe PID 2560 wrote to memory of 1860 2560 z3749307.exe z2258073.exe PID 1860 wrote to memory of 2620 1860 z2258073.exe z7091633.exe PID 1860 wrote to memory of 2620 1860 z2258073.exe z7091633.exe PID 1860 wrote to memory of 2620 1860 z2258073.exe z7091633.exe PID 2620 wrote to memory of 1608 2620 z7091633.exe q6842092.exe PID 2620 wrote to memory of 1608 2620 z7091633.exe q6842092.exe PID 2620 wrote to memory of 1608 2620 z7091633.exe q6842092.exe PID 1608 wrote to memory of 2484 1608 q6842092.exe AppLaunch.exe PID 1608 wrote to memory of 2484 1608 q6842092.exe AppLaunch.exe PID 1608 wrote to memory of 2484 1608 q6842092.exe AppLaunch.exe PID 1608 wrote to memory of 2484 1608 q6842092.exe AppLaunch.exe PID 1608 wrote to memory of 2484 1608 q6842092.exe AppLaunch.exe PID 1608 wrote to memory of 2484 1608 q6842092.exe AppLaunch.exe PID 1608 wrote to memory of 2484 1608 q6842092.exe AppLaunch.exe PID 1608 wrote to memory of 2484 1608 q6842092.exe AppLaunch.exe PID 2620 wrote to memory of 4064 2620 z7091633.exe r9141507.exe PID 2620 wrote to memory of 4064 2620 z7091633.exe r9141507.exe PID 2620 wrote to memory of 4064 2620 z7091633.exe r9141507.exe PID 4064 wrote to memory of 3296 4064 r9141507.exe AppLaunch.exe PID 4064 wrote to memory of 3296 4064 r9141507.exe AppLaunch.exe PID 4064 wrote to memory of 3296 4064 r9141507.exe AppLaunch.exe PID 4064 wrote to memory of 4956 4064 r9141507.exe AppLaunch.exe PID 4064 wrote to memory of 4956 4064 r9141507.exe AppLaunch.exe PID 4064 wrote to memory of 4956 4064 r9141507.exe AppLaunch.exe PID 4064 wrote to memory of 4956 4064 r9141507.exe AppLaunch.exe PID 4064 wrote to memory of 4956 4064 r9141507.exe AppLaunch.exe PID 4064 wrote to memory of 4956 4064 r9141507.exe AppLaunch.exe PID 4064 wrote to memory of 4956 4064 r9141507.exe AppLaunch.exe PID 4064 wrote to memory of 4956 4064 r9141507.exe AppLaunch.exe PID 4064 wrote to memory of 4956 4064 r9141507.exe AppLaunch.exe PID 4064 wrote to memory of 4956 4064 r9141507.exe AppLaunch.exe PID 1860 wrote to memory of 4736 1860 z2258073.exe s7575032.exe PID 1860 wrote to memory of 4736 1860 z2258073.exe s7575032.exe PID 1860 wrote to memory of 4736 1860 z2258073.exe s7575032.exe PID 4736 wrote to memory of 2132 4736 s7575032.exe AppLaunch.exe PID 4736 wrote to memory of 2132 4736 s7575032.exe AppLaunch.exe PID 4736 wrote to memory of 2132 4736 s7575032.exe AppLaunch.exe PID 4736 wrote to memory of 2132 4736 s7575032.exe AppLaunch.exe PID 4736 wrote to memory of 2132 4736 s7575032.exe AppLaunch.exe PID 4736 wrote to memory of 2132 4736 s7575032.exe AppLaunch.exe PID 4736 wrote to memory of 2132 4736 s7575032.exe AppLaunch.exe PID 4736 wrote to memory of 2132 4736 s7575032.exe AppLaunch.exe PID 2560 wrote to memory of 748 2560 z3749307.exe t3467161.exe PID 2560 wrote to memory of 748 2560 z3749307.exe t3467161.exe PID 2560 wrote to memory of 748 2560 z3749307.exe t3467161.exe PID 748 wrote to memory of 2056 748 t3467161.exe explonde.exe PID 748 wrote to memory of 2056 748 t3467161.exe explonde.exe PID 748 wrote to memory of 2056 748 t3467161.exe explonde.exe PID 4324 wrote to memory of 5080 4324 z0944375.exe u1057060.exe PID 4324 wrote to memory of 5080 4324 z0944375.exe u1057060.exe PID 4324 wrote to memory of 5080 4324 z0944375.exe u1057060.exe PID 2056 wrote to memory of 3816 2056 explonde.exe schtasks.exe PID 2056 wrote to memory of 3816 2056 explonde.exe schtasks.exe PID 2056 wrote to memory of 3816 2056 explonde.exe schtasks.exe PID 2056 wrote to memory of 2700 2056 explonde.exe cmd.exe PID 2056 wrote to memory of 2700 2056 explonde.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b542ad7d79013b0bb1403479eee3f8daa8b628a007d5dee9b9b788645e67faf2.exe"C:\Users\Admin\AppData\Local\Temp\b542ad7d79013b0bb1403479eee3f8daa8b628a007d5dee9b9b788645e67faf2.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0944375.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0944375.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3749307.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3749307.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2258073.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2258073.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7091633.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7091633.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6842092.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6842092.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1608 -s 1567⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9141507.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9141507.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 5847⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7575032.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7575032.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4736 -s 1486⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3467161.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3467161.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1057060.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1057060.exe3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2119414.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2119414.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1608 -ip 16081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4064 -ip 40641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4956 -ip 49561⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4736 -ip 47361⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2119414.exeFilesize
22KB
MD582a0a76c189cfad837121fda64730e9c
SHA1fb83980ee206e948ca7a5a6ab338660731e186dc
SHA256251f7efa232b2ae47877c5d5a814b240e6e9167b22fa7cc4e078a8dc8f76fe47
SHA512dacba945e47643df9e24ca3c97cd6bc2e241a3451f29b8e3afb37ed8f8f68789d90aff8bd3ade94143cc19944d0354922f4354d2ccdc4bdce208531b57fb9604
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w2119414.exeFilesize
22KB
MD582a0a76c189cfad837121fda64730e9c
SHA1fb83980ee206e948ca7a5a6ab338660731e186dc
SHA256251f7efa232b2ae47877c5d5a814b240e6e9167b22fa7cc4e078a8dc8f76fe47
SHA512dacba945e47643df9e24ca3c97cd6bc2e241a3451f29b8e3afb37ed8f8f68789d90aff8bd3ade94143cc19944d0354922f4354d2ccdc4bdce208531b57fb9604
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0944375.exeFilesize
1.2MB
MD5dedb99c2ea6e93aa2407448f91a951a5
SHA1bc8e2ec48373f16be18b3f140007cac1132d99fa
SHA2568fe70446090f684beca7cb154c593efdb83a2356c12e807df091f13e28c05f49
SHA5125d43f570c3fe7f466d28d852a9da0be014793788aa2c8e2edd64d48320a812253bfe2ec80b666527c1af52bb40db953555b1d388ff096f11db26c3f1934df9bb
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z0944375.exeFilesize
1.2MB
MD5dedb99c2ea6e93aa2407448f91a951a5
SHA1bc8e2ec48373f16be18b3f140007cac1132d99fa
SHA2568fe70446090f684beca7cb154c593efdb83a2356c12e807df091f13e28c05f49
SHA5125d43f570c3fe7f466d28d852a9da0be014793788aa2c8e2edd64d48320a812253bfe2ec80b666527c1af52bb40db953555b1d388ff096f11db26c3f1934df9bb
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1057060.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u1057060.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3749307.exeFilesize
1.0MB
MD52837dee72894e0720b676943bbb495fb
SHA14385222838c3c539267621051119f15cade20ece
SHA25601413b675e87503c0e158baaf5cb0f73dc030f53b30d4d867db41e2c55c63f66
SHA512ef0761e79c57b025f360311b4bdffd7ec2669df3ee017273e80311f507f44d6c73fa5ae2d7fc25f6dfe316cf34743e67048b0424e069f6e98f31a3f25934b4d1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z3749307.exeFilesize
1.0MB
MD52837dee72894e0720b676943bbb495fb
SHA14385222838c3c539267621051119f15cade20ece
SHA25601413b675e87503c0e158baaf5cb0f73dc030f53b30d4d867db41e2c55c63f66
SHA512ef0761e79c57b025f360311b4bdffd7ec2669df3ee017273e80311f507f44d6c73fa5ae2d7fc25f6dfe316cf34743e67048b0424e069f6e98f31a3f25934b4d1
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3467161.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3467161.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2258073.exeFilesize
882KB
MD5329a087b3e680dfbc6beea74579d3776
SHA18eb02cd3e2eb871e08c29ae95537c88a4610df53
SHA256f390147385af800966718d7facb1122633811deaef7ae9c4a3d848bda634d29c
SHA512d39821ba8ba3e85dda24d6d1538b1369ae20ae6c37598f3accba8768a6e26258461d52d26f7f22fa5a8a200bac0c7529a298426f8b259bb92ae2128eed286273
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z2258073.exeFilesize
882KB
MD5329a087b3e680dfbc6beea74579d3776
SHA18eb02cd3e2eb871e08c29ae95537c88a4610df53
SHA256f390147385af800966718d7facb1122633811deaef7ae9c4a3d848bda634d29c
SHA512d39821ba8ba3e85dda24d6d1538b1369ae20ae6c37598f3accba8768a6e26258461d52d26f7f22fa5a8a200bac0c7529a298426f8b259bb92ae2128eed286273
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7575032.exeFilesize
1.0MB
MD5036d52b70bf9cfe2d347a97414ecb3f0
SHA12a27ded94cd280cd03c24f0b6b183067ddba1fba
SHA256f46b0feeea2cd4ae6b85a1526e3c9d3da7f9a2a70599b300496004dff3284a8c
SHA512ace762b6d857de6dad5c1307e34f370c0ab07a04aac8c00fa8c5296ce91dbd83db50986e702730aaf0dcb46bbfb284f0d241dfccf7461e9608f46f69c1589575
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s7575032.exeFilesize
1.0MB
MD5036d52b70bf9cfe2d347a97414ecb3f0
SHA12a27ded94cd280cd03c24f0b6b183067ddba1fba
SHA256f46b0feeea2cd4ae6b85a1526e3c9d3da7f9a2a70599b300496004dff3284a8c
SHA512ace762b6d857de6dad5c1307e34f370c0ab07a04aac8c00fa8c5296ce91dbd83db50986e702730aaf0dcb46bbfb284f0d241dfccf7461e9608f46f69c1589575
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7091633.exeFilesize
491KB
MD50e595e35d3ecd10dc92eff7e2a385857
SHA1273b983ac7f35e0a8f0772cca0adc01507582fac
SHA256dea457ee41df6b1bdd3e178dea955d091a7c8529caff1af784accf2ab8855853
SHA5124fc4747f814f2caa1e5ede0b52a2ce8f1ad8eae48e6642ed52bf2afb8c4f0124701ad5a65b41e143fc32d8d87b795335be55138992720706f6a125dc4395c5a3
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z7091633.exeFilesize
491KB
MD50e595e35d3ecd10dc92eff7e2a385857
SHA1273b983ac7f35e0a8f0772cca0adc01507582fac
SHA256dea457ee41df6b1bdd3e178dea955d091a7c8529caff1af784accf2ab8855853
SHA5124fc4747f814f2caa1e5ede0b52a2ce8f1ad8eae48e6642ed52bf2afb8c4f0124701ad5a65b41e143fc32d8d87b795335be55138992720706f6a125dc4395c5a3
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6842092.exeFilesize
860KB
MD5617543fc73fee5375304b3dbf6466202
SHA11df55f05574ee0eefe120f0c8b1e1368f7bbc748
SHA2567098a514ef4ff4cdfbf3bc607432784ff76d16336914c4db8b487cb8c1f96972
SHA512c335ced767991ea4246a2339bf0661a4eeb484ad01b637397190b1eb89634e160bff788dd3414e119407fc1893344ee694e0949aa49d081b73f48c23955622f2
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q6842092.exeFilesize
860KB
MD5617543fc73fee5375304b3dbf6466202
SHA11df55f05574ee0eefe120f0c8b1e1368f7bbc748
SHA2567098a514ef4ff4cdfbf3bc607432784ff76d16336914c4db8b487cb8c1f96972
SHA512c335ced767991ea4246a2339bf0661a4eeb484ad01b637397190b1eb89634e160bff788dd3414e119407fc1893344ee694e0949aa49d081b73f48c23955622f2
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9141507.exeFilesize
1016KB
MD5e9b0efdb8548034650a57609704936ec
SHA1e9c9ac4a642315128ebf4dc96e1c0dd33a787fcb
SHA256af1fba2124826b1909bd2a55a1d5dfe78f1d272897103c0c8cb6ea42750980dc
SHA5128288722f65281999cfb0c8ce52992cbc588a41c9d2555ae042166ac292fc9090dd8d6757cb2fed7303842cd947473eb62b8280865cf0b80f39a03f7faa4e7eb1
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r9141507.exeFilesize
1016KB
MD5e9b0efdb8548034650a57609704936ec
SHA1e9c9ac4a642315128ebf4dc96e1c0dd33a787fcb
SHA256af1fba2124826b1909bd2a55a1d5dfe78f1d272897103c0c8cb6ea42750980dc
SHA5128288722f65281999cfb0c8ce52992cbc588a41c9d2555ae042166ac292fc9090dd8d6757cb2fed7303842cd947473eb62b8280865cf0b80f39a03f7faa4e7eb1
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/2132-63-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/2132-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2132-49-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/2132-87-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/2132-88-0x0000000005010000-0x0000000005020000-memory.dmpFilesize
64KB
-
memory/2132-66-0x0000000005120000-0x000000000515C000-memory.dmpFilesize
240KB
-
memory/2132-50-0x0000000001000000-0x0000000001006000-memory.dmpFilesize
24KB
-
memory/2132-62-0x0000000004FB0000-0x0000000004FC2000-memory.dmpFilesize
72KB
-
memory/2132-58-0x0000000005230000-0x000000000533A000-memory.dmpFilesize
1.0MB
-
memory/2132-56-0x0000000005740000-0x0000000005D58000-memory.dmpFilesize
6.1MB
-
memory/2132-73-0x0000000005170000-0x00000000051BC000-memory.dmpFilesize
304KB
-
memory/2484-84-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/2484-86-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/2484-36-0x0000000074710000-0x0000000074EC0000-memory.dmpFilesize
7.7MB
-
memory/2484-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4956-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4956-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4956-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4956-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB