Analysis
-
max time kernel
151s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 07:59
Static task
static1
Behavioral task
behavioral1
Sample
b7805dec0b6b6e1bf76541f762dfd1def6da015d804810555e98017b5d7a2183.exe
Resource
win7-20230831-en
General
-
Target
b7805dec0b6b6e1bf76541f762dfd1def6da015d804810555e98017b5d7a2183.exe
-
Size
1.3MB
-
MD5
d527834728de8b7c783fd09b1e5ff5f6
-
SHA1
d9ac7ad5791e154b6f622e06f11b382fd5862cc0
-
SHA256
b7805dec0b6b6e1bf76541f762dfd1def6da015d804810555e98017b5d7a2183
-
SHA512
c41ee15c801b5cf23fb24746c129f8130100fad65d414491d44c9b82811e44b9be0b3380cf1b98faaa3e3f7f88c2746da32ff97b7274dc880e1de65ca2a34576
-
SSDEEP
24576:AyhxbRTz5yoWhnHqciBXAhMQAYB4ppBcYXwNJYoP5ms5vJaIzJ90Dta/:HhptzEoWAzQmQAQ4ppmYXwZ5m+LzJ90B
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1584-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1584-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1584-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/1584-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3220-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t0281814.exeexplonde.exeu6224885.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation t0281814.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation u6224885.exe Key value queried \REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 16 IoCs
Processes:
z3858980.exez8849308.exez6434601.exez1161641.exeq2076755.exer4600784.exes4830434.exet0281814.exeexplonde.exeu6224885.exelegota.exew4439393.exeexplonde.exelegota.exeexplonde.exelegota.exepid process 3920 z3858980.exe 2084 z8849308.exe 3956 z6434601.exe 4956 z1161641.exe 3828 q2076755.exe 1444 r4600784.exe 1740 s4830434.exe 3428 t0281814.exe 3904 explonde.exe 4324 u6224885.exe 1940 legota.exe 4088 w4439393.exe 4332 explonde.exe 2292 legota.exe 1984 explonde.exe 4956 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 2304 rundll32.exe 1116 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z3858980.exez8849308.exez6434601.exez1161641.exeb7805dec0b6b6e1bf76541f762dfd1def6da015d804810555e98017b5d7a2183.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z3858980.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z8849308.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z6434601.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z1161641.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b7805dec0b6b6e1bf76541f762dfd1def6da015d804810555e98017b5d7a2183.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q2076755.exer4600784.exes4830434.exedescription pid process target process PID 3828 set thread context of 3220 3828 q2076755.exe AppLaunch.exe PID 1444 set thread context of 1584 1444 r4600784.exe AppLaunch.exe PID 1740 set thread context of 3452 1740 s4830434.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3544 3828 WerFault.exe q2076755.exe 3360 1444 WerFault.exe r4600784.exe 5100 1584 WerFault.exe AppLaunch.exe 2632 1740 WerFault.exe s4830434.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4632 schtasks.exe 4120 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 3220 AppLaunch.exe 3220 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3220 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b7805dec0b6b6e1bf76541f762dfd1def6da015d804810555e98017b5d7a2183.exez3858980.exez8849308.exez6434601.exez1161641.exeq2076755.exer4600784.exes4830434.exet0281814.exeexplonde.exeu6224885.exedescription pid process target process PID 3088 wrote to memory of 3920 3088 b7805dec0b6b6e1bf76541f762dfd1def6da015d804810555e98017b5d7a2183.exe z3858980.exe PID 3088 wrote to memory of 3920 3088 b7805dec0b6b6e1bf76541f762dfd1def6da015d804810555e98017b5d7a2183.exe z3858980.exe PID 3088 wrote to memory of 3920 3088 b7805dec0b6b6e1bf76541f762dfd1def6da015d804810555e98017b5d7a2183.exe z3858980.exe PID 3920 wrote to memory of 2084 3920 z3858980.exe z8849308.exe PID 3920 wrote to memory of 2084 3920 z3858980.exe z8849308.exe PID 3920 wrote to memory of 2084 3920 z3858980.exe z8849308.exe PID 2084 wrote to memory of 3956 2084 z8849308.exe z6434601.exe PID 2084 wrote to memory of 3956 2084 z8849308.exe z6434601.exe PID 2084 wrote to memory of 3956 2084 z8849308.exe z6434601.exe PID 3956 wrote to memory of 4956 3956 z6434601.exe z1161641.exe PID 3956 wrote to memory of 4956 3956 z6434601.exe z1161641.exe PID 3956 wrote to memory of 4956 3956 z6434601.exe z1161641.exe PID 4956 wrote to memory of 3828 4956 z1161641.exe q2076755.exe PID 4956 wrote to memory of 3828 4956 z1161641.exe q2076755.exe PID 4956 wrote to memory of 3828 4956 z1161641.exe q2076755.exe PID 3828 wrote to memory of 3220 3828 q2076755.exe AppLaunch.exe PID 3828 wrote to memory of 3220 3828 q2076755.exe AppLaunch.exe PID 3828 wrote to memory of 3220 3828 q2076755.exe AppLaunch.exe PID 3828 wrote to memory of 3220 3828 q2076755.exe AppLaunch.exe PID 3828 wrote to memory of 3220 3828 q2076755.exe AppLaunch.exe PID 3828 wrote to memory of 3220 3828 q2076755.exe AppLaunch.exe PID 3828 wrote to memory of 3220 3828 q2076755.exe AppLaunch.exe PID 3828 wrote to memory of 3220 3828 q2076755.exe AppLaunch.exe PID 4956 wrote to memory of 1444 4956 z1161641.exe r4600784.exe PID 4956 wrote to memory of 1444 4956 z1161641.exe r4600784.exe PID 4956 wrote to memory of 1444 4956 z1161641.exe r4600784.exe PID 1444 wrote to memory of 1584 1444 r4600784.exe AppLaunch.exe PID 1444 wrote to memory of 1584 1444 r4600784.exe AppLaunch.exe PID 1444 wrote to memory of 1584 1444 r4600784.exe AppLaunch.exe PID 1444 wrote to memory of 1584 1444 r4600784.exe AppLaunch.exe PID 1444 wrote to memory of 1584 1444 r4600784.exe AppLaunch.exe PID 1444 wrote to memory of 1584 1444 r4600784.exe AppLaunch.exe PID 1444 wrote to memory of 1584 1444 r4600784.exe AppLaunch.exe PID 1444 wrote to memory of 1584 1444 r4600784.exe AppLaunch.exe PID 1444 wrote to memory of 1584 1444 r4600784.exe AppLaunch.exe PID 1444 wrote to memory of 1584 1444 r4600784.exe AppLaunch.exe PID 3956 wrote to memory of 1740 3956 z6434601.exe s4830434.exe PID 3956 wrote to memory of 1740 3956 z6434601.exe s4830434.exe PID 3956 wrote to memory of 1740 3956 z6434601.exe s4830434.exe PID 1740 wrote to memory of 3452 1740 s4830434.exe AppLaunch.exe PID 1740 wrote to memory of 3452 1740 s4830434.exe AppLaunch.exe PID 1740 wrote to memory of 3452 1740 s4830434.exe AppLaunch.exe PID 1740 wrote to memory of 3452 1740 s4830434.exe AppLaunch.exe PID 1740 wrote to memory of 3452 1740 s4830434.exe AppLaunch.exe PID 1740 wrote to memory of 3452 1740 s4830434.exe AppLaunch.exe PID 1740 wrote to memory of 3452 1740 s4830434.exe AppLaunch.exe PID 1740 wrote to memory of 3452 1740 s4830434.exe AppLaunch.exe PID 2084 wrote to memory of 3428 2084 z8849308.exe t0281814.exe PID 2084 wrote to memory of 3428 2084 z8849308.exe t0281814.exe PID 2084 wrote to memory of 3428 2084 z8849308.exe t0281814.exe PID 3428 wrote to memory of 3904 3428 t0281814.exe explonde.exe PID 3428 wrote to memory of 3904 3428 t0281814.exe explonde.exe PID 3428 wrote to memory of 3904 3428 t0281814.exe explonde.exe PID 3920 wrote to memory of 4324 3920 z3858980.exe u6224885.exe PID 3920 wrote to memory of 4324 3920 z3858980.exe u6224885.exe PID 3920 wrote to memory of 4324 3920 z3858980.exe u6224885.exe PID 3904 wrote to memory of 4120 3904 explonde.exe schtasks.exe PID 3904 wrote to memory of 4120 3904 explonde.exe schtasks.exe PID 3904 wrote to memory of 4120 3904 explonde.exe schtasks.exe PID 4324 wrote to memory of 1940 4324 u6224885.exe legota.exe PID 4324 wrote to memory of 1940 4324 u6224885.exe legota.exe PID 4324 wrote to memory of 1940 4324 u6224885.exe legota.exe PID 3904 wrote to memory of 4804 3904 explonde.exe cmd.exe PID 3904 wrote to memory of 4804 3904 explonde.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7805dec0b6b6e1bf76541f762dfd1def6da015d804810555e98017b5d7a2183.exe"C:\Users\Admin\AppData\Local\Temp\b7805dec0b6b6e1bf76541f762dfd1def6da015d804810555e98017b5d7a2183.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3858980.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3858980.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8849308.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8849308.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6434601.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6434601.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1161641.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1161641.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2076755.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2076755.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 1487⤵
- Program crash
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4600784.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4600784.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵PID:1584
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1584 -s 5408⤵
- Program crash
PID:5100 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1444 -s 1487⤵
- Program crash
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4830434.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4830434.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵PID:3452
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1740 -s 2046⤵
- Program crash
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0281814.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0281814.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
PID:4120 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵PID:4804
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:4880
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵PID:1976
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵PID:1816
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵PID:3512
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵PID:4688
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵PID:3376
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6224885.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6224885.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
PID:1940 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4439393.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4439393.exe2⤵
- Executes dropped EXE
PID:4088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3828 -ip 38281⤵PID:4664
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1444 -ip 14441⤵PID:4968
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 1584 -ip 15841⤵PID:3548
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1740 -ip 17401⤵PID:1992
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F1⤵
- Creates scheduled task(s)
PID:4632
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit1⤵PID:4540
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"2⤵PID:4156
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:3664
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E2⤵PID:748
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"2⤵PID:1672
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E2⤵PID:3700
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"2⤵PID:1068
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:4332
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:2292
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
PID:1984
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
PID:4956
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4439393.exeFilesize
22KB
MD5ad2c89fb52e6adab093dbf21a12c1605
SHA1c3ec510f04a7758f1bb4a78dc8de93d1990d40a6
SHA256f19c2dd6344c757a4ce0d1c7da0f0b0251979af38b83252e06478f73d750c121
SHA51273254e74c362cc848f5f8f72b4f1cf0c5d202cad754690ae92ed2944072779f5b0ec9d04d9b2e08b56eb2e08592488f7e662da30d6bed49742c75a28317ab6e0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w4439393.exeFilesize
22KB
MD5ad2c89fb52e6adab093dbf21a12c1605
SHA1c3ec510f04a7758f1bb4a78dc8de93d1990d40a6
SHA256f19c2dd6344c757a4ce0d1c7da0f0b0251979af38b83252e06478f73d750c121
SHA51273254e74c362cc848f5f8f72b4f1cf0c5d202cad754690ae92ed2944072779f5b0ec9d04d9b2e08b56eb2e08592488f7e662da30d6bed49742c75a28317ab6e0
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3858980.exeFilesize
1.2MB
MD59917f2ea8685ffbfe1bb41a956d43a0c
SHA16ccf688e940e9ebd78b8c62e5fd03ffe22d0e01b
SHA25685fdecd367a1265dd62cde02d98769d85f887b885d6bcfbc67688c1643afabf9
SHA5120e594f33387c19139ba5ee7d3940ef3879ea44cc6c9da0a0ea9080447fb845c79f52ff39730e7c4afb983a4044be83aa789fb130a08331813035dc9fceb45733
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z3858980.exeFilesize
1.2MB
MD59917f2ea8685ffbfe1bb41a956d43a0c
SHA16ccf688e940e9ebd78b8c62e5fd03ffe22d0e01b
SHA25685fdecd367a1265dd62cde02d98769d85f887b885d6bcfbc67688c1643afabf9
SHA5120e594f33387c19139ba5ee7d3940ef3879ea44cc6c9da0a0ea9080447fb845c79f52ff39730e7c4afb983a4044be83aa789fb130a08331813035dc9fceb45733
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6224885.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6224885.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8849308.exeFilesize
1.0MB
MD5890612a7e6cab6f268651bc02955feaf
SHA154ec5183c24da8f9705d4fbab1cca3053067c6d5
SHA25607afa5547db9da8b22726e2d08d7d515bcf0005286c037cdfc61cf4d46d1274c
SHA512e304db638bedbc34e11f4d234b66512f3723be945992826095da8f37be0ad0c99384a309e856543c627aa90c7a8c07d1b39afe0fd0ed050e3884a0e761b609c8
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z8849308.exeFilesize
1.0MB
MD5890612a7e6cab6f268651bc02955feaf
SHA154ec5183c24da8f9705d4fbab1cca3053067c6d5
SHA25607afa5547db9da8b22726e2d08d7d515bcf0005286c037cdfc61cf4d46d1274c
SHA512e304db638bedbc34e11f4d234b66512f3723be945992826095da8f37be0ad0c99384a309e856543c627aa90c7a8c07d1b39afe0fd0ed050e3884a0e761b609c8
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0281814.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t0281814.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6434601.exeFilesize
882KB
MD568efbc8f0ebb7bdad56ea0302a5a5842
SHA1d82c807a74a6acd16529511d67d7534754810699
SHA2566f10aa775339c213a72d3e7ed54c8cf41b45dbed6c105fc45d16b3db044149b5
SHA5125ad452861ebb5fc411b632309312699775cceaec5f30fac035c340605e2479cf0583dd6d6be792ae9af5bdcc9588149e15280a533ab9201fd068ffe129c1a3df
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z6434601.exeFilesize
882KB
MD568efbc8f0ebb7bdad56ea0302a5a5842
SHA1d82c807a74a6acd16529511d67d7534754810699
SHA2566f10aa775339c213a72d3e7ed54c8cf41b45dbed6c105fc45d16b3db044149b5
SHA5125ad452861ebb5fc411b632309312699775cceaec5f30fac035c340605e2479cf0583dd6d6be792ae9af5bdcc9588149e15280a533ab9201fd068ffe129c1a3df
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4830434.exeFilesize
1.0MB
MD55e8e0d9b5cc685104f34bce5da3f4eb1
SHA172b636160de68a43e510e0321548154826354860
SHA256fe0163b68e3be26435f5d55e8b9897cc30b4060a187704f99e1b547fc024b08b
SHA512eb1532e6e99c6515abd699fb91da9c564a160690c0ba086701f763b7b31a43744aa3371171b9205f687ff94b297c4572986884f7a28d493172b9fe8db918b43a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s4830434.exeFilesize
1.0MB
MD55e8e0d9b5cc685104f34bce5da3f4eb1
SHA172b636160de68a43e510e0321548154826354860
SHA256fe0163b68e3be26435f5d55e8b9897cc30b4060a187704f99e1b547fc024b08b
SHA512eb1532e6e99c6515abd699fb91da9c564a160690c0ba086701f763b7b31a43744aa3371171b9205f687ff94b297c4572986884f7a28d493172b9fe8db918b43a
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1161641.exeFilesize
491KB
MD5772105df76ec34c7629993c1493bae4a
SHA10aff38a7e16df2e4c944f1971b82767537586c2a
SHA256385efa0bbd4cfcdfe8e448057734b2cce5d140e022aac9f16375f66fe1e6f3fe
SHA51282fc3d662e83e4d4ba7831ac50bbbefabb1afdeeb1c41ce1f6095765a8dcc4b5782f23e8e4b0f052e65ebf9d5e218644b402a4b3135e4d8ab409418572dce98e
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1161641.exeFilesize
491KB
MD5772105df76ec34c7629993c1493bae4a
SHA10aff38a7e16df2e4c944f1971b82767537586c2a
SHA256385efa0bbd4cfcdfe8e448057734b2cce5d140e022aac9f16375f66fe1e6f3fe
SHA51282fc3d662e83e4d4ba7831ac50bbbefabb1afdeeb1c41ce1f6095765a8dcc4b5782f23e8e4b0f052e65ebf9d5e218644b402a4b3135e4d8ab409418572dce98e
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2076755.exeFilesize
860KB
MD5bf9d5072bd7a70e781666f2718be94e7
SHA15c66bff4335e6d62e25e849dc830d992ec0a3f19
SHA256bf001ee4a12695c28c85e25c0a6ba087097c61e92e55b3a3d4f1369be63a13ec
SHA51209462f423608c112bc46740a56753b6316cb3d91b4a68094952cee3800ce3482d35dc536d0712503e392eb711f2141cb761e03b8f25e4fd9f7b17224cc6e86ec
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q2076755.exeFilesize
860KB
MD5bf9d5072bd7a70e781666f2718be94e7
SHA15c66bff4335e6d62e25e849dc830d992ec0a3f19
SHA256bf001ee4a12695c28c85e25c0a6ba087097c61e92e55b3a3d4f1369be63a13ec
SHA51209462f423608c112bc46740a56753b6316cb3d91b4a68094952cee3800ce3482d35dc536d0712503e392eb711f2141cb761e03b8f25e4fd9f7b17224cc6e86ec
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4600784.exeFilesize
1016KB
MD55073f52c4552033a9a0f26e2d8672524
SHA13d46dbccfa9f70a9315724e0455bc8273d9f2f38
SHA256c7b38664c06c1ae00ceb6032071d5844555ccfdacacfd42a60ed5560e18f1db4
SHA5123f78fd5a1789dcecb08125c61d5fc6380f0bf38edbb753bbd1d52b8c9cd0dd72a63c695b4a6746e14f70dab62c5c3b181e0ce2aa64f0f715e53af18a20c375e7
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4600784.exeFilesize
1016KB
MD55073f52c4552033a9a0f26e2d8672524
SHA13d46dbccfa9f70a9315724e0455bc8273d9f2f38
SHA256c7b38664c06c1ae00ceb6032071d5844555ccfdacacfd42a60ed5560e18f1db4
SHA5123f78fd5a1789dcecb08125c61d5fc6380f0bf38edbb753bbd1d52b8c9cd0dd72a63c695b4a6746e14f70dab62c5c3b181e0ce2aa64f0f715e53af18a20c375e7
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1584-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1584-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1584-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1584-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3220-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/3220-86-0x0000000073EF0000-0x00000000746A0000-memory.dmpFilesize
7.7MB
-
memory/3220-36-0x0000000073EF0000-0x00000000746A0000-memory.dmpFilesize
7.7MB
-
memory/3220-56-0x0000000073EF0000-0x00000000746A0000-memory.dmpFilesize
7.7MB
-
memory/3452-58-0x0000000005270000-0x000000000537A000-memory.dmpFilesize
1.0MB
-
memory/3452-88-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB
-
memory/3452-87-0x0000000073EF0000-0x00000000746A0000-memory.dmpFilesize
7.7MB
-
memory/3452-78-0x0000000005210000-0x000000000525C000-memory.dmpFilesize
304KB
-
memory/3452-65-0x00000000051C0000-0x00000000051FC000-memory.dmpFilesize
240KB
-
memory/3452-62-0x0000000005050000-0x0000000005060000-memory.dmpFilesize
64KB
-
memory/3452-60-0x0000000005160000-0x0000000005172000-memory.dmpFilesize
72KB
-
memory/3452-57-0x0000000005780000-0x0000000005D98000-memory.dmpFilesize
6.1MB
-
memory/3452-50-0x0000000005000000-0x0000000005006000-memory.dmpFilesize
24KB
-
memory/3452-49-0x0000000073EF0000-0x00000000746A0000-memory.dmpFilesize
7.7MB
-
memory/3452-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB