Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 08:34
Static task
static1
Behavioral task
behavioral1
Sample
4c1d4f4d9ef94423989dcddde3c2056ce4a0b2e9bf462212502e4fcfa629a810_JC.exe
Resource
win7-20230831-en
General
-
Target
4c1d4f4d9ef94423989dcddde3c2056ce4a0b2e9bf462212502e4fcfa629a810_JC.exe
-
Size
1.1MB
-
MD5
eb6e3ed467b96d894306129220e2d9f5
-
SHA1
b1a1b9c045ac9e81e06515469661ff7a8ec9c248
-
SHA256
4c1d4f4d9ef94423989dcddde3c2056ce4a0b2e9bf462212502e4fcfa629a810
-
SHA512
5ac32741c5ac6d58b2740caeeaaf738f3fad3a6b9f4972ef50b7f9bc4cc36618afaad175af64adbe2f2aa52bd724df27ff58da14ba12a9d81a539d2ad230df05
-
SSDEEP
24576:myJmsa//9UC7E7wHzlYsKE4xoWjaRaAeewCb:1wZVUBETlZaja07ewC
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4136-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4136-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4136-43-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/4136-45-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3588-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
legota.exet3656039.exeexplonde.exeu6958207.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation legota.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation t3656039.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation u6958207.exe -
Executes dropped EXE 16 IoCs
Processes:
z6559510.exez1127107.exez5637144.exez1297842.exeq7768750.exer4514159.exes8530875.exet3656039.exeexplonde.exeu6958207.exelegota.exew8746188.exelegota.exeexplonde.exelegota.exeexplonde.exepid process 1800 z6559510.exe 4772 z1127107.exe 3124 z5637144.exe 1808 z1297842.exe 1272 q7768750.exe 824 r4514159.exe 2980 s8530875.exe 1984 t3656039.exe 3736 explonde.exe 856 u6958207.exe 2208 legota.exe 4224 w8746188.exe 4384 legota.exe 4136 explonde.exe 1180 legota.exe 3776 explonde.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 3076 rundll32.exe 3668 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
4c1d4f4d9ef94423989dcddde3c2056ce4a0b2e9bf462212502e4fcfa629a810_JC.exez6559510.exez1127107.exez5637144.exez1297842.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 4c1d4f4d9ef94423989dcddde3c2056ce4a0b2e9bf462212502e4fcfa629a810_JC.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z6559510.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z1127107.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z5637144.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z1297842.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q7768750.exer4514159.exes8530875.exedescription pid process target process PID 1272 set thread context of 3588 1272 q7768750.exe AppLaunch.exe PID 824 set thread context of 4136 824 r4514159.exe AppLaunch.exe PID 2980 set thread context of 1532 2980 s8530875.exe AppLaunch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 224 1272 WerFault.exe q7768750.exe 2620 824 WerFault.exe r4514159.exe 3100 4136 WerFault.exe AppLaunch.exe 1704 2980 WerFault.exe s8530875.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3684 schtasks.exe 2948 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 3588 AppLaunch.exe 3588 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 3588 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4c1d4f4d9ef94423989dcddde3c2056ce4a0b2e9bf462212502e4fcfa629a810_JC.exez6559510.exez1127107.exez5637144.exez1297842.exeq7768750.exer4514159.exes8530875.exet3656039.exeu6958207.exedescription pid process target process PID 4112 wrote to memory of 1800 4112 4c1d4f4d9ef94423989dcddde3c2056ce4a0b2e9bf462212502e4fcfa629a810_JC.exe z6559510.exe PID 4112 wrote to memory of 1800 4112 4c1d4f4d9ef94423989dcddde3c2056ce4a0b2e9bf462212502e4fcfa629a810_JC.exe z6559510.exe PID 4112 wrote to memory of 1800 4112 4c1d4f4d9ef94423989dcddde3c2056ce4a0b2e9bf462212502e4fcfa629a810_JC.exe z6559510.exe PID 1800 wrote to memory of 4772 1800 z6559510.exe z1127107.exe PID 1800 wrote to memory of 4772 1800 z6559510.exe z1127107.exe PID 1800 wrote to memory of 4772 1800 z6559510.exe z1127107.exe PID 4772 wrote to memory of 3124 4772 z1127107.exe z5637144.exe PID 4772 wrote to memory of 3124 4772 z1127107.exe z5637144.exe PID 4772 wrote to memory of 3124 4772 z1127107.exe z5637144.exe PID 3124 wrote to memory of 1808 3124 z5637144.exe z1297842.exe PID 3124 wrote to memory of 1808 3124 z5637144.exe z1297842.exe PID 3124 wrote to memory of 1808 3124 z5637144.exe z1297842.exe PID 1808 wrote to memory of 1272 1808 z1297842.exe q7768750.exe PID 1808 wrote to memory of 1272 1808 z1297842.exe q7768750.exe PID 1808 wrote to memory of 1272 1808 z1297842.exe q7768750.exe PID 1272 wrote to memory of 4912 1272 q7768750.exe AppLaunch.exe PID 1272 wrote to memory of 4912 1272 q7768750.exe AppLaunch.exe PID 1272 wrote to memory of 4912 1272 q7768750.exe AppLaunch.exe PID 1272 wrote to memory of 3588 1272 q7768750.exe AppLaunch.exe PID 1272 wrote to memory of 3588 1272 q7768750.exe AppLaunch.exe PID 1272 wrote to memory of 3588 1272 q7768750.exe AppLaunch.exe PID 1272 wrote to memory of 3588 1272 q7768750.exe AppLaunch.exe PID 1272 wrote to memory of 3588 1272 q7768750.exe AppLaunch.exe PID 1272 wrote to memory of 3588 1272 q7768750.exe AppLaunch.exe PID 1272 wrote to memory of 3588 1272 q7768750.exe AppLaunch.exe PID 1272 wrote to memory of 3588 1272 q7768750.exe AppLaunch.exe PID 1808 wrote to memory of 824 1808 z1297842.exe r4514159.exe PID 1808 wrote to memory of 824 1808 z1297842.exe r4514159.exe PID 1808 wrote to memory of 824 1808 z1297842.exe r4514159.exe PID 824 wrote to memory of 4136 824 r4514159.exe AppLaunch.exe PID 824 wrote to memory of 4136 824 r4514159.exe AppLaunch.exe PID 824 wrote to memory of 4136 824 r4514159.exe AppLaunch.exe PID 824 wrote to memory of 4136 824 r4514159.exe AppLaunch.exe PID 824 wrote to memory of 4136 824 r4514159.exe AppLaunch.exe PID 824 wrote to memory of 4136 824 r4514159.exe AppLaunch.exe PID 824 wrote to memory of 4136 824 r4514159.exe AppLaunch.exe PID 824 wrote to memory of 4136 824 r4514159.exe AppLaunch.exe PID 824 wrote to memory of 4136 824 r4514159.exe AppLaunch.exe PID 824 wrote to memory of 4136 824 r4514159.exe AppLaunch.exe PID 3124 wrote to memory of 2980 3124 z5637144.exe s8530875.exe PID 3124 wrote to memory of 2980 3124 z5637144.exe s8530875.exe PID 3124 wrote to memory of 2980 3124 z5637144.exe s8530875.exe PID 2980 wrote to memory of 4252 2980 s8530875.exe AppLaunch.exe PID 2980 wrote to memory of 4252 2980 s8530875.exe AppLaunch.exe PID 2980 wrote to memory of 4252 2980 s8530875.exe AppLaunch.exe PID 2980 wrote to memory of 1532 2980 s8530875.exe AppLaunch.exe PID 2980 wrote to memory of 1532 2980 s8530875.exe AppLaunch.exe PID 2980 wrote to memory of 1532 2980 s8530875.exe AppLaunch.exe PID 2980 wrote to memory of 1532 2980 s8530875.exe AppLaunch.exe PID 2980 wrote to memory of 1532 2980 s8530875.exe AppLaunch.exe PID 2980 wrote to memory of 1532 2980 s8530875.exe AppLaunch.exe PID 2980 wrote to memory of 1532 2980 s8530875.exe AppLaunch.exe PID 2980 wrote to memory of 1532 2980 s8530875.exe AppLaunch.exe PID 4772 wrote to memory of 1984 4772 z1127107.exe t3656039.exe PID 4772 wrote to memory of 1984 4772 z1127107.exe t3656039.exe PID 4772 wrote to memory of 1984 4772 z1127107.exe t3656039.exe PID 1984 wrote to memory of 3736 1984 t3656039.exe explonde.exe PID 1984 wrote to memory of 3736 1984 t3656039.exe explonde.exe PID 1984 wrote to memory of 3736 1984 t3656039.exe explonde.exe PID 1800 wrote to memory of 856 1800 z6559510.exe u6958207.exe PID 1800 wrote to memory of 856 1800 z6559510.exe u6958207.exe PID 1800 wrote to memory of 856 1800 z6559510.exe u6958207.exe PID 856 wrote to memory of 2208 856 u6958207.exe legota.exe PID 856 wrote to memory of 2208 856 u6958207.exe legota.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c1d4f4d9ef94423989dcddde3c2056ce4a0b2e9bf462212502e4fcfa629a810_JC.exe"C:\Users\Admin\AppData\Local\Temp\4c1d4f4d9ef94423989dcddde3c2056ce4a0b2e9bf462212502e4fcfa629a810_JC.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6559510.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6559510.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1127107.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1127107.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5637144.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5637144.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1297842.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1297842.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7768750.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7768750.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1272 -s 5687⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4514159.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4514159.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4136 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 824 -s 5927⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8530875.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8530875.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 6006⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3656039.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3656039.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6958207.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6958207.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8746188.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8746188.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1272 -ip 12721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 824 -ip 8241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4136 -ip 41361⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2980 -ip 29801⤵
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8746188.exeFilesize
22KB
MD508feb9a9508c47c3ee9478c37e03df3e
SHA12967b66f17c276c9819c489df2705b4826dcf437
SHA25631e5975ab81722ca9c3b28c2ef84f4d9c32bef9ef68a736d8cdf3e9968f5726a
SHA512902c60feda0743c710501ae2394a3c20c4319f68f3640ed4622d4989a714ee2b098a2bbb77dd75c379867c5de8598936d2a5b7691b708342408d855adebf31a5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w8746188.exeFilesize
22KB
MD508feb9a9508c47c3ee9478c37e03df3e
SHA12967b66f17c276c9819c489df2705b4826dcf437
SHA25631e5975ab81722ca9c3b28c2ef84f4d9c32bef9ef68a736d8cdf3e9968f5726a
SHA512902c60feda0743c710501ae2394a3c20c4319f68f3640ed4622d4989a714ee2b098a2bbb77dd75c379867c5de8598936d2a5b7691b708342408d855adebf31a5
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6559510.exeFilesize
998KB
MD5e1815ffc1cf02ff18869a02c9235815e
SHA1b9c0e7611f44eae0e5b11245279eab5c8a631168
SHA25636dda2c3bfcf4a371aa2d62bb344c83bfb9c85f3f9042283c6a20e061c15eaaf
SHA51274bda949c3c54b3091dbf30c86bc769f3613f0038201b67f4362c2252433323c744ef2abe3eeaf4742dd456a229483c7ac6ac22e3331631fc413f3e3e4d5afab
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z6559510.exeFilesize
998KB
MD5e1815ffc1cf02ff18869a02c9235815e
SHA1b9c0e7611f44eae0e5b11245279eab5c8a631168
SHA25636dda2c3bfcf4a371aa2d62bb344c83bfb9c85f3f9042283c6a20e061c15eaaf
SHA51274bda949c3c54b3091dbf30c86bc769f3613f0038201b67f4362c2252433323c744ef2abe3eeaf4742dd456a229483c7ac6ac22e3331631fc413f3e3e4d5afab
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6958207.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u6958207.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1127107.exeFilesize
815KB
MD51bbc286e0de70ea93a2d22382215cb6f
SHA1998f8216681b836c1c9995ffd0d617d0259fe94d
SHA25600dd845a27cdd6a841129f3f25bc36fd11c64b769481d2a584164a99fbd2c3d6
SHA5122ea1320c1e37907e97c4247b29c9723005bbf6c32e19aaac53d4f61e4c78ad260f811af031bee40cf519855f256cec7492c27988f902137c9a537df6b8f09175
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z1127107.exeFilesize
815KB
MD51bbc286e0de70ea93a2d22382215cb6f
SHA1998f8216681b836c1c9995ffd0d617d0259fe94d
SHA25600dd845a27cdd6a841129f3f25bc36fd11c64b769481d2a584164a99fbd2c3d6
SHA5122ea1320c1e37907e97c4247b29c9723005bbf6c32e19aaac53d4f61e4c78ad260f811af031bee40cf519855f256cec7492c27988f902137c9a537df6b8f09175
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3656039.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t3656039.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5637144.exeFilesize
632KB
MD536e613620013d7c98fce6ad50f0e3c95
SHA1c6a6fe34461cfce24c51e5bb15b1c3ac3dc76e60
SHA256fb39eb7a4dd0c737136168f04b0b2293603b440c778b9dfd10fdda5329cd9050
SHA51285bf562d89ca74cc3a3140ad4b51d7c3fa466be7fcb53d936046169264f01256b569af792cac5fc580527bb3451cb7a27ff7e93826c47b89a2af683833ceb3bc
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z5637144.exeFilesize
632KB
MD536e613620013d7c98fce6ad50f0e3c95
SHA1c6a6fe34461cfce24c51e5bb15b1c3ac3dc76e60
SHA256fb39eb7a4dd0c737136168f04b0b2293603b440c778b9dfd10fdda5329cd9050
SHA51285bf562d89ca74cc3a3140ad4b51d7c3fa466be7fcb53d936046169264f01256b569af792cac5fc580527bb3451cb7a27ff7e93826c47b89a2af683833ceb3bc
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8530875.exeFilesize
413KB
MD5c93c13d505991c7cb12237918c50ef65
SHA124ad52f45a5b27d30f763d8db79d559a7445bcae
SHA256e5a4497939136c4bacb1ac5227957867151bf1e7be58aa92952325a79ba12edb
SHA512614cc3719a3d666403ff2989d100b4c685b9ae6be5b21277a1a9eac8c1b4b57ceaac12e7874924e226e5fc12a008327d264cbd9afebc9aa2b3708fd11d630a22
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s8530875.exeFilesize
413KB
MD5c93c13d505991c7cb12237918c50ef65
SHA124ad52f45a5b27d30f763d8db79d559a7445bcae
SHA256e5a4497939136c4bacb1ac5227957867151bf1e7be58aa92952325a79ba12edb
SHA512614cc3719a3d666403ff2989d100b4c685b9ae6be5b21277a1a9eac8c1b4b57ceaac12e7874924e226e5fc12a008327d264cbd9afebc9aa2b3708fd11d630a22
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1297842.exeFilesize
354KB
MD5f9d2fcbcfca0cba8b419661c251c1eb6
SHA1b0636f65f5b29ba8375a948e9a806d8aaebab16e
SHA256a5ebf76860c64ee2848861fed3398dd6255a4a5eaa50e14d93e4a2b9a6c415dc
SHA512e1421dd0d34f6cfd133666e8309b013e0a5f1ba3b025204316fd36863d671cd7f104a70f3a563b929ba184b5d9835555f44748d579ec9481704b7c1a4103c517
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z1297842.exeFilesize
354KB
MD5f9d2fcbcfca0cba8b419661c251c1eb6
SHA1b0636f65f5b29ba8375a948e9a806d8aaebab16e
SHA256a5ebf76860c64ee2848861fed3398dd6255a4a5eaa50e14d93e4a2b9a6c415dc
SHA512e1421dd0d34f6cfd133666e8309b013e0a5f1ba3b025204316fd36863d671cd7f104a70f3a563b929ba184b5d9835555f44748d579ec9481704b7c1a4103c517
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7768750.exeFilesize
250KB
MD545273b0f41e08d2f61edc364029ea992
SHA13ded2e0efc6558bb6cb5445da4b053374bd048dc
SHA256cae055a0e95f4ace6e9c7a173b74294d41e326b6c5f2cc48afbf1af334afb616
SHA512d71e3337a171927d0df2f751b62bedad3281d43515f5da1dc6b912852955994eb1f21968f76c6165924fe66babc6a772227296e42959a1122f0b677bc6fe8f69
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q7768750.exeFilesize
250KB
MD545273b0f41e08d2f61edc364029ea992
SHA13ded2e0efc6558bb6cb5445da4b053374bd048dc
SHA256cae055a0e95f4ace6e9c7a173b74294d41e326b6c5f2cc48afbf1af334afb616
SHA512d71e3337a171927d0df2f751b62bedad3281d43515f5da1dc6b912852955994eb1f21968f76c6165924fe66babc6a772227296e42959a1122f0b677bc6fe8f69
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4514159.exeFilesize
379KB
MD5767d84dfc368dfa40300726c123dce8c
SHA1db76960b8baafd82000c3141f0fb364e0161e889
SHA25690deb0c2cc3a1504f3313ab533135bda41d95d7fb04a69db5349b67663e59144
SHA512e03cf9c5785b74d7f35dfcf2647010b133c114244f3eab2f098382b4c1a216ac894d91b12f87a08779083f933ded52032abdd555c5d74eae5748b0e7704dd5c4
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r4514159.exeFilesize
379KB
MD5767d84dfc368dfa40300726c123dce8c
SHA1db76960b8baafd82000c3141f0fb364e0161e889
SHA25690deb0c2cc3a1504f3313ab533135bda41d95d7fb04a69db5349b67663e59144
SHA512e03cf9c5785b74d7f35dfcf2647010b133c114244f3eab2f098382b4c1a216ac894d91b12f87a08779083f933ded52032abdd555c5d74eae5748b0e7704dd5c4
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/1532-87-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/1532-51-0x00000000050D0000-0x00000000050D6000-memory.dmpFilesize
24KB
-
memory/1532-65-0x000000000A6F0000-0x000000000A72C000-memory.dmpFilesize
240KB
-
memory/1532-60-0x000000000A690000-0x000000000A6A2000-memory.dmpFilesize
72KB
-
memory/1532-49-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/1532-59-0x0000000005150000-0x0000000005160000-memory.dmpFilesize
64KB
-
memory/1532-88-0x0000000005150000-0x0000000005160000-memory.dmpFilesize
64KB
-
memory/1532-58-0x000000000A760000-0x000000000A86A000-memory.dmpFilesize
1.0MB
-
memory/1532-57-0x000000000AC00000-0x000000000B218000-memory.dmpFilesize
6.1MB
-
memory/1532-72-0x000000000A870000-0x000000000A8BC000-memory.dmpFilesize
304KB
-
memory/1532-50-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/3588-86-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/3588-40-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/3588-36-0x0000000074700000-0x0000000074EB0000-memory.dmpFilesize
7.7MB
-
memory/3588-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4136-45-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4136-43-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4136-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4136-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB