Analysis
-
max time kernel
180s -
max time network
189s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11-10-2023 12:31
Static task
static1
Behavioral task
behavioral1
Sample
5ee4d56ab9b4c561ae652f66b8d9750c.exe
Resource
win7-20230831-en
General
-
Target
5ee4d56ab9b4c561ae652f66b8d9750c.exe
-
Size
1.1MB
-
MD5
5ee4d56ab9b4c561ae652f66b8d9750c
-
SHA1
bc1f7f4606da7c427984249976f9d8aae0f91a4c
-
SHA256
4b0e79d395083723c3dd3a17b0c34ccf0b7a2f670e6aae6b9194ecf1fe0a4dac
-
SHA512
880c5f9106dd42933a4b6c5cd18dc4250cdabf3b78a8bea517bd74d1db7219844376d59792a5bba317c24e012455f3c6f7d30547ee65568e4970d51cdd18f22f
-
SSDEEP
24576:hy8TQOLVciUgq0s1CWqMctYA/pFA0UUbVTJ6Mv3vUox:U/cV7XTLaq9UURT4
Malware Config
Extracted
redline
gruha
77.91.124.55:19071
-
auth_value
2f4cf2e668a540e64775b27535cc6892
Extracted
amadey
3.89
http://77.91.68.52/mac/index.php
http://77.91.68.78/help/index.php
-
install_dir
fefffe8cea
-
install_file
explonde.exe
-
strings_key
916aae73606d7a9e02a1d3b47c199688
Signatures
-
Detect Mystic stealer payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3452-40-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3452-41-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3452-42-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic behavioral2/memory/3452-44-0x0000000000400000-0x0000000000428000-memory.dmp family_mystic -
Detects Healer an antivirus disabler dropper 1 IoCs
Processes:
resource yara_rule behavioral2/memory/648-35-0x0000000000400000-0x000000000040A000-memory.dmp healer -
Processes:
AppLaunch.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
t8836065.exeexplonde.exeu4479343.exelegota.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation t8836065.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation explonde.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation u4479343.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation legota.exe -
Executes dropped EXE 18 IoCs
Processes:
z1046657.exez7772281.exez9259279.exez8635948.exeq8603293.exer6683018.exes3081683.exet8836065.exeexplonde.exeu4479343.exelegota.exew6176490.exeexplonde.exelegota.exeexplonde.exelegota.exeexplonde.exelegota.exepid process 4720 z1046657.exe 2608 z7772281.exe 4640 z9259279.exe 3780 z8635948.exe 3816 q8603293.exe 2228 r6683018.exe 884 s3081683.exe 4032 t8836065.exe 2432 explonde.exe 3792 u4479343.exe 4620 legota.exe 1872 w6176490.exe 3268 explonde.exe 2424 legota.exe 4500 explonde.exe 3824 legota.exe 708 explonde.exe 3980 legota.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 4028 rundll32.exe 4108 rundll32.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
z1046657.exez7772281.exez9259279.exez8635948.exe5ee4d56ab9b4c561ae652f66b8d9750c.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" z1046657.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" z7772281.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\"" z9259279.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup4 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP004.TMP\\\"" z8635948.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 5ee4d56ab9b4c561ae652f66b8d9750c.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
q8603293.exer6683018.exes3081683.exedescription pid process target process PID 3816 set thread context of 648 3816 q8603293.exe AppLaunch.exe PID 2228 set thread context of 3452 2228 r6683018.exe AppLaunch.exe PID 884 set thread context of 1784 884 s3081683.exe AppLaunch.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 1688 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 1760 3816 WerFault.exe q8603293.exe 3004 2228 WerFault.exe r6683018.exe 4896 3452 WerFault.exe AppLaunch.exe 4140 884 WerFault.exe s3081683.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4552 schtasks.exe 1660 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
AppLaunch.exepid process 648 AppLaunch.exe 648 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 648 AppLaunch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5ee4d56ab9b4c561ae652f66b8d9750c.exez1046657.exez7772281.exez9259279.exez8635948.exeq8603293.exer6683018.exes3081683.exet8836065.exeexplonde.exeu4479343.exedescription pid process target process PID 5092 wrote to memory of 4720 5092 5ee4d56ab9b4c561ae652f66b8d9750c.exe z1046657.exe PID 5092 wrote to memory of 4720 5092 5ee4d56ab9b4c561ae652f66b8d9750c.exe z1046657.exe PID 5092 wrote to memory of 4720 5092 5ee4d56ab9b4c561ae652f66b8d9750c.exe z1046657.exe PID 4720 wrote to memory of 2608 4720 z1046657.exe z7772281.exe PID 4720 wrote to memory of 2608 4720 z1046657.exe z7772281.exe PID 4720 wrote to memory of 2608 4720 z1046657.exe z7772281.exe PID 2608 wrote to memory of 4640 2608 z7772281.exe z9259279.exe PID 2608 wrote to memory of 4640 2608 z7772281.exe z9259279.exe PID 2608 wrote to memory of 4640 2608 z7772281.exe z9259279.exe PID 4640 wrote to memory of 3780 4640 z9259279.exe z8635948.exe PID 4640 wrote to memory of 3780 4640 z9259279.exe z8635948.exe PID 4640 wrote to memory of 3780 4640 z9259279.exe z8635948.exe PID 3780 wrote to memory of 3816 3780 z8635948.exe q8603293.exe PID 3780 wrote to memory of 3816 3780 z8635948.exe q8603293.exe PID 3780 wrote to memory of 3816 3780 z8635948.exe q8603293.exe PID 3816 wrote to memory of 648 3816 q8603293.exe AppLaunch.exe PID 3816 wrote to memory of 648 3816 q8603293.exe AppLaunch.exe PID 3816 wrote to memory of 648 3816 q8603293.exe AppLaunch.exe PID 3816 wrote to memory of 648 3816 q8603293.exe AppLaunch.exe PID 3816 wrote to memory of 648 3816 q8603293.exe AppLaunch.exe PID 3816 wrote to memory of 648 3816 q8603293.exe AppLaunch.exe PID 3816 wrote to memory of 648 3816 q8603293.exe AppLaunch.exe PID 3816 wrote to memory of 648 3816 q8603293.exe AppLaunch.exe PID 3780 wrote to memory of 2228 3780 z8635948.exe r6683018.exe PID 3780 wrote to memory of 2228 3780 z8635948.exe r6683018.exe PID 3780 wrote to memory of 2228 3780 z8635948.exe r6683018.exe PID 2228 wrote to memory of 3452 2228 r6683018.exe AppLaunch.exe PID 2228 wrote to memory of 3452 2228 r6683018.exe AppLaunch.exe PID 2228 wrote to memory of 3452 2228 r6683018.exe AppLaunch.exe PID 2228 wrote to memory of 3452 2228 r6683018.exe AppLaunch.exe PID 2228 wrote to memory of 3452 2228 r6683018.exe AppLaunch.exe PID 2228 wrote to memory of 3452 2228 r6683018.exe AppLaunch.exe PID 2228 wrote to memory of 3452 2228 r6683018.exe AppLaunch.exe PID 2228 wrote to memory of 3452 2228 r6683018.exe AppLaunch.exe PID 2228 wrote to memory of 3452 2228 r6683018.exe AppLaunch.exe PID 2228 wrote to memory of 3452 2228 r6683018.exe AppLaunch.exe PID 4640 wrote to memory of 884 4640 z9259279.exe s3081683.exe PID 4640 wrote to memory of 884 4640 z9259279.exe s3081683.exe PID 4640 wrote to memory of 884 4640 z9259279.exe s3081683.exe PID 884 wrote to memory of 3908 884 s3081683.exe AppLaunch.exe PID 884 wrote to memory of 3908 884 s3081683.exe AppLaunch.exe PID 884 wrote to memory of 3908 884 s3081683.exe AppLaunch.exe PID 884 wrote to memory of 1784 884 s3081683.exe AppLaunch.exe PID 884 wrote to memory of 1784 884 s3081683.exe AppLaunch.exe PID 884 wrote to memory of 1784 884 s3081683.exe AppLaunch.exe PID 884 wrote to memory of 1784 884 s3081683.exe AppLaunch.exe PID 884 wrote to memory of 1784 884 s3081683.exe AppLaunch.exe PID 884 wrote to memory of 1784 884 s3081683.exe AppLaunch.exe PID 884 wrote to memory of 1784 884 s3081683.exe AppLaunch.exe PID 884 wrote to memory of 1784 884 s3081683.exe AppLaunch.exe PID 2608 wrote to memory of 4032 2608 z7772281.exe t8836065.exe PID 2608 wrote to memory of 4032 2608 z7772281.exe t8836065.exe PID 2608 wrote to memory of 4032 2608 z7772281.exe t8836065.exe PID 4032 wrote to memory of 2432 4032 t8836065.exe explonde.exe PID 4032 wrote to memory of 2432 4032 t8836065.exe explonde.exe PID 4032 wrote to memory of 2432 4032 t8836065.exe explonde.exe PID 4720 wrote to memory of 3792 4720 z1046657.exe u4479343.exe PID 4720 wrote to memory of 3792 4720 z1046657.exe u4479343.exe PID 4720 wrote to memory of 3792 4720 z1046657.exe u4479343.exe PID 2432 wrote to memory of 4552 2432 explonde.exe schtasks.exe PID 2432 wrote to memory of 4552 2432 explonde.exe schtasks.exe PID 2432 wrote to memory of 4552 2432 explonde.exe schtasks.exe PID 3792 wrote to memory of 4620 3792 u4479343.exe legota.exe PID 3792 wrote to memory of 4620 3792 u4479343.exe legota.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ee4d56ab9b4c561ae652f66b8d9750c.exe"C:\Users\Admin\AppData\Local\Temp\5ee4d56ab9b4c561ae652f66b8d9750c.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1046657.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1046657.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7772281.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7772281.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9259279.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9259279.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8635948.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8635948.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8603293.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8603293.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 5647⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6683018.exeC:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6683018.exe6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"7⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 5408⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 5647⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3081683.exeC:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3081683.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"6⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 884 -s 5886⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8836065.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8836065.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN explonde.exe /TR "C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe" /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "explonde.exe" /P "Admin:N"&&CACLS "explonde.exe" /P "Admin:R" /E&&echo Y|CACLS "..\fefffe8cea" /P "Admin:N"&&CACLS "..\fefffe8cea" /P "Admin:R" /E&&Exit6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "explonde.exe" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:N"7⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\fefffe8cea" /P "Admin:R" /E7⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4479343.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4479343.exe3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legota.exe /TR "C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe" /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legota.exe" /P "Admin:N"&&CACLS "legota.exe" /P "Admin:R" /E&&echo Y|CACLS "..\cb378487cf" /P "Admin:N"&&CACLS "..\cb378487cf" /P "Admin:R" /E&&Exit5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "legota.exe" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:N"6⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\cb378487cf" /P "Admin:R" /E6⤵
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main5⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6176490.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6176490.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3816 -ip 38161⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2228 -ip 22281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3452 -ip 34521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 884 -ip 8841⤵
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\sc.exeC:\Windows\system32\sc.exe start wuauserv1⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeC:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeC:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6176490.exeFilesize
22KB
MD5dc9ae719d169fd3f17a8a1138882d01a
SHA1f6efa4bf1a4ebb95f079d448dd657ebdcb1d733a
SHA2565e86c184f33493f2e2c5cfc214f8c64b87edad58cad63df8aaad66c116ed5004
SHA5128f996c1465bd225d7b447d1685660b1c4309c9ae0756598157cabde9034b72e31ef0b99b31c859cff66cf8855f5fad04504a9b22c0d1326a33a6141d747921a9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\w6176490.exeFilesize
22KB
MD5dc9ae719d169fd3f17a8a1138882d01a
SHA1f6efa4bf1a4ebb95f079d448dd657ebdcb1d733a
SHA2565e86c184f33493f2e2c5cfc214f8c64b87edad58cad63df8aaad66c116ed5004
SHA5128f996c1465bd225d7b447d1685660b1c4309c9ae0756598157cabde9034b72e31ef0b99b31c859cff66cf8855f5fad04504a9b22c0d1326a33a6141d747921a9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1046657.exeFilesize
997KB
MD53af68c108eda57d729f500e7bbd56e9f
SHA195b6523b95fa963fa346d37fa9b8bd59d4a446b1
SHA256b914aa18261dec7f8ca4bf8fb91089582a6584889921a1fb9bfbde9c8776e535
SHA512719494cb64fc7b72b2dda98ec6123c121f1a13d50360b441a0cc69344fd29e27c5cd821778b5a2bed6c7de7a21352ecebc7981b89f1c7a3fcad5892e5ccfc7ef
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\z1046657.exeFilesize
997KB
MD53af68c108eda57d729f500e7bbd56e9f
SHA195b6523b95fa963fa346d37fa9b8bd59d4a446b1
SHA256b914aa18261dec7f8ca4bf8fb91089582a6584889921a1fb9bfbde9c8776e535
SHA512719494cb64fc7b72b2dda98ec6123c121f1a13d50360b441a0cc69344fd29e27c5cd821778b5a2bed6c7de7a21352ecebc7981b89f1c7a3fcad5892e5ccfc7ef
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4479343.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\u4479343.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7772281.exeFilesize
814KB
MD5b6f7bbde98ee890a375ccbfa8d6a3723
SHA12d5080a07e9016be0c64913d12d8f5fb5e542611
SHA2563459a4c3b28c350a6f15b7f27b61c90a6cc9156b78d4850a9cbd19ec86b21ff1
SHA512ef6fc4a503c74b56d9aaad413ad1c46926e3eb8410c3398320c8459fee562fc33d8afb23b2e1fa26eb35763be027d5002a90a0f61b304e6d5e7f627dd68dc594
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\z7772281.exeFilesize
814KB
MD5b6f7bbde98ee890a375ccbfa8d6a3723
SHA12d5080a07e9016be0c64913d12d8f5fb5e542611
SHA2563459a4c3b28c350a6f15b7f27b61c90a6cc9156b78d4850a9cbd19ec86b21ff1
SHA512ef6fc4a503c74b56d9aaad413ad1c46926e3eb8410c3398320c8459fee562fc33d8afb23b2e1fa26eb35763be027d5002a90a0f61b304e6d5e7f627dd68dc594
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8836065.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\t8836065.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9259279.exeFilesize
631KB
MD580a3aefe44c20f0a1b4fa9a9843c8334
SHA1a8b49df6f191fce719ac9d26487fa093c53df52c
SHA25672fee0671762c548300a2fb4e4759ddfe34f9379a379e2beb9ca3d062db9440b
SHA5127d3432aa73f54ffbf11d581c1d786586d40042814111e262dd5bf2e07d09ce61bcc75beb26d45991f25065526ff9d18cd1540d8d4c7f0b3c02da30f80199a672
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\z9259279.exeFilesize
631KB
MD580a3aefe44c20f0a1b4fa9a9843c8334
SHA1a8b49df6f191fce719ac9d26487fa093c53df52c
SHA25672fee0671762c548300a2fb4e4759ddfe34f9379a379e2beb9ca3d062db9440b
SHA5127d3432aa73f54ffbf11d581c1d786586d40042814111e262dd5bf2e07d09ce61bcc75beb26d45991f25065526ff9d18cd1540d8d4c7f0b3c02da30f80199a672
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3081683.exeFilesize
413KB
MD5b23179a18c6029c2b494cee50c4542a0
SHA170f50b802169a4a3486019aa8ef4dcee9829c8bd
SHA256a08c4a0249e3adaf286541e2bbe138476de9e35f69bd00209ac4542e0cf91b6e
SHA512834818f41cb20cb8fe03b3c342de67e43efad080475001865fe466cc7a0ebf4b41556f41df01713c0d724ea2a3f794ac4c1c2fe637bac4979a04344c2c55a70c
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\s3081683.exeFilesize
413KB
MD5b23179a18c6029c2b494cee50c4542a0
SHA170f50b802169a4a3486019aa8ef4dcee9829c8bd
SHA256a08c4a0249e3adaf286541e2bbe138476de9e35f69bd00209ac4542e0cf91b6e
SHA512834818f41cb20cb8fe03b3c342de67e43efad080475001865fe466cc7a0ebf4b41556f41df01713c0d724ea2a3f794ac4c1c2fe637bac4979a04344c2c55a70c
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8635948.exeFilesize
354KB
MD5c18723f22cef8a507395ea469ada4a18
SHA1210c2b2ac47813a1f544ef2ea9f5a8a6e602a961
SHA2561f5fcd7f228c235cc4231ecb19870843f80904d5ede96f7d3b4b37918a67b4cf
SHA512c02a1b135c1dd6eff2defbab178e90884a213548c92d9f206dc5f0fc3ba4d2ad69010a3287b33262dc324021f8db1e4410f60cefd225f713eb543056c149121c
-
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\z8635948.exeFilesize
354KB
MD5c18723f22cef8a507395ea469ada4a18
SHA1210c2b2ac47813a1f544ef2ea9f5a8a6e602a961
SHA2561f5fcd7f228c235cc4231ecb19870843f80904d5ede96f7d3b4b37918a67b4cf
SHA512c02a1b135c1dd6eff2defbab178e90884a213548c92d9f206dc5f0fc3ba4d2ad69010a3287b33262dc324021f8db1e4410f60cefd225f713eb543056c149121c
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8603293.exeFilesize
250KB
MD57e54db4c91c4afbff61772ab7c5b6494
SHA18f8ab5ce482db4380f232c420377be7ba25239cc
SHA25641046925e9cf09d66552f1073b605f15c1cb243d7886244e6a82b5322080df7a
SHA51292ca77be46cbf344fb82e7af2a873c195da4947e2c7673f0c1ffeace80cb9c7e24037a1729ca91c8f4b4a9b2f7e47ec3ba57345dd1c5d3f7894ec56684733dab
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\q8603293.exeFilesize
250KB
MD57e54db4c91c4afbff61772ab7c5b6494
SHA18f8ab5ce482db4380f232c420377be7ba25239cc
SHA25641046925e9cf09d66552f1073b605f15c1cb243d7886244e6a82b5322080df7a
SHA51292ca77be46cbf344fb82e7af2a873c195da4947e2c7673f0c1ffeace80cb9c7e24037a1729ca91c8f4b4a9b2f7e47ec3ba57345dd1c5d3f7894ec56684733dab
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6683018.exeFilesize
379KB
MD5c050c12e86d0fb144739e12eeac116ce
SHA125151fff87cdb37a203d048ccc410f656fe9a809
SHA256900d0aff8b514ee9fa90bd732c5761795c6886392075340c94b6d374e03636ad
SHA51278913806baf9727535472794b7620edb0186197d9a188325084e419fbd86ef46c77009e162a7e33823d83b0e40c9c1f0580f12cb0d338bd6a0b906d34b17d655
-
C:\Users\Admin\AppData\Local\Temp\IXP004.TMP\r6683018.exeFilesize
379KB
MD5c050c12e86d0fb144739e12eeac116ce
SHA125151fff87cdb37a203d048ccc410f656fe9a809
SHA256900d0aff8b514ee9fa90bd732c5761795c6886392075340c94b6d374e03636ad
SHA51278913806baf9727535472794b7620edb0186197d9a188325084e419fbd86ef46c77009e162a7e33823d83b0e40c9c1f0580f12cb0d338bd6a0b906d34b17d655
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\cb378487cf\legota.exeFilesize
219KB
MD5a427281ec99595c2a977a70e0009a30c
SHA1c937c5d14127921f068a081bb3e8f450c9966852
SHA25640ff20f391de89b6604882de34b20f32e78d6ead62c4587b3fa968c6c21e03d3
SHA5122a7a735bbaab2b19d5ca23e988ff7aaba8dc91b7e6295a84a4a9ff5efa5e89a67ff40073c671192054262153d188f0534bfd6e67231fe79c0e6e46d0ed380976
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Local\Temp\fefffe8cea\explonde.exeFilesize
219KB
MD5c256a814d3f9d02d73029580dfe882b3
SHA1e11e9ea937183139753f3b0d5e71c8301d000896
SHA25653f129d7c6b008406a6214c261e45c06dfc1cd7dc36639018e37b07416bf5f7c
SHA5121f263232f9bcf8f936239cd0866594c5d14c4b6cca8337c1a20dabfedf588fbc5839deba7f5fc8243f1a6fa64f87a2133afde6ce7b6eb4293b4807f66e05df3a
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dllFilesize
89KB
MD52ac6d3fcf6913b1a1ac100407e97fccb
SHA1809f7d4ed348951b79745074487956255d1d0a9a
SHA25630f0f0631054f194553a9b8700f2db747cb167490201a43c0767644d77870dbe
SHA51279ebf87dccce1a0b7f892473dfb1c0bff5908840e80bbda44235a7a568993a76b661b81db6597798ec6e978dc441dd7108583367ffdc57224e40d0bd0efe93b6
-
C:\Users\Admin\AppData\Roaming\006700e5a2ab05\cred64.dllFilesize
273B
MD50c459e65bcc6d38574f0c0d63a87088a
SHA141e53d5f2b3e7ca859b842a1c7b677e0847e6d65
SHA256871c61d5f7051d6ddcf787e92e92d9c7e36747e64ea17b8cffccac549196abc4
SHA512be1ca1fa525dfea57bc14ba41d25fb904c8e4c1d5cb4a5981d3173143620fb8e08277c0dfc2287b792e365871cc6805034377060a84cfef81969cd3d3ba8f90d
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dllFilesize
89KB
MD5ec41f740797d2253dc1902e71941bbdb
SHA1407b75f07cb205fee94c4c6261641bd40c2c28e9
SHA25647425ebf3dd905bbfea15a7667662aa6ce3d2deba4b48dfbe646ce9d06f43520
SHA512e544348e86cee7572a6f12827368d5377d66194a006621d4414ef7e0f2050826d32967b4374dfbcdecda027011c95d2044bd7c461db23fad639f9922b92a6d33
-
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dllFilesize
273B
MD56d5040418450624fef735b49ec6bffe9
SHA15fff6a1a620a5c4522aead8dbd0a5a52570e8773
SHA256dbc5ab846d6c2b4a1d0f6da31adeaa6467e8c791708bf4a52ef43adbb6b6c0d3
SHA512bdf1d85e5f91c4994c5a68f7a1289435fd47069bc8f844d498d7dfd19b5609086e32700205d0fd7d1eb6c65bcc5fab5382de8b912f7ce9b6f7f09db43e49f0b0
-
memory/648-36-0x0000000073ED0000-0x0000000074680000-memory.dmpFilesize
7.7MB
-
memory/648-84-0x0000000073ED0000-0x0000000074680000-memory.dmpFilesize
7.7MB
-
memory/648-86-0x0000000073ED0000-0x0000000074680000-memory.dmpFilesize
7.7MB
-
memory/648-35-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/1784-57-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/1784-88-0x0000000005450000-0x0000000005460000-memory.dmpFilesize
64KB
-
memory/1784-87-0x0000000073ED0000-0x0000000074680000-memory.dmpFilesize
7.7MB
-
memory/1784-61-0x0000000005620000-0x000000000566C000-memory.dmpFilesize
304KB
-
memory/1784-60-0x00000000055E0000-0x000000000561C000-memory.dmpFilesize
240KB
-
memory/1784-56-0x0000000005580000-0x0000000005592000-memory.dmpFilesize
72KB
-
memory/1784-55-0x0000000005670000-0x000000000577A000-memory.dmpFilesize
1.0MB
-
memory/1784-51-0x0000000005B80000-0x0000000006198000-memory.dmpFilesize
6.1MB
-
memory/1784-50-0x0000000073ED0000-0x0000000074680000-memory.dmpFilesize
7.7MB
-
memory/1784-49-0x0000000001670000-0x0000000001676000-memory.dmpFilesize
24KB
-
memory/1784-48-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/3452-44-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3452-42-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3452-41-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3452-40-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB