Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
14-12-2022 08:59
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
General
-
Target
tmp.exe
-
Size
464KB
-
MD5
96ceffa9d6eb17ddf487a47dc2612e2e
-
SHA1
90cf9a9b40abca048672103db01fcf71e76941ba
-
SHA256
11067d8c251f6a030e1753cb2473dac3073d5cebe80b4072cf9f017c86be1c6d
-
SHA512
75e070f586dff89b95c95d4792a98bc90b99e65bd0641b62656aeb1bb9214980ef734691a09a10f4ad7e41786bf4547b0e154ff945c60a206f575e3ebf6a4e0e
-
SSDEEP
12288:eb5DbPowllDRf9Ib2JONfUcri1RcQP2a25NV:e9Dbg6lV9C2JOBUIc12a25X
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Processes:
resource yara_rule behavioral2/memory/2632-137-0x0000000010000000-0x00000000101B9000-memory.dmp purplefox_rootkit behavioral2/memory/2632-135-0x0000000010000000-0x00000000101B9000-memory.dmp purplefox_rootkit behavioral2/memory/2632-141-0x0000000010000000-0x00000000101B9000-memory.dmp purplefox_rootkit behavioral2/memory/3680-145-0x0000000010000000-0x00000000101B9000-memory.dmp purplefox_rootkit behavioral2/memory/3680-160-0x0000000010000000-0x00000000101B9000-memory.dmp purplefox_rootkit behavioral2/memory/2100-164-0x0000000010000000-0x00000000101B9000-memory.dmp purplefox_rootkit behavioral2/memory/3680-146-0x0000000010000000-0x00000000101B9000-memory.dmp purplefox_rootkit behavioral2/memory/2100-166-0x0000000010000000-0x00000000101B9000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
Processes:
resource yara_rule behavioral2/memory/2632-137-0x0000000010000000-0x00000000101B9000-memory.dmp family_gh0strat behavioral2/memory/2632-135-0x0000000010000000-0x00000000101B9000-memory.dmp family_gh0strat behavioral2/memory/2632-141-0x0000000010000000-0x00000000101B9000-memory.dmp family_gh0strat behavioral2/memory/3680-145-0x0000000010000000-0x00000000101B9000-memory.dmp family_gh0strat behavioral2/memory/3680-160-0x0000000010000000-0x00000000101B9000-memory.dmp family_gh0strat behavioral2/memory/2100-164-0x0000000010000000-0x00000000101B9000-memory.dmp family_gh0strat behavioral2/memory/3680-146-0x0000000010000000-0x00000000101B9000-memory.dmp family_gh0strat behavioral2/memory/2100-166-0x0000000010000000-0x00000000101B9000-memory.dmp family_gh0strat -
Modifies firewall policy service 2 TTPs 9 IoCs
Processes:
Jbrja.exetmp.exeJbrja.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" tmp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" tmp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" tmp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Jbrja.exe -
Processes:
tmp.exeJbrja.exeJbrja.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Jbrja.exe -
Processes:
Jbrja.exetmp.exeJbrja.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Jbrja.exe -
Executes dropped EXE 2 IoCs
Processes:
Jbrja.exeJbrja.exepid process 3680 Jbrja.exe 2100 Jbrja.exe -
Processes:
resource yara_rule behavioral2/memory/2632-133-0x0000000010000000-0x00000000101B9000-memory.dmp upx behavioral2/memory/2632-132-0x00000000007C0000-0x000000000184E000-memory.dmp upx behavioral2/memory/2632-137-0x0000000010000000-0x00000000101B9000-memory.dmp upx behavioral2/memory/2632-135-0x0000000010000000-0x00000000101B9000-memory.dmp upx behavioral2/memory/2632-140-0x00000000007C0000-0x000000000184E000-memory.dmp upx behavioral2/memory/3680-143-0x0000000010000000-0x00000000101B9000-memory.dmp upx behavioral2/memory/2632-141-0x0000000010000000-0x00000000101B9000-memory.dmp upx behavioral2/memory/3680-142-0x0000000000890000-0x000000000191E000-memory.dmp upx behavioral2/memory/3680-145-0x0000000010000000-0x00000000101B9000-memory.dmp upx behavioral2/memory/2632-152-0x00000000007C0000-0x000000000184E000-memory.dmp upx behavioral2/memory/2100-154-0x0000000000790000-0x000000000181E000-memory.dmp upx behavioral2/memory/3680-158-0x0000000000890000-0x000000000191E000-memory.dmp upx behavioral2/memory/3680-160-0x0000000010000000-0x00000000101B9000-memory.dmp upx behavioral2/memory/2100-163-0x0000000000790000-0x000000000181E000-memory.dmp upx behavioral2/memory/2100-164-0x0000000010000000-0x00000000101B9000-memory.dmp upx behavioral2/memory/3680-146-0x0000000010000000-0x00000000101B9000-memory.dmp upx behavioral2/memory/2100-165-0x0000000000790000-0x000000000181E000-memory.dmp upx behavioral2/memory/2100-166-0x0000000010000000-0x00000000101B9000-memory.dmp upx -
Processes:
Jbrja.exeJbrja.exetmp.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" tmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Jbrja.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" Jbrja.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tmp.exe -
Processes:
Jbrja.exetmp.exeJbrja.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Jbrja.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Jbrja.exedescription ioc process File opened (read-only) \??\S: Jbrja.exe File opened (read-only) \??\U: Jbrja.exe File opened (read-only) \??\B: Jbrja.exe File opened (read-only) \??\G: Jbrja.exe File opened (read-only) \??\K: Jbrja.exe File opened (read-only) \??\M: Jbrja.exe File opened (read-only) \??\N: Jbrja.exe File opened (read-only) \??\R: Jbrja.exe File opened (read-only) \??\Y: Jbrja.exe File opened (read-only) \??\I: Jbrja.exe File opened (read-only) \??\V: Jbrja.exe File opened (read-only) \??\E: Jbrja.exe File opened (read-only) \??\F: Jbrja.exe File opened (read-only) \??\H: Jbrja.exe File opened (read-only) \??\O: Jbrja.exe File opened (read-only) \??\Z: Jbrja.exe File opened (read-only) \??\X: Jbrja.exe File opened (read-only) \??\J: Jbrja.exe File opened (read-only) \??\L: Jbrja.exe File opened (read-only) \??\P: Jbrja.exe File opened (read-only) \??\Q: Jbrja.exe File opened (read-only) \??\T: Jbrja.exe File opened (read-only) \??\W: Jbrja.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
Jbrja.exedescription ioc process File opened for modification C:\autorun.inf Jbrja.exe -
Drops file in System32 directory 2 IoCs
Processes:
tmp.exedescription ioc process File created C:\Windows\SysWOW64\Jbrja.exe tmp.exe File opened for modification C:\Windows\SysWOW64\Jbrja.exe tmp.exe -
Drops file in Program Files directory 11 IoCs
Processes:
Jbrja.exedescription ioc process File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe Jbrja.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe Jbrja.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe Jbrja.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe Jbrja.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe Jbrja.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe Jbrja.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe Jbrja.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe Jbrja.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe Jbrja.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe Jbrja.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe Jbrja.exe -
Drops file in Windows directory 1 IoCs
Processes:
tmp.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI tmp.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Jbrja.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Jbrja.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Jbrja.exe -
Modifies data under HKEY_USERS 28 IoCs
Processes:
Jbrja.exeJbrja.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S1_0 = "3299283285" Jbrja.exe Key created \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425 Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-1516192097 = "267" Jbrja.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\1313304901 = "23E4F7F25F8A545EF07859773043475EDD1D103E2D9C27F1F3A268ED09F30DE884DB9D92FD831B72EEF599E8C233EB23FBE7145BFA46281679ED385593CEE8869548167F08C5681A4B967232DBC5E0E01EC06026FCE8B24FCB589B28C073413E3C9C326851C4731397E851C96D85B6EDDDAA4E25FA227776D385991927AE94FC" Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\1364026700 = "35" Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-1516192097 = "267" Jbrja.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-50721799 = "0" Jbrja.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\1313304901 = "23E4F7F25F8A545EF07859773043475EDD1D103E2D9C27F1F3A268ED09F30DE884DB9D92FD831B72EEF599E8C233EB23FBE7145BFA46281679ED385593CEE8869548167F08C5681A4B967232DBC5E0E01EC06026FCE8B24FCB589B28C073413E3C9C326851C4731397E851C96D85B6EDDDAA4E25FA227776D385991927AE94FC" Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\1414748499 = "136" Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S4_0 = "0" Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\1364026700 = "35" Jbrja.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-101443598 = "0800687474703A2F2F616C7468617772792E6F72672F696D616765732F78732E6A706700687474703A2F2F7777772E6361726565726465736B2E6F72672F696D616765732F78732E6A706700687474703A2F2F6172746875722E6E697269612E62697A2F78732E6A706700687474703A2F2F616D73616D65782E636F6D2F78732E6A706700687474703A2F2F6170706C652D7069652E696E2F696D616765732F78732E6A706700687474703A2F2F61686D65646979652E6E65742F78732E6A706700687474703A2F2F67322E6172726F776869746563682E636F6D2F78732E6A706700687474703A2F2F616D7079617A696C696D2E636F6D2E74722F696D616765732F7873322E6A7067" Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S3_0 = "17001001" Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\GlobalUserOffline = "0" Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-50721799 = "0" Jbrja.exe Key created \REGISTRY\USER\.DEFAULT\Software\Aoqcbk Jbrja.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-101443598 = "0800687474703A2F2F616C7468617772792E6F72672F696D616765732F78732E6A706700687474703A2F2F7777772E6361726565726465736B2E6F72672F696D616765732F78732E6A706700687474703A2F2F6172746875722E6E697269612E62697A2F78732E6A706700687474703A2F2F616D73616D65782E636F6D2F78732E6A706700687474703A2F2F6170706C652D7069652E696E2F696D616765732F78732E6A706700687474703A2F2F61686D65646979652E6E65742F78732E6A706700687474703A2F2F67322E6172726F776869746563682E636F6D2F78732E6A706700687474703A2F2F616D7079617A696C696D2E636F6D2E74722F696D616765732F7873322E6A7067" Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\S2_0 = "9832" Jbrja.exe Key created \REGISTRY\USER\.DEFAULT\Software Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\GlobalUserOffline = "0" Jbrja.exe Key created \REGISTRY\USER\.DEFAULT\Software Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-1465470298 = "0" Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\1414748499 = "136" Jbrja.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Aoqcbk\1460008425\-1465470298 = "0" Jbrja.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum Jbrja.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Jbrja.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
tmp.exeJbrja.exeJbrja.exepid process 2632 tmp.exe 2632 tmp.exe 3680 Jbrja.exe 3680 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe 2100 Jbrja.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
tmp.exedescription pid process Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe Token: SeDebugPrivilege 2632 tmp.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
tmp.exeJbrja.exeJbrja.execmd.exedescription pid process target process PID 2632 wrote to memory of 796 2632 tmp.exe fontdrvhost.exe PID 2632 wrote to memory of 800 2632 tmp.exe fontdrvhost.exe PID 2632 wrote to memory of 1020 2632 tmp.exe dwm.exe PID 2632 wrote to memory of 2452 2632 tmp.exe sihost.exe PID 2632 wrote to memory of 2536 2632 tmp.exe svchost.exe PID 2632 wrote to memory of 2680 2632 tmp.exe taskhostw.exe PID 2632 wrote to memory of 1040 2632 tmp.exe Explorer.EXE PID 2632 wrote to memory of 3096 2632 tmp.exe svchost.exe PID 2632 wrote to memory of 3288 2632 tmp.exe DllHost.exe PID 2632 wrote to memory of 3380 2632 tmp.exe StartMenuExperienceHost.exe PID 2632 wrote to memory of 3452 2632 tmp.exe RuntimeBroker.exe PID 2632 wrote to memory of 3532 2632 tmp.exe SearchApp.exe PID 2632 wrote to memory of 3828 2632 tmp.exe RuntimeBroker.exe PID 2632 wrote to memory of 4952 2632 tmp.exe RuntimeBroker.exe PID 3680 wrote to memory of 796 3680 Jbrja.exe fontdrvhost.exe PID 3680 wrote to memory of 800 3680 Jbrja.exe fontdrvhost.exe PID 3680 wrote to memory of 1020 3680 Jbrja.exe dwm.exe PID 2632 wrote to memory of 624 2632 tmp.exe cmd.exe PID 2632 wrote to memory of 624 2632 tmp.exe cmd.exe PID 2632 wrote to memory of 624 2632 tmp.exe cmd.exe PID 3680 wrote to memory of 2452 3680 Jbrja.exe sihost.exe PID 3680 wrote to memory of 2536 3680 Jbrja.exe svchost.exe PID 3680 wrote to memory of 2680 3680 Jbrja.exe taskhostw.exe PID 3680 wrote to memory of 2100 3680 Jbrja.exe Jbrja.exe PID 3680 wrote to memory of 2100 3680 Jbrja.exe Jbrja.exe PID 3680 wrote to memory of 2100 3680 Jbrja.exe Jbrja.exe PID 3680 wrote to memory of 1040 3680 Jbrja.exe Explorer.EXE PID 3680 wrote to memory of 3096 3680 Jbrja.exe svchost.exe PID 3680 wrote to memory of 3288 3680 Jbrja.exe DllHost.exe PID 3680 wrote to memory of 3380 3680 Jbrja.exe StartMenuExperienceHost.exe PID 3680 wrote to memory of 3452 3680 Jbrja.exe RuntimeBroker.exe PID 3680 wrote to memory of 3532 3680 Jbrja.exe SearchApp.exe PID 3680 wrote to memory of 3828 3680 Jbrja.exe RuntimeBroker.exe PID 3680 wrote to memory of 4952 3680 Jbrja.exe RuntimeBroker.exe PID 2100 wrote to memory of 796 2100 Jbrja.exe fontdrvhost.exe PID 2100 wrote to memory of 800 2100 Jbrja.exe fontdrvhost.exe PID 2100 wrote to memory of 1020 2100 Jbrja.exe dwm.exe PID 2100 wrote to memory of 2452 2100 Jbrja.exe sihost.exe PID 2100 wrote to memory of 2536 2100 Jbrja.exe svchost.exe PID 2100 wrote to memory of 2680 2100 Jbrja.exe taskhostw.exe PID 2100 wrote to memory of 1040 2100 Jbrja.exe Explorer.EXE PID 2100 wrote to memory of 3096 2100 Jbrja.exe svchost.exe PID 2100 wrote to memory of 3288 2100 Jbrja.exe DllHost.exe PID 2100 wrote to memory of 3380 2100 Jbrja.exe StartMenuExperienceHost.exe PID 2100 wrote to memory of 3452 2100 Jbrja.exe RuntimeBroker.exe PID 2100 wrote to memory of 3532 2100 Jbrja.exe SearchApp.exe PID 2100 wrote to memory of 3828 2100 Jbrja.exe RuntimeBroker.exe PID 2100 wrote to memory of 4952 2100 Jbrja.exe RuntimeBroker.exe PID 2100 wrote to memory of 624 2100 Jbrja.exe cmd.exe PID 2100 wrote to memory of 624 2100 Jbrja.exe cmd.exe PID 624 wrote to memory of 3924 624 cmd.exe PING.EXE PID 624 wrote to memory of 3924 624 cmd.exe PING.EXE PID 624 wrote to memory of 3924 624 cmd.exe PING.EXE PID 2100 wrote to memory of 796 2100 Jbrja.exe fontdrvhost.exe PID 2100 wrote to memory of 800 2100 Jbrja.exe fontdrvhost.exe PID 2100 wrote to memory of 1020 2100 Jbrja.exe dwm.exe PID 2100 wrote to memory of 2452 2100 Jbrja.exe sihost.exe PID 2100 wrote to memory of 2536 2100 Jbrja.exe svchost.exe PID 2100 wrote to memory of 2680 2100 Jbrja.exe taskhostw.exe PID 2100 wrote to memory of 1040 2100 Jbrja.exe Explorer.EXE PID 2100 wrote to memory of 3096 2100 Jbrja.exe svchost.exe PID 2100 wrote to memory of 3288 2100 Jbrja.exe DllHost.exe PID 2100 wrote to memory of 3380 2100 Jbrja.exe StartMenuExperienceHost.exe PID 2100 wrote to memory of 3452 2100 Jbrja.exe RuntimeBroker.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
tmp.exeJbrja.exeJbrja.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Jbrja.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Jbrja.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\tmp.exe > nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\Jbrja.exeC:\Windows\SysWOW64\Jbrja.exe -acsi1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.11⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\Jbrja.exeC:\Windows\SysWOW64\Jbrja.exe -auto1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SYSTEM.INIFilesize
257B
MD57f1a28c3c926b5edc018bcbe3b515159
SHA1599e9026685c11dd2d0fb9bfd11805cbd7913fb2
SHA2566c85838d481ae0b55b60541983fd2da68f85a4c524264e9fd1033af18a8c95a0
SHA5121434007c624ca085b6d898fb33c1c4984fa2945c9a157ab968ba12af01116c65c6dcff95df7333aa54205d87c56e69f6208e6408e625d848e5e39fd971b254a3
-
C:\Windows\SysWOW64\Jbrja.exeFilesize
464KB
MD596ceffa9d6eb17ddf487a47dc2612e2e
SHA190cf9a9b40abca048672103db01fcf71e76941ba
SHA25611067d8c251f6a030e1753cb2473dac3073d5cebe80b4072cf9f017c86be1c6d
SHA51275e070f586dff89b95c95d4792a98bc90b99e65bd0641b62656aeb1bb9214980ef734691a09a10f4ad7e41786bf4547b0e154ff945c60a206f575e3ebf6a4e0e
-
C:\Windows\SysWOW64\Jbrja.exeFilesize
464KB
MD596ceffa9d6eb17ddf487a47dc2612e2e
SHA190cf9a9b40abca048672103db01fcf71e76941ba
SHA25611067d8c251f6a030e1753cb2473dac3073d5cebe80b4072cf9f017c86be1c6d
SHA51275e070f586dff89b95c95d4792a98bc90b99e65bd0641b62656aeb1bb9214980ef734691a09a10f4ad7e41786bf4547b0e154ff945c60a206f575e3ebf6a4e0e
-
C:\Windows\SysWOW64\Jbrja.exeFilesize
464KB
MD596ceffa9d6eb17ddf487a47dc2612e2e
SHA190cf9a9b40abca048672103db01fcf71e76941ba
SHA25611067d8c251f6a030e1753cb2473dac3073d5cebe80b4072cf9f017c86be1c6d
SHA51275e070f586dff89b95c95d4792a98bc90b99e65bd0641b62656aeb1bb9214980ef734691a09a10f4ad7e41786bf4547b0e154ff945c60a206f575e3ebf6a4e0e
-
memory/624-148-0x0000000000000000-mapping.dmp
-
memory/2100-149-0x0000000000000000-mapping.dmp
-
memory/2100-166-0x0000000010000000-0x00000000101B9000-memory.dmpFilesize
1.7MB
-
memory/2100-165-0x0000000000790000-0x000000000181E000-memory.dmpFilesize
16.6MB
-
memory/2100-164-0x0000000010000000-0x00000000101B9000-memory.dmpFilesize
1.7MB
-
memory/2100-163-0x0000000000790000-0x000000000181E000-memory.dmpFilesize
16.6MB
-
memory/2100-162-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/2100-154-0x0000000000790000-0x000000000181E000-memory.dmpFilesize
16.6MB
-
memory/2632-150-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/2632-136-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/2632-132-0x00000000007C0000-0x000000000184E000-memory.dmpFilesize
16.6MB
-
memory/2632-152-0x00000000007C0000-0x000000000184E000-memory.dmpFilesize
16.6MB
-
memory/2632-137-0x0000000010000000-0x00000000101B9000-memory.dmpFilesize
1.7MB
-
memory/2632-135-0x0000000010000000-0x00000000101B9000-memory.dmpFilesize
1.7MB
-
memory/2632-140-0x00000000007C0000-0x000000000184E000-memory.dmpFilesize
16.6MB
-
memory/2632-133-0x0000000010000000-0x00000000101B9000-memory.dmpFilesize
1.7MB
-
memory/2632-141-0x0000000010000000-0x00000000101B9000-memory.dmpFilesize
1.7MB
-
memory/3680-143-0x0000000010000000-0x00000000101B9000-memory.dmpFilesize
1.7MB
-
memory/3680-160-0x0000000010000000-0x00000000101B9000-memory.dmpFilesize
1.7MB
-
memory/3680-158-0x0000000000890000-0x000000000191E000-memory.dmpFilesize
16.6MB
-
memory/3680-145-0x0000000010000000-0x00000000101B9000-memory.dmpFilesize
1.7MB
-
memory/3680-146-0x0000000010000000-0x00000000101B9000-memory.dmpFilesize
1.7MB
-
memory/3680-142-0x0000000000890000-0x000000000191E000-memory.dmpFilesize
16.6MB
-
memory/3680-153-0x0000000000400000-0x0000000000476000-memory.dmpFilesize
472KB
-
memory/3924-161-0x0000000000000000-mapping.dmp