Analysis
-
max time kernel
104s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-01-2023 03:42
Static task
static1
Behavioral task
behavioral1
Sample
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe
Resource
win7-20221111-en
General
-
Target
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe
-
Size
160KB
-
MD5
9a6a913cceb071140108ff9df1d1ff5b
-
SHA1
116ec5175b5da2f23eb95f3bc4e1cbaed551bbf3
-
SHA256
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b
-
SHA512
55c59d7a273af3e960b56987380f5f2c5659278d46f958e670f334f4827776868afef206f7d3bf0c9720862432279ca05e44be0827514d36af80c432f80b2e04
-
SSDEEP
3072:aT2xNfzEmPUac0yCRS9EK0TLmV/MsdpFJma538ZNvWPJFlD:OkPpe0mB3N8zWDN
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Executes dropped EXE 1 IoCs
Processes:
WaterMark.exepid process 1100 WaterMark.exe -
Processes:
resource yara_rule behavioral2/memory/4356-134-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/4356-137-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4356-132-0x0000000002530000-0x00000000035BE000-memory.dmp upx behavioral2/memory/4356-136-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/4356-138-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4356-143-0x0000000000400000-0x0000000000421000-memory.dmp upx behavioral2/memory/4356-146-0x0000000002530000-0x00000000035BE000-memory.dmp upx behavioral2/memory/1100-151-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/1100-152-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/1100-153-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/1100-156-0x0000000000400000-0x0000000000421000-memory.dmp upx -
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Drops file in Program Files directory 3 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft\WaterMark.exe deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe File opened for modification C:\Program Files (x86)\Microsoft\px5DE4.tmp deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe File created C:\Program Files (x86)\Microsoft\WaterMark.exe deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Drops file in Windows directory 1 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Processes:
iexplore.exeIEXPLORE.EXEiexplore.exeIEXPLORE.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011941" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1660969715" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3e0000003e000000c4040000a3020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1660969715" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1523314653" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31011941" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011941" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1660969715" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{84B79CA9-A058-11ED-919F-7218A89707DE} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{84C385DD-A058-11ED-919F-7218A89707DE} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31011941" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1523157666" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31011941" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31011941" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "381818732" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1660969715" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exeWaterMark.exepid process 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe 1100 WaterMark.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 2584 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription pid process Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Token: SeDebugPrivilege 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exeiexplore.exepid process 2584 iexplore.exe 2436 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
Processes:
iexplore.exeiexplore.exeIEXPLORE.EXEIEXPLORE.EXEpid process 2436 iexplore.exe 2436 iexplore.exe 2584 iexplore.exe 2584 iexplore.exe 4536 IEXPLORE.EXE 4536 IEXPLORE.EXE 2608 IEXPLORE.EXE 2608 IEXPLORE.EXE 4536 IEXPLORE.EXE 4536 IEXPLORE.EXE -
Suspicious use of UnmapMainImage 2 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exeWaterMark.exepid process 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe 1100 WaterMark.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exeWaterMark.exeiexplore.exeiexplore.exedescription pid process target process PID 4356 wrote to memory of 776 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe fontdrvhost.exe PID 4356 wrote to memory of 784 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe fontdrvhost.exe PID 4356 wrote to memory of 1008 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe dwm.exe PID 4356 wrote to memory of 2628 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe sihost.exe PID 4356 wrote to memory of 2696 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe svchost.exe PID 4356 wrote to memory of 2888 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe taskhostw.exe PID 4356 wrote to memory of 2680 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe Explorer.EXE PID 4356 wrote to memory of 3080 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe svchost.exe PID 4356 wrote to memory of 3280 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe DllHost.exe PID 4356 wrote to memory of 3368 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe StartMenuExperienceHost.exe PID 4356 wrote to memory of 1100 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe WaterMark.exe PID 4356 wrote to memory of 1100 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe WaterMark.exe PID 4356 wrote to memory of 1100 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe WaterMark.exe PID 4356 wrote to memory of 3440 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe RuntimeBroker.exe PID 4356 wrote to memory of 3528 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe SearchApp.exe PID 4356 wrote to memory of 3784 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe RuntimeBroker.exe PID 4356 wrote to memory of 4672 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe RuntimeBroker.exe PID 4356 wrote to memory of 3292 4356 deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe RuntimeBroker.exe PID 1100 wrote to memory of 4268 1100 WaterMark.exe svchost.exe PID 1100 wrote to memory of 4268 1100 WaterMark.exe svchost.exe PID 1100 wrote to memory of 4268 1100 WaterMark.exe svchost.exe PID 1100 wrote to memory of 4268 1100 WaterMark.exe svchost.exe PID 1100 wrote to memory of 4268 1100 WaterMark.exe svchost.exe PID 1100 wrote to memory of 4268 1100 WaterMark.exe svchost.exe PID 1100 wrote to memory of 4268 1100 WaterMark.exe svchost.exe PID 1100 wrote to memory of 4268 1100 WaterMark.exe svchost.exe PID 1100 wrote to memory of 4268 1100 WaterMark.exe svchost.exe PID 1100 wrote to memory of 2584 1100 WaterMark.exe iexplore.exe PID 1100 wrote to memory of 2584 1100 WaterMark.exe iexplore.exe PID 1100 wrote to memory of 2436 1100 WaterMark.exe iexplore.exe PID 1100 wrote to memory of 2436 1100 WaterMark.exe iexplore.exe PID 2584 wrote to memory of 4536 2584 iexplore.exe IEXPLORE.EXE PID 2584 wrote to memory of 4536 2584 iexplore.exe IEXPLORE.EXE PID 2584 wrote to memory of 4536 2584 iexplore.exe IEXPLORE.EXE PID 2436 wrote to memory of 2608 2436 iexplore.exe IEXPLORE.EXE PID 2436 wrote to memory of 2608 2436 iexplore.exe IEXPLORE.EXE PID 2436 wrote to memory of 2608 2436 iexplore.exe IEXPLORE.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe"C:\Users\Admin\AppData\Local\Temp\deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Microsoft\WaterMark.exe"C:\Program Files (x86)\Microsoft\WaterMark.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe4⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2584 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2436 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
160KB
MD59a6a913cceb071140108ff9df1d1ff5b
SHA1116ec5175b5da2f23eb95f3bc4e1cbaed551bbf3
SHA256deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b
SHA51255c59d7a273af3e960b56987380f5f2c5659278d46f958e670f334f4827776868afef206f7d3bf0c9720862432279ca05e44be0827514d36af80c432f80b2e04
-
C:\Program Files (x86)\Microsoft\WaterMark.exeFilesize
160KB
MD59a6a913cceb071140108ff9df1d1ff5b
SHA1116ec5175b5da2f23eb95f3bc4e1cbaed551bbf3
SHA256deb5deb65b397c80f01ebb40633d3da7d5994bfcf5b2c3095904477c3e1b166b
SHA51255c59d7a273af3e960b56987380f5f2c5659278d46f958e670f334f4827776868afef206f7d3bf0c9720862432279ca05e44be0827514d36af80c432f80b2e04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86CFilesize
779B
MD5da6a32b46f7dd93455271b8ba5f6958c
SHA160113cc5a648a5659e5fe044e7224eee3ad6afe7
SHA2565599ce82fbe165aca36b5135ad490b16c8891017caefc874f93146b9170cfdcc
SHA5126d31ada0e633658e6c13379dca3e15a04794e6522d66309db852cedccf69b9857549d6424c625640b35daf2309ee07acacdc28c4a8f5d4e3d46092d91fd36db9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
471B
MD50518b0c986ebecc2e8b7d18563f3a3f9
SHA1f64c6bf2713c74c0519bc4dfbb1ef2d361d8fa0f
SHA2565beab60b4c60e1dd16a188541199742eb97df28aa6a3e41f7dcabc1c75dee492
SHA512a49b8b37bc4d23c631e891b9cc8921bc724f52a66c59f01823536423336fd387223f544ff6de19db5ed691a18285004bc2a1fc5730f4165e26b89479713f9915
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86CFilesize
246B
MD589e6991c7b3588059e0127a892c6565b
SHA1c431753ccb1cc976c46ae39dba882de58a4a5e71
SHA2562940c484b871034ac907f9d5a98dcbec9e94cb548b8206e232d7fc40f02410f6
SHA512bc16419137bc17cbed0c2990d6346b7cd29714dbe3f242f76f01db409d663581baf96122f0afdc67c8c78b86deb2d0ac350b434eca0bd2b8f8fb705c5785c788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86CFilesize
246B
MD589e6991c7b3588059e0127a892c6565b
SHA1c431753ccb1cc976c46ae39dba882de58a4a5e71
SHA2562940c484b871034ac907f9d5a98dcbec9e94cb548b8206e232d7fc40f02410f6
SHA512bc16419137bc17cbed0c2990d6346b7cd29714dbe3f242f76f01db409d663581baf96122f0afdc67c8c78b86deb2d0ac350b434eca0bd2b8f8fb705c5785c788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86CFilesize
246B
MD589e6991c7b3588059e0127a892c6565b
SHA1c431753ccb1cc976c46ae39dba882de58a4a5e71
SHA2562940c484b871034ac907f9d5a98dcbec9e94cb548b8206e232d7fc40f02410f6
SHA512bc16419137bc17cbed0c2990d6346b7cd29714dbe3f242f76f01db409d663581baf96122f0afdc67c8c78b86deb2d0ac350b434eca0bd2b8f8fb705c5785c788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD50c467fda244406ae9200976a6446b385
SHA126c84720f8776915fec11f026eaadf5c2433ee2a
SHA256a7dfcb4f1ae2623bddd256766713155000ec60ad724109a9415fe2dba6bca619
SHA512de653ffaaf79ad2aaac3cd13f4649297c51bac7c3f1344fb6c0219cb796fcea4abd5a74fab126f12160f05caf6c2b4eb1cb8721304534a34716b0ddf157ac164
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776Filesize
404B
MD55efa0ce62811695bb1494ceb27713571
SHA1aadf466db9feaffb6aa14b311c1d0008b4d3f909
SHA256127aa1c81b244dde5d7cf8f97289d3b6c3dd9639e9e465151c1680b6dd68a0d8
SHA512882deb9115aff1c9bf89aab6774ce6a2de5c7af91d9cf7156c1243e83091b6a691d09561653cf74d43c9f1dc5eed8b99f00eb5fa8dcc3968061727a6f81870a8
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{84B79CA9-A058-11ED-919F-7218A89707DE}.datFilesize
5KB
MD5ec4a77fb27f5e85c955179365b0b08fb
SHA1f924c5254f8a560317555a302399bb13f44e7259
SHA2561c44a6c9509cd84bee3fcaf5131464ca7284045488497b64661d794580ddb9dd
SHA51216059e56f2f3c331ff0087f92eeb89c80f786afb0a243468a01a9c47ec07caf067d6b510dd782f5ce897e206b3c362884d524351ee22707b38aa29815357509b
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{84C385DD-A058-11ED-919F-7218A89707DE}.datFilesize
5KB
MD5cef1984e9ba734e309762c826e6bcba2
SHA102e5d717f181750e24d7df5e6da688f9061f578e
SHA2560df4ed5499aac07c3a7f1ab3d6d8abf828e32fa7ae8a18206c6cf1be7cfe0cc2
SHA512a8a7d18bf56582907cf92f62215196ea4796a7ba35960b0f479662fd88f59e190f88e83b6f51dfba5bfab6697665844f652041f01c1ec9c5794811f8cc61104b
-
memory/1100-156-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1100-151-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1100-152-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1100-153-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/1100-139-0x0000000000000000-mapping.dmp
-
memory/1100-142-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4268-150-0x0000000000000000-mapping.dmp
-
memory/4356-134-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4356-138-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4356-143-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/4356-146-0x0000000002530000-0x00000000035BE000-memory.dmpFilesize
16.6MB
-
memory/4356-136-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/4356-132-0x0000000002530000-0x00000000035BE000-memory.dmpFilesize
16.6MB
-
memory/4356-137-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB