Analysis
-
max time kernel
151s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-03-2024 10:28
Static task
static1
Behavioral task
behavioral1
Sample
db66b3698482c366c1de1189e75e2450.exe
Resource
win7-20240221-en
General
-
Target
db66b3698482c366c1de1189e75e2450.exe
-
Size
496KB
-
MD5
db66b3698482c366c1de1189e75e2450
-
SHA1
4dcf416c4da2476a6340f8d48b75aae1af7552d4
-
SHA256
5ee51a9806a81b2083b8530d9ec3a923103f1a3f50a8302fa399daa41789723e
-
SHA512
05a0024e36cc8d1644355124a0a453c7f46d853fbf4df99541a55e862eda8e230ed873f9ed66b545044c0dc527ad98faf267ba753783d04ecbacbb45a21f7747
-
SSDEEP
12288:LDCPENnBV5jaHBoFvZstQW012B04Ngjw5qu8jxTQlDrLOM:LEEZBV5jCoFvZsSWG2BdN+w2+O
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
3men.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" 3men.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
Processes:
j29oAE.exenuuwuiw.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" j29oAE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" nuuwuiw.exe -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2160 cmd.exe -
Executes dropped EXE 12 IoCs
Processes:
j29oAE.exenuuwuiw.exe2men.exe2men.exe2men.exe2men.exe2men.exe2men.exe3men.exe3men.exe3men.exeFBBD.tmppid process 2720 j29oAE.exe 2936 nuuwuiw.exe 2432 2men.exe 2596 2men.exe 3016 2men.exe 1148 2men.exe 2516 2men.exe 2792 2men.exe 2840 3men.exe 1952 3men.exe 800 3men.exe 1744 FBBD.tmp -
Loads dropped DLL 17 IoCs
Processes:
db66b3698482c366c1de1189e75e2450.exej29oAE.exeWerFault.exe3men.exepid process 2244 db66b3698482c366c1de1189e75e2450.exe 2244 db66b3698482c366c1de1189e75e2450.exe 2720 j29oAE.exe 2720 j29oAE.exe 2244 db66b3698482c366c1de1189e75e2450.exe 2244 db66b3698482c366c1de1189e75e2450.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2988 WerFault.exe 2244 db66b3698482c366c1de1189e75e2450.exe 2244 db66b3698482c366c1de1189e75e2450.exe 2840 3men.exe 2840 3men.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2596-42-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2596-40-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2596-46-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2596-51-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2596-53-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/3016-52-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/2596-55-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/3016-56-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/3016-62-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/3016-65-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/3016-66-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/3016-67-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral1/memory/1148-70-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1148-78-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1148-84-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1148-81-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1148-86-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1148-88-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2516-90-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2516-92-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2516-96-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2516-99-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2516-103-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2516-102-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2516-107-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2596-117-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2840-120-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1148-123-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/2516-124-0x0000000000400000-0x0000000000407000-memory.dmp upx behavioral1/memory/2840-135-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1952-137-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1952-138-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/2840-259-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/800-263-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1952-419-0x00000000004E0000-0x00000000005E0000-memory.dmp upx -
Adds Run key to start application 2 TTPs 53 IoCs
Processes:
nuuwuiw.exe3men.exej29oAE.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /a" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /U" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /p" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /N" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /h" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /R" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /J" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /q" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /z" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /x" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /T" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /Z" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /I" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /H" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /K" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /i" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /C" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /O" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /w" nuuwuiw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\352.exe = "C:\\Program Files (x86)\\LP\\9B52\\352.exe" 3men.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /n" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /M" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /o" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /g" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /b" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /A" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /G" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /m" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /D" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /l" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /S" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /Y" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /t" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /F" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /k" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /s" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /j" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /f" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /e" j29oAE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /E" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /r" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /B" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /c" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /Q" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /u" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /v" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /V" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /L" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /W" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /P" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /d" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /X" nuuwuiw.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\nuuwuiw = "C:\\Users\\Admin\\nuuwuiw.exe /e" nuuwuiw.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
2men.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 2men.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 2men.exe -
Suspicious use of SetThreadContext 5 IoCs
Processes:
2men.exedescription pid process target process PID 2432 set thread context of 2596 2432 2men.exe 2men.exe PID 2432 set thread context of 3016 2432 2men.exe 2men.exe PID 2432 set thread context of 1148 2432 2men.exe 2men.exe PID 2432 set thread context of 2516 2432 2men.exe 2men.exe PID 2432 set thread context of 2792 2432 2men.exe 2men.exe -
Drops file in Program Files directory 3 IoCs
Processes:
3men.exedescription ioc process File opened for modification C:\Program Files (x86)\LP\9B52\FBBD.tmp 3men.exe File created C:\Program Files (x86)\LP\9B52\352.exe 3men.exe File opened for modification C:\Program Files (x86)\LP\9B52\352.exe 3men.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2988 3016 WerFault.exe 2men.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
Processes:
tasklist.exetasklist.exepid process 2664 tasklist.exe 2384 tasklist.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
j29oAE.exenuuwuiw.exe2men.exe3men.exepid process 2720 j29oAE.exe 2720 j29oAE.exe 2936 nuuwuiw.exe 1148 2men.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 1148 2men.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2840 3men.exe 2840 3men.exe 2840 3men.exe 2840 3men.exe 2840 3men.exe 2840 3men.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2840 3men.exe 2840 3men.exe 2840 3men.exe 2840 3men.exe 2840 3men.exe 2840 3men.exe 2840 3men.exe 2840 3men.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe 2936 nuuwuiw.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
tasklist.exemsiexec.exetasklist.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2664 tasklist.exe Token: SeRestorePrivilege 2292 msiexec.exe Token: SeTakeOwnershipPrivilege 2292 msiexec.exe Token: SeSecurityPrivilege 2292 msiexec.exe Token: SeDebugPrivilege 2384 tasklist.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe Token: SeShutdownPrivilege 2884 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
explorer.exepid process 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
explorer.exepid process 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe 2884 explorer.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
db66b3698482c366c1de1189e75e2450.exej29oAE.exenuuwuiw.exe2men.exe2men.exe2men.exepid process 2244 db66b3698482c366c1de1189e75e2450.exe 2720 j29oAE.exe 2936 nuuwuiw.exe 2432 2men.exe 2596 2men.exe 2516 2men.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
db66b3698482c366c1de1189e75e2450.exej29oAE.execmd.exe2men.exe2men.exedescription pid process target process PID 2244 wrote to memory of 2720 2244 db66b3698482c366c1de1189e75e2450.exe j29oAE.exe PID 2244 wrote to memory of 2720 2244 db66b3698482c366c1de1189e75e2450.exe j29oAE.exe PID 2244 wrote to memory of 2720 2244 db66b3698482c366c1de1189e75e2450.exe j29oAE.exe PID 2244 wrote to memory of 2720 2244 db66b3698482c366c1de1189e75e2450.exe j29oAE.exe PID 2720 wrote to memory of 2936 2720 j29oAE.exe nuuwuiw.exe PID 2720 wrote to memory of 2936 2720 j29oAE.exe nuuwuiw.exe PID 2720 wrote to memory of 2936 2720 j29oAE.exe nuuwuiw.exe PID 2720 wrote to memory of 2936 2720 j29oAE.exe nuuwuiw.exe PID 2720 wrote to memory of 2712 2720 j29oAE.exe cmd.exe PID 2720 wrote to memory of 2712 2720 j29oAE.exe cmd.exe PID 2720 wrote to memory of 2712 2720 j29oAE.exe cmd.exe PID 2720 wrote to memory of 2712 2720 j29oAE.exe cmd.exe PID 2712 wrote to memory of 2664 2712 cmd.exe tasklist.exe PID 2712 wrote to memory of 2664 2712 cmd.exe tasklist.exe PID 2712 wrote to memory of 2664 2712 cmd.exe tasklist.exe PID 2712 wrote to memory of 2664 2712 cmd.exe tasklist.exe PID 2244 wrote to memory of 2432 2244 db66b3698482c366c1de1189e75e2450.exe 2men.exe PID 2244 wrote to memory of 2432 2244 db66b3698482c366c1de1189e75e2450.exe 2men.exe PID 2244 wrote to memory of 2432 2244 db66b3698482c366c1de1189e75e2450.exe 2men.exe PID 2244 wrote to memory of 2432 2244 db66b3698482c366c1de1189e75e2450.exe 2men.exe PID 2432 wrote to memory of 2596 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2596 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2596 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2596 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2596 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2596 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2596 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2596 2432 2men.exe 2men.exe PID 2432 wrote to memory of 3016 2432 2men.exe 2men.exe PID 2432 wrote to memory of 3016 2432 2men.exe 2men.exe PID 2432 wrote to memory of 3016 2432 2men.exe 2men.exe PID 2432 wrote to memory of 3016 2432 2men.exe 2men.exe PID 2432 wrote to memory of 3016 2432 2men.exe 2men.exe PID 2432 wrote to memory of 3016 2432 2men.exe 2men.exe PID 2432 wrote to memory of 3016 2432 2men.exe 2men.exe PID 2432 wrote to memory of 3016 2432 2men.exe 2men.exe PID 3016 wrote to memory of 2988 3016 2men.exe WerFault.exe PID 3016 wrote to memory of 2988 3016 2men.exe WerFault.exe PID 3016 wrote to memory of 2988 3016 2men.exe WerFault.exe PID 3016 wrote to memory of 2988 3016 2men.exe WerFault.exe PID 2432 wrote to memory of 1148 2432 2men.exe 2men.exe PID 2432 wrote to memory of 1148 2432 2men.exe 2men.exe PID 2432 wrote to memory of 1148 2432 2men.exe 2men.exe PID 2432 wrote to memory of 1148 2432 2men.exe 2men.exe PID 2432 wrote to memory of 1148 2432 2men.exe 2men.exe PID 2432 wrote to memory of 1148 2432 2men.exe 2men.exe PID 2432 wrote to memory of 1148 2432 2men.exe 2men.exe PID 2432 wrote to memory of 1148 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2516 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2516 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2516 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2516 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2516 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2516 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2516 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2516 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2792 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2792 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2792 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2792 2432 2men.exe 2men.exe PID 2432 wrote to memory of 2792 2432 2men.exe 2men.exe PID 2244 wrote to memory of 2840 2244 db66b3698482c366c1de1189e75e2450.exe 3men.exe PID 2244 wrote to memory of 2840 2244 db66b3698482c366c1de1189e75e2450.exe 3men.exe PID 2244 wrote to memory of 2840 2244 db66b3698482c366c1de1189e75e2450.exe 3men.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
3men.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 3men.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 3men.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\db66b3698482c366c1de1189e75e2450.exe"C:\Users\Admin\AppData\Local\Temp\db66b3698482c366c1de1189e75e2450.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\j29oAE.exeC:\Users\Admin\j29oAE.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\nuuwuiw.exe"C:\Users\Admin\nuuwuiw.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del j29oAE.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\2men.exeC:\Users\Admin\2men.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3016 -s 884⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\2men.exe"C:\Users\Admin\2men.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\3men.exeC:\Users\Admin\3men.exe2⤵
- Modifies security service
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- System policy modification
-
C:\Users\Admin\3men.exeC:\Users\Admin\3men.exe startC:\Users\Admin\AppData\Roaming\2956A\2EB9B.exe%C:\Users\Admin\AppData\Roaming\2956A3⤵
- Executes dropped EXE
-
C:\Users\Admin\3men.exeC:\Users\Admin\3men.exe startC:\Program Files (x86)\6A908\lvvm.exe%C:\Program Files (x86)\6A9083⤵
- Executes dropped EXE
-
C:\Program Files (x86)\LP\9B52\FBBD.tmp"C:\Program Files (x86)\LP\9B52\FBBD.tmp"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del db66b3698482c366c1de1189e75e2450.exe2⤵
- Deletes itself
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
5Hide Artifacts
1Hidden Files and Directories
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\2956A\A908.956Filesize
600B
MD5365b7df65ae6393c0a969e2718436966
SHA1b60ed921ab110e4cec24644a55dcdc65880f5072
SHA2562df58af688ded2c38827dc87456c04e584339442219a28e34233d0bab03cf2e0
SHA512d26234e287088c1ea13bf28e2b5f1644d8308232a2dd66926849a5d4127ab0d9af6067d0f8221f56f007b6084e6cb12c157a531c98dc0ede7a927e32457ca283
-
C:\Users\Admin\AppData\Roaming\2956A\A908.956Filesize
996B
MD5f462ace8180cd639c27510008e2ece7c
SHA1c1b32f8629a603deaa5ac598bd2072652c92ef04
SHA256b708c56be84fafb743b40c75f1f310772b92b47eed704f7521ea25b360f36a89
SHA5120e7c0298e28c0c18cab86dea747c7f065af8891a6715e7e56994b31d372df239db6bd76e2d3f4c3129ee59d5d841f906723f59ea56de7fdb848cbd5ba032c9cb
-
C:\Users\Admin\AppData\Roaming\2956A\A908.956Filesize
1KB
MD52cf3e6a14f3726a0180b10d7a9ae36d9
SHA1366709e1521851292628e2239a2b5007a83ef0a4
SHA25677af91e4483919c398cf76f9e2e7412be474cb11a8f6d7cb8e94fbe4181f67fb
SHA512320a575496f0a51b63d46d26c1b9b1a403a617ca17b8fe1152af408ababba73fb3154a74bc78afcf6871600031d5abc195becc5763665bf555b389c36648fb57
-
\Program Files (x86)\LP\9B52\FBBD.tmpFilesize
96KB
MD56b9ed8570a1857126c8bf99e0663926c
SHA194e08d8a0be09be35f37a9b17ec2130febfa2074
SHA256888e4e571a6f78ee81d94ab56bd033d413f9160f1089073176b03c91878aae2d
SHA51223211a1b71f1d05ad7f003231da826220ac4940e48071135cc3fba14708123fa0292e2e71c294a8086d8dc5f90dd32c4da3b41e6857c56f38cb325d78cb14880
-
\Users\Admin\2men.exeFilesize
132KB
MD5945a713b037b50442ec5d18d3dc0d55e
SHA12c8881b327a79fafcce27479b78f05487d93c802
SHA2562da470571a64bcdeb56f62c916ee2bffa87ccc6c028b7c8cb0132d09bceedd2f
SHA5120eab4bb5d04725cc20e463ae6959f71064674602f8ee7b3c9b2db75e928b9a0b1bdc94233dc261f6277d02e54a443b42a59b12aaebb8bbf243f0940344fbf385
-
\Users\Admin\3men.exeFilesize
271KB
MD50d668203e24463de2bf228f00443b7bc
SHA1eacff981d71f6648f6315e508bfd75e11683dba8
SHA256509d530e99839d7dbc8fccac163420d9dc455fb478fa57fdec1b7a2ef629d7bc
SHA5123251bb1341bd466e71468d72723bd5cf545dbd232327f343b44c51daae8755ed3caa02f74adbb0304912769346fa90dfa4c7036c211836e5650bdb06993ba803
-
\Users\Admin\j29oAE.exeFilesize
176KB
MD5c4a634088e095eab98183984bb7252d8
SHA1c205f2c1f8040c9205c6c06accd75c0396c59781
SHA256db345985313397a39cc2817134315c8db71ab4c48680e62c0358db406b0eff6a
SHA512b6a30f6d5cc30bee9b9d483629f16c80c5338360cec629f9ee2a3307b73b9743fd71396e408ac72008b84f4b8fded26002c910421853253b52b8b4d530df7a8e
-
\Users\Admin\nuuwuiw.exeFilesize
176KB
MD554b3c38f3863eea72ad3f1c182582055
SHA117753f8192b078b916534fa4290e572ba92a3271
SHA256b107a4627f54f5650db47cec5e6e6a756712f7adde42ef88b1a0239adcee9822
SHA512b82384f2a69fab93b33bc49b853149644bc9ba1c3997c3eaa23c335f409a8d2ef4003475c6bcb6d9d35ab3ccace671d7cdd8e14aa99290374d4eb74738a87b57
-
memory/800-263-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/800-442-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/800-264-0x0000000000536000-0x0000000000556000-memory.dmpFilesize
128KB
-
memory/1148-68-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1148-70-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1148-88-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1148-86-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1148-81-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1148-84-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1148-123-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1148-78-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1744-440-0x0000000000540000-0x0000000000640000-memory.dmpFilesize
1024KB
-
memory/1744-439-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1744-444-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1952-419-0x00000000004E0000-0x00000000005E0000-memory.dmpFilesize
1024KB
-
memory/1952-137-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1952-138-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/1952-139-0x00000000004E0000-0x00000000005E0000-memory.dmpFilesize
1024KB
-
memory/2516-99-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2516-124-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2516-92-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2516-103-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2516-102-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2516-107-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2516-90-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2516-96-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2596-40-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2596-46-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2596-38-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2596-117-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2596-44-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2596-42-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2596-53-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2596-51-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2596-55-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/2840-135-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2840-259-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2840-262-0x0000000000290000-0x0000000000390000-memory.dmpFilesize
1024KB
-
memory/2840-120-0x0000000000400000-0x000000000046A000-memory.dmpFilesize
424KB
-
memory/2840-121-0x0000000000290000-0x0000000000390000-memory.dmpFilesize
1024KB
-
memory/2884-319-0x0000000003FA0000-0x0000000003FA1000-memory.dmpFilesize
4KB
-
memory/2884-449-0x0000000003FA0000-0x0000000003FA1000-memory.dmpFilesize
4KB
-
memory/3016-52-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/3016-49-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/3016-56-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/3016-62-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/3016-65-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/3016-66-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/3016-67-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB