Analysis
-
max time kernel
26s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 02:23
Static task
static1
Behavioral task
behavioral1
Sample
ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe
Resource
win7-20240508-en
General
-
Target
ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe
-
Size
175KB
-
MD5
6a61a3d7d8ea4a373a2b71d50f166882
-
SHA1
bf3d7a162624857a267e197dbd745b120dba239c
-
SHA256
ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95
-
SHA512
48f5ac05f965713515c8b00c5b84e72fa2d109deac8c2235bda191661ec208dabd2f991636bd0859170fc16873a595315b61f306d6bec327210422e7efb5ad69
-
SSDEEP
3072:aftffjmNaftffjmNmcoa3b9OBFhfY6XHNNTGkZm1MOTLjAimZcoa3b9OBF:aVfjmNaVfjmNm+BOBbfY6XHjSkZmGgje
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exeLogo1_.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe -
Processes:
Logo1_.execa39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe -
Processes:
ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exeLogo1_.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Logo1_.exe -
Executes dropped EXE 3 IoCs
Processes:
Logo1_.execa39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.execa39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exepid process 1664 Logo1_.exe 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe 4252 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe -
Processes:
resource yara_rule behavioral2/memory/1600-20-0x00000000008D0000-0x000000000195E000-memory.dmp upx behavioral2/memory/1600-22-0x00000000008D0000-0x000000000195E000-memory.dmp upx behavioral2/memory/1600-23-0x00000000008D0000-0x000000000195E000-memory.dmp upx behavioral2/memory/1600-24-0x00000000008D0000-0x000000000195E000-memory.dmp upx behavioral2/memory/1600-40-0x00000000008D0000-0x000000000195E000-memory.dmp upx behavioral2/memory/1600-44-0x00000000008D0000-0x000000000195E000-memory.dmp upx behavioral2/memory/1664-64-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-67-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-68-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-72-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-71-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-69-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-66-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-70-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-73-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-75-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-76-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-77-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-78-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-79-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-81-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-82-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-89-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-92-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-93-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-94-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-96-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-100-0x00000000033F0000-0x000000000447E000-memory.dmp upx behavioral2/memory/1664-102-0x00000000033F0000-0x000000000447E000-memory.dmp upx -
Processes:
ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exeLogo1_.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Logo1_.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" Logo1_.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Logo1_.exe -
Processes:
ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exeLogo1_.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Logo1_.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exedescription ioc process File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe -
Drops file in Windows directory 7 IoCs
Processes:
Logo1_.execa39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.execa39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exedescription ioc process File opened for modification C:\Windows\rundl132.exe Logo1_.exe File opened for modification C:\Windows\SYSTEM.INI ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe File opened for modification C:\Windows\rundl132.exe ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe File created C:\Windows\Logo1_.exe ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe File created C:\Windows\vDll.dll Logo1_.exe File created C:\Windows\rundl132.exe ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe File created C:\Windows\Logo1_.exe ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
Logo1_.execa39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exepid process 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe 1664 Logo1_.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exedescription pid process Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Token: SeDebugPrivilege 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exeLogo1_.exenet.execmd.execa39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.execmd.exedescription pid process target process PID 4788 wrote to memory of 5084 4788 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe cmd.exe PID 4788 wrote to memory of 5084 4788 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe cmd.exe PID 4788 wrote to memory of 5084 4788 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe cmd.exe PID 4788 wrote to memory of 1664 4788 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Logo1_.exe PID 4788 wrote to memory of 1664 4788 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Logo1_.exe PID 4788 wrote to memory of 1664 4788 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Logo1_.exe PID 1664 wrote to memory of 2484 1664 Logo1_.exe net.exe PID 1664 wrote to memory of 2484 1664 Logo1_.exe net.exe PID 1664 wrote to memory of 2484 1664 Logo1_.exe net.exe PID 2484 wrote to memory of 4192 2484 net.exe net1.exe PID 2484 wrote to memory of 4192 2484 net.exe net1.exe PID 2484 wrote to memory of 4192 2484 net.exe net1.exe PID 5084 wrote to memory of 1600 5084 cmd.exe ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe PID 5084 wrote to memory of 1600 5084 cmd.exe ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe PID 5084 wrote to memory of 1600 5084 cmd.exe ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe PID 1600 wrote to memory of 784 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe fontdrvhost.exe PID 1600 wrote to memory of 792 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe fontdrvhost.exe PID 1600 wrote to memory of 1020 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe dwm.exe PID 1600 wrote to memory of 2504 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe sihost.exe PID 1600 wrote to memory of 2564 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe svchost.exe PID 1600 wrote to memory of 2692 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe taskhostw.exe PID 1600 wrote to memory of 3460 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Explorer.EXE PID 1600 wrote to memory of 3604 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe svchost.exe PID 1600 wrote to memory of 3792 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe DllHost.exe PID 1600 wrote to memory of 3896 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe StartMenuExperienceHost.exe PID 1600 wrote to memory of 3960 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe RuntimeBroker.exe PID 1600 wrote to memory of 4084 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe SearchApp.exe PID 1600 wrote to memory of 4140 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe RuntimeBroker.exe PID 1600 wrote to memory of 4464 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe RuntimeBroker.exe PID 1600 wrote to memory of 336 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe TextInputHost.exe PID 1600 wrote to memory of 1316 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe backgroundTaskHost.exe PID 1600 wrote to memory of 412 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe backgroundTaskHost.exe PID 1600 wrote to memory of 5084 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe cmd.exe PID 1600 wrote to memory of 5084 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe cmd.exe PID 1600 wrote to memory of 1664 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Logo1_.exe PID 1600 wrote to memory of 1664 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Logo1_.exe PID 1600 wrote to memory of 3016 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Conhost.exe PID 1600 wrote to memory of 828 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe cmd.exe PID 1600 wrote to memory of 828 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe cmd.exe PID 1600 wrote to memory of 828 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe cmd.exe PID 1600 wrote to memory of 828 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe cmd.exe PID 1600 wrote to memory of 828 1600 ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe cmd.exe PID 1664 wrote to memory of 3460 1664 Logo1_.exe Explorer.EXE PID 1664 wrote to memory of 3460 1664 Logo1_.exe Explorer.EXE PID 828 wrote to memory of 4252 828 cmd.exe ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe PID 828 wrote to memory of 4252 828 cmd.exe ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe PID 1664 wrote to memory of 784 1664 Logo1_.exe fontdrvhost.exe PID 1664 wrote to memory of 792 1664 Logo1_.exe fontdrvhost.exe PID 1664 wrote to memory of 1020 1664 Logo1_.exe dwm.exe PID 1664 wrote to memory of 2504 1664 Logo1_.exe sihost.exe PID 1664 wrote to memory of 2564 1664 Logo1_.exe svchost.exe PID 1664 wrote to memory of 2692 1664 Logo1_.exe taskhostw.exe PID 1664 wrote to memory of 3460 1664 Logo1_.exe Explorer.EXE PID 1664 wrote to memory of 3604 1664 Logo1_.exe svchost.exe PID 1664 wrote to memory of 3792 1664 Logo1_.exe DllHost.exe PID 1664 wrote to memory of 3896 1664 Logo1_.exe StartMenuExperienceHost.exe PID 1664 wrote to memory of 3960 1664 Logo1_.exe RuntimeBroker.exe PID 1664 wrote to memory of 4084 1664 Logo1_.exe SearchApp.exe PID 1664 wrote to memory of 4140 1664 Logo1_.exe RuntimeBroker.exe PID 1664 wrote to memory of 4464 1664 Logo1_.exe RuntimeBroker.exe PID 1664 wrote to memory of 336 1664 Logo1_.exe TextInputHost.exe PID 1664 wrote to memory of 1316 1664 Logo1_.exe backgroundTaskHost.exe PID 1664 wrote to memory of 4052 1664 Logo1_.exe RuntimeBroker.exe PID 1664 wrote to memory of 1740 1664 Logo1_.exe RuntimeBroker.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exeLogo1_.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Logo1_.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe"C:\Users\Admin\AppData\Local\Temp\ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7474.bat3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
C:\Users\Admin\AppData\Local\Temp\ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe"C:\Users\Admin\AppData\Local\Temp\ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7733.bat5⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe"C:\Users\Admin\AppData\Local\Temp\ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe"6⤵
- Executes dropped EXE
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exeFilesize
251KB
MD596e1b35794cab7c89ed11aef9fd21231
SHA1f117566e261850b2a7439a644d229ae68917da20
SHA256b3a73fa9b408ee517b0bfe8d54f7ddfa25158dc2a9aa0944b08b11fbcf8b57f3
SHA5126962ac273cce263805f787f1a08584125091c906e9a753023cdc54e20ad3f0d2e63678d6d167e5febbd5a2776360cb1266200fac701bb755a3ee97938c558a16
-
C:\Program Files\7-Zip\7z.exeFilesize
570KB
MD50a3f614ca98af487ca3ef5a04839f899
SHA1ce8766d4812c1ea6ce2ff975ef26e1e0281444c4
SHA256f6c2e0f841e6b825daba7b586552785434dad7e16d9106ab25b0974ab41373a8
SHA512a8e32a071291f1690dff6b0e4f49a236c39ebca195992866159fa4e9518fdd5fb4f390f9645a794efd075e07dbd5fea488248871cb1c31e7c4c22ea45a1ad6fd
-
C:\Users\Admin\AppData\Local\Temp\$$a7474.batFilesize
722B
MD5a8652e96c0d295baf089252886a71864
SHA17b34017ffde6fdeb95d95be7a2c161497b91a6d7
SHA256ca4ed837a0f87833990a42450465902abefdf0f7a18d48cde940bbd18b0dfff2
SHA5120b476432bfda5e88c25e5bd66adcb78fbb438efcec6b00c5c77b88ab06a890755d95f188846c21816e61b9ce4198c4c70b64f3a536b486fa626917538659bdf4
-
C:\Users\Admin\AppData\Local\Temp\$$a7733.batFilesize
722B
MD5d834476c798a33cfce01c39d25989210
SHA139779ad1594d0c0ef5e2f83708817b131aea45d7
SHA25696a7587be32a9c4c06072032b52a85008ab36921f11dca784da13df0376be8cd
SHA512317ceac14913c186b4759b3cfd8574f1520c290fd545b6fdada42348265d26144eea8270875c96b4f0f82c73f3bf57d4e2abe62be0910e6b6a424e5094e63e63
-
C:\Users\Admin\AppData\Local\Temp\ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe.exeFilesize
123KB
MD5545c8eaf76284f3a19868beeb5ed9468
SHA171aa8f38967552840fb0ec45e0ea6586052dd01a
SHA256ff9a0963d54145747422bf112102df5b15cd0d2e6425673590c323c028db481b
SHA5120b873532d9f065e3cfa72af297ccd64df9205e99523c4579508e6a11fa87590d6f19455bf78c8e71f9a332852cfabae64e890899e7b0b41ba87434799ec1b278
-
C:\Users\Admin\AppData\Local\Temp\ca39977d2c63551e523b49bba341434d7bd1de45a5dc78e7102f2854d21f3e95.exe.exeFilesize
149KB
MD560cba5d5d2f3c1b7cc30ea13d7aa3ccf
SHA14dc4de651d6c51d9232d883bab16afc3bb2c9cde
SHA256336bceaf647585452d703c72c3f9ed448f51defebb3c96486ee50563ce6299ab
SHA51201d40229fd8864775eb3632140994286421eea0cf5f2ee510cff4cdfec09df040ba20daa6118ef2b6c9e2d399eac61f7236290dac30d1fdc75f6feeff27dc1e2
-
C:\Windows\Logo1_.exeFilesize
26KB
MD5501e8b69f0c69752427230a1a009466e
SHA196d9e84f26cda2da08e2aa64d3a0a4e01bfa91b1
SHA25648c1b2a71fe3057e59ca81108b97cff0189251c8d98739462bf65e307a7352dd
SHA5121c11f011297000e4a103a2f2732bc47b5f6f4fef9ce746ee519fa7b57a08703bf73ce148b9caa5b20dc104323dda304553b384a2520bda9c6b5f3fce79be7656
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5c31e61576d891d6018087ba424ae7a20
SHA1e480d11f6ee415e88df02817bffe06dd0eb5fc66
SHA2568aff215b2b3ae03355942d16293aa6815d58c6a41c4c804b817feee38da8329e
SHA51223dfcb0fe88ff1a7e0d2f9a8d54346bbd9e2ae3a7344a45446d9b077f039c1129bad1d5dc0010c3157ab757dd6f840f472f35f2f9d198d0ec4d6379bef69f5a0
-
C:\Windows\rundl132.exeFilesize
26KB
MD53b569dd590fe54c93c348668d5a6485b
SHA1ca3f84814c40aede97e456b732310f84c073e70d
SHA2565ad5ec797c8d0a90d3f18f41e0f15871f083300681478402e6814021af53eaed
SHA5127313b0cb51367225e001fddd50b23b06f908a36a0c5bffe4dc2d153fd778dcfc18b1a32437d726182dcc0819fbabba5c64749aab33ca7af12352a7d43f7f8369
-
C:\fwgb.pifFilesize
100KB
MD56b9074c9251a04b3ec576e9012f464bc
SHA100f918eb39d847955b3202d32e35eb2963ca6a6c
SHA256aef1c9ea2a1874b61f5f4e84b034512c88c8ec7c751c956d35674514ec4fcad5
SHA512a334e2c5686439c684b34d34a9e4e1578dcc68684d1f2065e11736430469d1b1ce9b45c19d1569857e9b31467575098a6c4421c297fd584c4abe2b069e9281f0
-
F:\$RECYCLE.BIN\S-1-5-21-2539840389-1261165778-1087677076-1000\_desktop.iniFilesize
9B
MD51d8a3f28a10f9f8be912b9aa0d257c6f
SHA1358ca1e31914fb991e009c945a40796cf465bb50
SHA2563887316b3cbbf3fa224813b5883e0ee043c8422d4f72d4ebdf0ae8a195b40d3e
SHA512b1ec3f07af4abcdc007ab43a9e685419176d74a6856df9be9085f5bc33178b91b30fc44667fd083d2aa818483b4ea216920fa479ebb277325c7b1e5d7a8caec1
-
memory/828-54-0x0000000000B40000-0x0000000000B42000-memory.dmpFilesize
8KB
-
memory/828-38-0x0000000000B90000-0x0000000000B91000-memory.dmpFilesize
4KB
-
memory/828-51-0x0000000000B40000-0x0000000000B42000-memory.dmpFilesize
8KB
-
memory/1600-36-0x0000000000760000-0x0000000000761000-memory.dmpFilesize
4KB
-
memory/1600-23-0x00000000008D0000-0x000000000195E000-memory.dmpFilesize
16.6MB
-
memory/1600-20-0x00000000008D0000-0x000000000195E000-memory.dmpFilesize
16.6MB
-
memory/1600-22-0x00000000008D0000-0x000000000195E000-memory.dmpFilesize
16.6MB
-
memory/1600-24-0x00000000008D0000-0x000000000195E000-memory.dmpFilesize
16.6MB
-
memory/1600-40-0x00000000008D0000-0x000000000195E000-memory.dmpFilesize
16.6MB
-
memory/1600-44-0x00000000008D0000-0x000000000195E000-memory.dmpFilesize
16.6MB
-
memory/1600-19-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1600-49-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1664-39-0x00000000005A0000-0x00000000005A2000-memory.dmpFilesize
8KB
-
memory/1664-76-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-11-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1664-141-0x00000000005A0000-0x00000000005A2000-memory.dmpFilesize
8KB
-
memory/1664-33-0x00000000005A0000-0x00000000005A2000-memory.dmpFilesize
8KB
-
memory/1664-34-0x00000000005B0000-0x00000000005B1000-memory.dmpFilesize
4KB
-
memory/1664-64-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-67-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-68-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-72-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-71-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-69-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-66-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-70-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-73-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-74-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1664-75-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-102-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-77-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-78-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-79-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-81-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-82-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-100-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-89-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-91-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1664-92-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-93-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-94-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/1664-96-0x00000000033F0000-0x000000000447E000-memory.dmpFilesize
16.6MB
-
memory/4788-0-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/4788-9-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/5084-50-0x00000000014A0000-0x00000000014A2000-memory.dmpFilesize
8KB
-
memory/5084-53-0x00000000014A0000-0x00000000014A2000-memory.dmpFilesize
8KB
-
memory/5084-31-0x0000000001940000-0x0000000001941000-memory.dmpFilesize
4KB
-
memory/5084-30-0x00000000014A0000-0x00000000014A2000-memory.dmpFilesize
8KB