Analysis
-
max time kernel
124s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 15:24
Static task
static1
Behavioral task
behavioral1
Sample
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe
Resource
win7-20240508-en
General
-
Target
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe
-
Size
1.4MB
-
MD5
fbeee5ec65c41926fb2ee90689cdf197
-
SHA1
4f45be900224707267f1b7fabe5f06ca03342c75
-
SHA256
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec
-
SHA512
20e2a65918899aafc2c627dca7c71f2ab4b9163d1d1823296b8541da7ec562dfe23b493e0227d9c2ec59f02edcea7f166c825030f70e2d942f47c44b101f93cd
-
SSDEEP
24576:f054Fqg5+0k/x+5hRoxlOM7TEBI8n9kZoEayE4bo+saKEUblbxVzrnv:84zX8L3nIi8RE1sFa0NxVzTv
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe -
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe -
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe -
Processes:
resource yara_rule behavioral2/memory/2116-3-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-4-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-17-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-7-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-16-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-18-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-8-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-6-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-5-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-1-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-20-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-22-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-23-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-24-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-25-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-26-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-28-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-29-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-30-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-32-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-33-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-35-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-37-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-40-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-42-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-44-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-46-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-48-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-50-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-52-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-59-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-61-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-63-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-66-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-67-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-70-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-72-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-74-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/2116-78-0x00000000023C0000-0x000000000347A000-memory.dmp upx -
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe -
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exedescription ioc process File opened (read-only) \??\M: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\Q: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\S: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\W: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\Z: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\X: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\E: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\G: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\I: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\J: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\T: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\U: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\V: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\N: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\P: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\Y: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\H: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\K: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\L: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\O: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened (read-only) \??\R: 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exedescription ioc process File opened for modification C:\autorun.inf 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification F:\autorun.inf 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe -
Drops file in Program Files directory 12 IoCs
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exedescription ioc process File opened for modification C:\Program Files\7-Zip\7zG.exe 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification C:\Program Files\7-Zip\7z.exe 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe -
Drops file in Windows directory 2 IoCs
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exedescription ioc process File created C:\Windows\e572ff9 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe File opened for modification C:\Windows\SYSTEM.INI 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exepid process 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exedescription pid process Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Token: SeDebugPrivilege 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exedescription pid process target process PID 2116 wrote to memory of 784 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe fontdrvhost.exe PID 2116 wrote to memory of 792 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe fontdrvhost.exe PID 2116 wrote to memory of 316 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe dwm.exe PID 2116 wrote to memory of 2412 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe sihost.exe PID 2116 wrote to memory of 2436 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe svchost.exe PID 2116 wrote to memory of 2552 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe taskhostw.exe PID 2116 wrote to memory of 3360 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Explorer.EXE PID 2116 wrote to memory of 3556 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe svchost.exe PID 2116 wrote to memory of 3764 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe DllHost.exe PID 2116 wrote to memory of 3852 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe StartMenuExperienceHost.exe PID 2116 wrote to memory of 3916 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 4004 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe SearchApp.exe PID 2116 wrote to memory of 4148 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 4316 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 1028 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe TextInputHost.exe PID 2116 wrote to memory of 1036 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe backgroundTaskHost.exe PID 2116 wrote to memory of 4728 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe backgroundTaskHost.exe PID 2116 wrote to memory of 784 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe fontdrvhost.exe PID 2116 wrote to memory of 792 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe fontdrvhost.exe PID 2116 wrote to memory of 316 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe dwm.exe PID 2116 wrote to memory of 2412 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe sihost.exe PID 2116 wrote to memory of 2436 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe svchost.exe PID 2116 wrote to memory of 2552 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe taskhostw.exe PID 2116 wrote to memory of 3360 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Explorer.EXE PID 2116 wrote to memory of 3556 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe svchost.exe PID 2116 wrote to memory of 3764 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe DllHost.exe PID 2116 wrote to memory of 3852 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe StartMenuExperienceHost.exe PID 2116 wrote to memory of 3916 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 4004 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe SearchApp.exe PID 2116 wrote to memory of 4148 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 4316 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 1028 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe TextInputHost.exe PID 2116 wrote to memory of 1036 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe backgroundTaskHost.exe PID 2116 wrote to memory of 932 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 4116 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 784 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe fontdrvhost.exe PID 2116 wrote to memory of 792 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe fontdrvhost.exe PID 2116 wrote to memory of 316 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe dwm.exe PID 2116 wrote to memory of 2412 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe sihost.exe PID 2116 wrote to memory of 2436 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe svchost.exe PID 2116 wrote to memory of 2552 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe taskhostw.exe PID 2116 wrote to memory of 3360 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Explorer.EXE PID 2116 wrote to memory of 3556 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe svchost.exe PID 2116 wrote to memory of 3764 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe DllHost.exe PID 2116 wrote to memory of 3852 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe StartMenuExperienceHost.exe PID 2116 wrote to memory of 3916 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 4004 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe SearchApp.exe PID 2116 wrote to memory of 4148 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 4316 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 1028 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe TextInputHost.exe PID 2116 wrote to memory of 1036 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe backgroundTaskHost.exe PID 2116 wrote to memory of 932 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 4116 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe PID 2116 wrote to memory of 784 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe fontdrvhost.exe PID 2116 wrote to memory of 792 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe fontdrvhost.exe PID 2116 wrote to memory of 316 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe dwm.exe PID 2116 wrote to memory of 2412 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe sihost.exe PID 2116 wrote to memory of 2436 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe svchost.exe PID 2116 wrote to memory of 2552 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe taskhostw.exe PID 2116 wrote to memory of 3360 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe Explorer.EXE PID 2116 wrote to memory of 3556 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe svchost.exe PID 2116 wrote to memory of 3764 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe DllHost.exe PID 2116 wrote to memory of 3852 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe StartMenuExperienceHost.exe PID 2116 wrote to memory of 3916 2116 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe RuntimeBroker.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:784
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:316
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2436
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2552
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe"C:\Users\Admin\AppData\Local\Temp\33990df4791544c6900217208b5f4168782df5927f3e982c67a800c3e74a4cec.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2116
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3556
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3764
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3852
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3916
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4004
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4148
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4316
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:1028
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:1036
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:4728
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:932
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4116
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3788
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵PID:4408
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\aghkqv.pifFilesize
97KB
MD5940dd7d7fb4ee98a8f00d16789dc1042
SHA1191217c9f2eb943ab08ed481ec3bde8664ba5a80
SHA256f8ba68ba65ab278b84d4544c977ceb3e92056c7a5d41d48baa21d0a5314511f8
SHA5127bcbe40b855b8215a447600d1ba8d734f2bbdbccae70db0442104baf8a1233022dc542f9ec6f6b8792dae9eb98b81377f159107edd30c0415720edc99912af04
-
memory/2116-29-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-78-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-17-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-30-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-16-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-18-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-21-0x0000000004050000-0x0000000004052000-memory.dmpFilesize
8KB
-
memory/2116-8-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-6-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-5-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-10-0x00000000041A0000-0x00000000041A1000-memory.dmpFilesize
4KB
-
memory/2116-9-0x0000000004050000-0x0000000004052000-memory.dmpFilesize
8KB
-
memory/2116-19-0x0000000004050000-0x0000000004052000-memory.dmpFilesize
8KB
-
memory/2116-1-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-20-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-22-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-23-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-33-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-25-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-26-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-28-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-0-0x0000000000400000-0x0000000000572000-memory.dmpFilesize
1.4MB
-
memory/2116-7-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-4-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-24-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-35-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-37-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-40-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-42-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-44-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-46-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-48-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-50-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-52-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-59-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-61-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-63-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-66-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-67-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-69-0x0000000004050000-0x0000000004052000-memory.dmpFilesize
8KB
-
memory/2116-70-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-72-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-74-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-32-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB
-
memory/2116-3-0x00000000023C0000-0x000000000347A000-memory.dmpFilesize
16.7MB