Analysis
-
max time kernel
25s -
max time network
66s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 23:39
Static task
static1
Behavioral task
behavioral1
Sample
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe
Resource
win7-20240419-en
General
-
Target
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe
-
Size
132KB
-
MD5
6e61786732b6f48298ece472af802c25
-
SHA1
89a1e36c6e7451081cca20351c2aac9c4c2672f8
-
SHA256
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe
-
SHA512
1aa19e7c6cc18e653653ec5efd0ca86b045ff38efd4c92b89ba071cdf9434704d31278b7df922790a2242640e5ddfbec95e14d2f76613702bf73a5f95d99a220
-
SSDEEP
1536:DJf83W8W60IL26Ap8iJySzlme3pUy3TDq+NcawHbNBleOD6MlSoUljObrEF8EX4n:DJCD548iJHxfq+Ncaw3fuOUhPm+N
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeFun.exeSVIQ.EXEdc.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" Fun.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" SVIQ.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe C:\\Windows\\system32\\WinSit.exe" dc.exe -
Modifies firewall policy service 2 TTPs 6 IoCs
Processes:
Fun.exe80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" Fun.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" Fun.exe -
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeFun.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Fun.exe -
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeFun.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Fun.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 22 IoCs
Processes:
resource yara_rule behavioral1/memory/1784-5-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-26-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-27-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-25-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-23-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-24-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-28-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-29-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-6-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-55-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-56-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-87-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-132-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-131-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-134-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/1784-137-0x0000000002680000-0x000000000370E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2744-152-0x0000000004DD0000-0x0000000005E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2744-156-0x0000000004DD0000-0x0000000005E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2744-155-0x0000000004DD0000-0x0000000005E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2744-158-0x0000000004DD0000-0x0000000005E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2744-272-0x0000000004DD0000-0x0000000005E5E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine C:\dkex.pif INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 23 IoCs
Processes:
resource yara_rule behavioral1/memory/1784-5-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-26-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-27-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-25-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-23-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-24-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-28-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-29-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-6-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-55-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-56-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/2908-86-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral1/memory/1784-87-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-132-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-131-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-134-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-137-0x0000000002680000-0x000000000370E000-memory.dmp UPX behavioral1/memory/1784-151-0x0000000000400000-0x0000000000421000-memory.dmp UPX behavioral1/memory/2744-152-0x0000000004DD0000-0x0000000005E5E000-memory.dmp UPX behavioral1/memory/2744-156-0x0000000004DD0000-0x0000000005E5E000-memory.dmp UPX behavioral1/memory/2744-155-0x0000000004DD0000-0x0000000005E5E000-memory.dmp UPX behavioral1/memory/2744-158-0x0000000004DD0000-0x0000000005E5E000-memory.dmp UPX behavioral1/memory/2744-272-0x0000000004DD0000-0x0000000005E5E000-memory.dmp UPX -
Deletes itself 1 IoCs
Processes:
Fun.exepid process 2744 Fun.exe -
Executes dropped EXE 3 IoCs
Processes:
Fun.exeSVIQ.EXEdc.exepid process 2744 Fun.exe 2908 SVIQ.EXE 1644 dc.exe -
Loads dropped DLL 2 IoCs
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exepid process 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe -
Processes:
resource yara_rule behavioral1/memory/1784-5-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-26-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-27-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-25-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-23-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-24-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-28-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-29-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-6-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-55-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-56-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-87-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-132-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-131-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-134-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/1784-137-0x0000000002680000-0x000000000370E000-memory.dmp upx behavioral1/memory/2744-152-0x0000000004DD0000-0x0000000005E5E000-memory.dmp upx behavioral1/memory/2744-156-0x0000000004DD0000-0x0000000005E5E000-memory.dmp upx behavioral1/memory/2744-155-0x0000000004DD0000-0x0000000005E5E000-memory.dmp upx behavioral1/memory/2744-158-0x0000000004DD0000-0x0000000005E5E000-memory.dmp upx behavioral1/memory/2744-272-0x0000000004DD0000-0x0000000005E5E000-memory.dmp upx -
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeFun.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" Fun.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" Fun.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc Fun.exe -
Adds Run key to start application 2 TTPs 12 IoCs
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeSVIQ.EXEdc.exeFun.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" dc.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc = "C:\\Windows\\dc.exe" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" Fun.exe Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\dc2k5 = "C:\\Windows\\SVIQ.EXE" SVIQ.EXE Set value (str) \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fun = "C:\\Windows\\system\\Fun.exe" Fun.exe -
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeFun.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Fun.exe -
Enumerates connected drives 3 TTPs 9 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeFun.exedescription ioc process File opened (read-only) \??\E: 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened (read-only) \??\G: Fun.exe File opened (read-only) \??\J: Fun.exe File opened (read-only) \??\K: Fun.exe File opened (read-only) \??\L: Fun.exe File opened (read-only) \??\M: Fun.exe File opened (read-only) \??\E: Fun.exe File opened (read-only) \??\H: Fun.exe File opened (read-only) \??\I: Fun.exe -
Drops file in System32 directory 10 IoCs
Processes:
SVIQ.EXEdc.exe80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeFun.exedescription ioc process File opened for modification C:\Windows\SysWOW64\WinSit.exe SVIQ.EXE File opened for modification C:\Windows\SysWOW64\config\Win.exe SVIQ.EXE File opened for modification C:\Windows\SysWOW64\config\Win.exe dc.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File created C:\Windows\SysWOW64\config\Win.exe 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe Fun.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe dc.exe File created C:\Windows\SysWOW64\WinSit.exe 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened for modification C:\Windows\SysWOW64\config\Win.exe 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened for modification C:\Windows\SysWOW64\WinSit.exe Fun.exe -
Drops file in Windows directory 35 IoCs
Processes:
dc.exe80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeSVIQ.EXEFun.exedescription ioc process File created C:\Windows\SVIQ.EXE dc.exe File opened for modification C:\Windows\system\Fun.exe 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened for modification C:\Windows\dc.exe 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File created C:\Windows\system\Fun.exe dc.exe File opened for modification C:\Windows\dc.exe SVIQ.EXE File created C:\Windows\dc.exe dc.exe File opened for modification C:\Windows\Help\Other.exe dc.exe File opened for modification C:\Windows\SVIQ.exe SVIQ.EXE File opened for modification C:\Windows\dc.exe Fun.exe File opened for modification C:\Windows\SVIQ.EXE Fun.exe File created C:\Windows\system\Fun.exe SVIQ.EXE File opened for modification C:\Windows\Help\Other.exe SVIQ.EXE File opened for modification C:\Windows\wininit.ini SVIQ.EXE File created C:\Windows\SVIQ.EXE 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened for modification C:\Windows\wininit.ini 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened for modification C:\Windows\wininit.ini Fun.exe File created C:\Windows\SVIQ.EXE SVIQ.EXE File opened for modification C:\Windows\inf\Other.exe SVIQ.EXE File opened for modification C:\Windows\system\Fun.exe SVIQ.EXE File opened for modification C:\Windows\dc.exe dc.exe File created C:\Windows\dc.exe 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened for modification C:\Windows\inf\Other.exe 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File created C:\Windows\Help\Other.exe 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened for modification C:\Windows\system\Fun.exe dc.exe File created C:\Windows\inf\Other.exe 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened for modification C:\Windows\Help\Other.exe 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened for modification C:\Windows\Help\Other.exe Fun.exe File opened for modification C:\Windows\wininit.ini dc.exe File created C:\Windows\system\Fun.exe 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened for modification C:\Windows\inf\Other.exe Fun.exe File opened for modification C:\Windows\inf\Other.exe dc.exe File opened for modification C:\Windows\SVIQ.EXE 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File created C:\Windows\system\Fun.exe Fun.exe File opened for modification C:\Windows\SYSTEM.INI 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe File opened for modification C:\Windows\system\Fun.exe Fun.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeFun.exeSVIQ.EXEdc.exepid process 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe 2744 Fun.exe 2908 SVIQ.EXE 1644 dc.exe 2744 Fun.exe 2908 SVIQ.EXE 1644 dc.exe 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe 2908 SVIQ.EXE 2744 Fun.exe 1644 dc.exe 2908 SVIQ.EXE 2744 Fun.exe 1644 dc.exe 2908 SVIQ.EXE 2744 Fun.exe 2744 Fun.exe 1644 dc.exe 2908 SVIQ.EXE 2744 Fun.exe 1644 dc.exe 2908 SVIQ.EXE 1644 dc.exe 2744 Fun.exe 2908 SVIQ.EXE 2744 Fun.exe 1644 dc.exe 2908 SVIQ.EXE 1644 dc.exe 2744 Fun.exe 2908 SVIQ.EXE 2744 Fun.exe 2744 Fun.exe 1644 dc.exe 2908 SVIQ.EXE -
Suspicious use of AdjustPrivilegeToken 42 IoCs
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeFun.exedescription pid process Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe Token: SeDebugPrivilege 2744 Fun.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeFun.exeSVIQ.EXEdc.exepid process 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe 2744 Fun.exe 2744 Fun.exe 2908 SVIQ.EXE 2908 SVIQ.EXE 1644 dc.exe 1644 dc.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeFun.exedescription pid process target process PID 1784 wrote to memory of 1084 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe taskhost.exe PID 1784 wrote to memory of 1152 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Dwm.exe PID 1784 wrote to memory of 1200 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Explorer.EXE PID 1784 wrote to memory of 1668 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe DllHost.exe PID 1784 wrote to memory of 2744 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Fun.exe PID 1784 wrote to memory of 2744 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Fun.exe PID 1784 wrote to memory of 2744 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Fun.exe PID 1784 wrote to memory of 2744 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Fun.exe PID 2744 wrote to memory of 2908 2744 Fun.exe SVIQ.EXE PID 2744 wrote to memory of 2908 2744 Fun.exe SVIQ.EXE PID 2744 wrote to memory of 2908 2744 Fun.exe SVIQ.EXE PID 2744 wrote to memory of 2908 2744 Fun.exe SVIQ.EXE PID 1784 wrote to memory of 1644 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe dc.exe PID 1784 wrote to memory of 1644 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe dc.exe PID 1784 wrote to memory of 1644 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe dc.exe PID 1784 wrote to memory of 1644 1784 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe dc.exe PID 2744 wrote to memory of 1084 2744 Fun.exe taskhost.exe PID 2744 wrote to memory of 1152 2744 Fun.exe Dwm.exe PID 2744 wrote to memory of 1200 2744 Fun.exe Explorer.EXE PID 2744 wrote to memory of 2908 2744 Fun.exe SVIQ.EXE PID 2744 wrote to memory of 2908 2744 Fun.exe SVIQ.EXE PID 2744 wrote to memory of 1644 2744 Fun.exe dc.exe PID 2744 wrote to memory of 1644 2744 Fun.exe dc.exe PID 2744 wrote to memory of 2108 2744 Fun.exe DllHost.exe PID 2744 wrote to memory of 2208 2744 Fun.exe DllHost.exe PID 2744 wrote to memory of 1084 2744 Fun.exe taskhost.exe PID 2744 wrote to memory of 1152 2744 Fun.exe Dwm.exe PID 2744 wrote to memory of 1200 2744 Fun.exe Explorer.EXE PID 2744 wrote to memory of 2108 2744 Fun.exe DllHost.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exeFun.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Fun.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe"C:\Users\Admin\AppData\Local\Temp\80376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe.exe"2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system\Fun.exeC:\Windows\system\Fun.exe3⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Deletes itself
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SVIQ.EXEC:\Windows\SVIQ.EXE4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\dc.exeC:\Windows\dc.exe3⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
7Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SVIQ.EXEFilesize
132KB
MD56e61786732b6f48298ece472af802c25
SHA189a1e36c6e7451081cca20351c2aac9c4c2672f8
SHA25680376c647b3d54978f26072d5b1699ce3384d50bb9bfd9c9c9656364084fcbfe
SHA5121aa19e7c6cc18e653653ec5efd0ca86b045ff38efd4c92b89ba071cdf9434704d31278b7df922790a2242640e5ddfbec95e14d2f76613702bf73a5f95d99a220
-
C:\Windows\SYSTEM.INIFilesize
257B
MD5d88190b7bc08def9ef27d78b5879cdb5
SHA143cc217ef2e5b6777319dbc9830c4b3b62c18a03
SHA256e12c71bc3b4f41fae355d87f0da8e52ebcc6433da01398cb5d9401adc7eb7bab
SHA512ec1c85e03d9cb68ad26fb10df638e9239bb5e6adb8217bad74e8cec21462aade7902ccbf0c49b4706511ef25f4de2064709475841b50798533c1094ab6eb6e16
-
C:\Windows\wininit.iniFilesize
41B
MD5e839977c0d22c9aa497b0b1d90d8a372
SHA1b5048e501399138796b38f3d3666e1a88c397e83
SHA256478db7f82fd7ef4860f7acd2f534ec303175500d7f4e1e36161d31c900d234e2
SHA5124c8ba5a26b6f738f8d25c32d019cee63e9a32d28e3aeb8fe31b965d7603c24a3539e469c8eb569747b47dadc9c43cdd1066ddb37ed8138bee5d0c74b5d0c275d
-
C:\dkex.pifFilesize
100KB
MD5e466b05afc9c94b869a5fb3ea500e997
SHA1e6a99b97f8808451c34ddb543e83bea0836d3f5d
SHA256401f766d355ccee537b266ead8496d78eb0840abe2ed052569704d2f8c3cc15c
SHA5127f68eddfebbba96f3709f56623d6b9c3940a53e92f41e69d79127382471508ab1e58abb8d2b4ebb736f2e016e378b5ccdc0c607b6f3bc37697ba474fbbc56945
-
memory/1084-30-0x00000000003D0000-0x00000000003D2000-memory.dmpFilesize
8KB
-
memory/1644-113-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1784-56-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-87-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-24-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-42-0x0000000001E90000-0x0000000001E92000-memory.dmpFilesize
8KB
-
memory/1784-43-0x0000000001E90000-0x0000000001E92000-memory.dmpFilesize
8KB
-
memory/1784-41-0x00000000037D0000-0x00000000037D1000-memory.dmpFilesize
4KB
-
memory/1784-39-0x00000000037D0000-0x00000000037D1000-memory.dmpFilesize
4KB
-
memory/1784-38-0x0000000001E90000-0x0000000001E92000-memory.dmpFilesize
8KB
-
memory/1784-28-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-29-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-6-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-54-0x0000000003AA0000-0x0000000003AC1000-memory.dmpFilesize
132KB
-
memory/1784-53-0x0000000003AA0000-0x0000000003AC1000-memory.dmpFilesize
132KB
-
memory/1784-55-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-0-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1784-25-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-5-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-23-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-27-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-112-0x0000000003AA0000-0x0000000003AC1000-memory.dmpFilesize
132KB
-
memory/1784-110-0x0000000003AA0000-0x0000000003AC1000-memory.dmpFilesize
132KB
-
memory/1784-132-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-131-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-134-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-137-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/1784-151-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB
-
memory/1784-26-0x0000000002680000-0x000000000370E000-memory.dmpFilesize
16.6MB
-
memory/2744-152-0x0000000004DD0000-0x0000000005E5E000-memory.dmpFilesize
16.6MB
-
memory/2744-156-0x0000000004DD0000-0x0000000005E5E000-memory.dmpFilesize
16.6MB
-
memory/2744-155-0x0000000004DD0000-0x0000000005E5E000-memory.dmpFilesize
16.6MB
-
memory/2744-158-0x0000000004DD0000-0x0000000005E5E000-memory.dmpFilesize
16.6MB
-
memory/2744-170-0x0000000003A40000-0x0000000003A41000-memory.dmpFilesize
4KB
-
memory/2744-272-0x0000000004DD0000-0x0000000005E5E000-memory.dmpFilesize
16.6MB
-
memory/2908-86-0x0000000000400000-0x0000000000421000-memory.dmpFilesize
132KB