Analysis
-
max time kernel
15s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 00:09
Static task
static1
Behavioral task
behavioral1
Sample
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe
Resource
win7-20240419-en
General
-
Target
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe
-
Size
65KB
-
MD5
37bb1404357349a46631b9c7d9a6fde2
-
SHA1
0dfd6e77ab3430c94fe79e97a61093c85d0805d1
-
SHA256
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e
-
SHA512
2a213b3fbc41e4633b20b7787654df5b6b0e1ea0e248a3d63151686d7151aa43064959eadb3e05a20cf3d228409cdfc60ba967a098efd0ab7d26fc134102c07d
-
SSDEEP
1536:QA73qRaMo1QFFoeakdTVzlTsHOJVurAExJavcql6RfE3M:6R5oiFFZaUTVzdsEurXWJl6R/
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Signatures
-
Modifies firewall policy service 3 TTPs 3 IoCs
Processes:
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe -
Processes:
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe -
Processes:
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe -
Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 38 IoCs
Processes:
resource yara_rule behavioral2/memory/3040-2-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-4-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-8-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-12-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-11-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-10-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-9-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-7-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-5-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-6-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-22-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-23-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-24-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-25-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-26-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-28-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-29-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-30-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-32-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-34-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-37-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-40-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-42-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-44-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-45-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-47-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-49-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-53-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-52-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-57-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-58-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-60-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-62-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-63-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-64-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-72-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-71-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3040-75-0x0000000000790000-0x000000000184A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine -
UPX dump on OEP (original entry point) 38 IoCs
Processes:
resource yara_rule behavioral2/memory/3040-2-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-4-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-8-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-12-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-11-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-10-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-9-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-7-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-5-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-6-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-22-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-23-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-24-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-25-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-26-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-28-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-29-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-30-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-32-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-34-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-37-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-40-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-42-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-44-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-45-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-47-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-49-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-53-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-52-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-57-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-58-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-60-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-62-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-63-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-64-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-72-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-71-0x0000000000790000-0x000000000184A000-memory.dmp UPX behavioral2/memory/3040-75-0x0000000000790000-0x000000000184A000-memory.dmp UPX -
Processes:
resource yara_rule behavioral2/memory/3040-2-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-4-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-8-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-12-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-11-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-10-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-9-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-7-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-5-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-6-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-22-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-23-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-24-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-25-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-26-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-28-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-29-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-30-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-32-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-34-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-37-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-40-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-42-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-44-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-45-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-47-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-49-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-53-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-52-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-57-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-58-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-60-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-62-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-63-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-64-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-72-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-71-0x0000000000790000-0x000000000184A000-memory.dmp upx behavioral2/memory/3040-75-0x0000000000790000-0x000000000184A000-memory.dmp upx -
Processes:
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe -
Processes:
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe -
Enumerates connected drives 3 TTPs 5 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exedescription ioc process File opened (read-only) \??\E: 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe File opened (read-only) \??\G: 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe File opened (read-only) \??\H: 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe File opened (read-only) \??\I: 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe File opened (read-only) \??\J: 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe -
Drops file in Windows directory 2 IoCs
Processes:
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exedescription ioc process File created C:\Windows\e58079c 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe File opened for modification C:\Windows\SYSTEM.INI 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
Processes:
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exepid process 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exedescription pid process Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Token: SeDebugPrivilege 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exedescription pid process target process PID 3040 wrote to memory of 800 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe fontdrvhost.exe PID 3040 wrote to memory of 804 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe fontdrvhost.exe PID 3040 wrote to memory of 384 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe dwm.exe PID 3040 wrote to memory of 2432 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe sihost.exe PID 3040 wrote to memory of 2444 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe svchost.exe PID 3040 wrote to memory of 2572 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe taskhostw.exe PID 3040 wrote to memory of 3196 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe Explorer.EXE PID 3040 wrote to memory of 3484 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe svchost.exe PID 3040 wrote to memory of 3736 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe DllHost.exe PID 3040 wrote to memory of 3828 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe StartMenuExperienceHost.exe PID 3040 wrote to memory of 3928 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe RuntimeBroker.exe PID 3040 wrote to memory of 4028 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe SearchApp.exe PID 3040 wrote to memory of 3612 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe RuntimeBroker.exe PID 3040 wrote to memory of 4624 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe RuntimeBroker.exe PID 3040 wrote to memory of 3668 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe TextInputHost.exe PID 3040 wrote to memory of 2868 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe RuntimeBroker.exe PID 3040 wrote to memory of 1592 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe msedge.exe PID 3040 wrote to memory of 4604 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe msedge.exe PID 3040 wrote to memory of 3172 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe msedge.exe PID 3040 wrote to memory of 3580 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe msedge.exe PID 3040 wrote to memory of 920 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe msedge.exe PID 3040 wrote to memory of 5620 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe msedge.exe PID 3040 wrote to memory of 5636 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe msedge.exe PID 3040 wrote to memory of 800 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe fontdrvhost.exe PID 3040 wrote to memory of 804 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe fontdrvhost.exe PID 3040 wrote to memory of 384 3040 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe dwm.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe"C:\Users\Admin\AppData\Local\Temp\8f1586eba6894a71207b8465541e5486ff38c70cb3ef04ec748aa7fce78bf94e.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd7c282e98,0x7ffd7c282ea4,0x7ffd7c282eb02⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2276 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2340 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:32⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2520 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5312 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5568 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3100 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:82⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Modify Registry
5Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFilesize
3.9MB
MD5faf79a48399d502194e87a5ad1ba7b8e
SHA109cd9d783ac126d33ec37de781beedce9ce6aa51
SHA2563d1266025af95bdb7b92d17debbf88a1386b19b7f7c2eeb9ced77debb9748e14
SHA512d84f8e25179e2cee6f95dc95c94a4a70dc56814aaf7f95e38f24f9828e64629cab0c184f5fddd67d834f419703f65d9d0e3a93e54d2730ed63d3d89644babb84
-
C:\miutiv.exeFilesize
97KB
MD506fbe85bd004690233543dd64c7034d7
SHA14449032a04c60b6ec578e981e320bf5f58abbcb4
SHA256fc3cfd6ba959714fd259e180c043ece823f73ca92fdeb7cf17979f8dde52fa82
SHA512ed3e9d2c0670bb6c8b5fa1171f28472d536a900f68da6c4ab9cfdd5db4b556466692fce37281ac5e7f2af8a190322cd01dd3d09cbd94dd0769e1109610f517f4
-
memory/3040-30-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-12-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-18-0x00000000039B0000-0x00000000039B2000-memory.dmpFilesize
8KB
-
memory/3040-32-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-20-0x00000000039B0000-0x00000000039B2000-memory.dmpFilesize
8KB
-
memory/3040-21-0x00000000039B0000-0x00000000039B2000-memory.dmpFilesize
8KB
-
memory/3040-11-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-19-0x0000000004000000-0x0000000004001000-memory.dmpFilesize
4KB
-
memory/3040-10-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-9-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-0-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/3040-5-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-34-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-22-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-23-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-24-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-25-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-26-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-28-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-29-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-7-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-8-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-6-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-37-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-40-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-42-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-44-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-45-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-47-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-49-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-53-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-52-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-57-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-58-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-60-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-62-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-63-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-64-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-72-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-71-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-75-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-78-0x00000000039B0000-0x00000000039B2000-memory.dmpFilesize
8KB
-
memory/3040-4-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB
-
memory/3040-2-0x0000000000790000-0x000000000184A000-memory.dmpFilesize
16.7MB