Analysis
-
max time kernel
123s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
23-04-2024 02:18
Static task
static1
Behavioral task
behavioral1
Sample
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe
Resource
win7-20240215-en
General
-
Target
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe
-
Size
2.0MB
-
MD5
f41ad1e9b99154dc5cc1b562c2166ca2
-
SHA1
3de885cc21dfa13fea14cb9d73bab6b09fb2b889
-
SHA256
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b
-
SHA512
49d5ac77e9186b72067c28d6974d0aa1b82b20dc78913296876e04e0e8ced17336600b8b3bd8192053d940202af9feb732b4a38e3006ccafa6fb4856d7147960
-
SSDEEP
49152:47sM3dbEnmZgJH6iADNsNn/3JQErFu/fEHHhF/poL9WpTo5pp9P:hOdbEnMgJaB5mn/3JQf/snXpi9WpToZt
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe -
Processes:
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe -
Processes:
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2112 cmd.exe -
Executes dropped EXE 2 IoCs
Processes:
Logo1_.exe7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exepid process 2860 Logo1_.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exepid process 2112 cmd.exe 2112 cmd.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe.exe upx behavioral1/memory/2544-30-0x0000000000400000-0x00000000006E5000-memory.dmp upx behavioral1/memory/2544-31-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-33-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-34-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-35-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-36-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-37-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-38-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-39-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-40-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-41-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-42-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-75-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-76-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-77-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-79-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-80-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-81-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-83-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-85-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-87-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-90-0x0000000000400000-0x00000000006E5000-memory.dmp upx behavioral1/memory/2544-96-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-98-0x00000000022E0000-0x000000000336E000-memory.dmp upx behavioral1/memory/2544-128-0x00000000022E0000-0x000000000336E000-memory.dmp upx -
Processes:
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe -
Processes:
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe -
Enumerates connected drives 3 TTPs 39 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Logo1_.exe7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exedescription ioc process File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\K: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\G: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\N: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\Q: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\N: Logo1_.exe File opened (read-only) \??\E: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\H: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\I: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\L: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\T: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\X: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\S: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\O: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\P: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\U: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\W: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\M: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\V: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\Y: 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\I: Logo1_.exe -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exedescription ioc process File opened for modification C:\autorun.inf 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened for modification F:\autorun.inf 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Logo1_.exedescription ioc process File created C:\Program Files (x86)\Microsoft SQL Server Compact Edition\v3.5\Desktop\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\Accessories\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lg\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe Logo1_.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Hearts\it-IT\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Minesweeper\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\RedistList\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe Logo1_.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\logger\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\js\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BOLDSTRI\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\css\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1036\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mn\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Chess\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_output\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows NT\TableTextService\it-IT\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\_desktop.ini Logo1_.exe File created C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Mail\es-ES\_desktop.ini Logo1_.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\STARTUP\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Mahjong\en-US\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ko\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Games\Multiplayer\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\fonts\_desktop.ini Logo1_.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\MSBuild\Microsoft\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ta\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\_desktop.ini Logo1_.exe -
Drops file in Windows directory 5 IoCs
Processes:
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exeLogo1_.exe7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exedescription ioc process File created C:\Windows\rundl132.exe 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File created C:\Windows\Logo1_.exe 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File opened for modification C:\Windows\SYSTEM.INI 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe File created C:\Windows\vDll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
Logo1_.exe7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exepid process 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
Processes:
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exedescription pid process Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Token: SeDebugPrivilege 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exepid process 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exeLogo1_.exenet.execmd.exe7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exedescription pid process target process PID 2924 wrote to memory of 2112 2924 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe cmd.exe PID 2924 wrote to memory of 2112 2924 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe cmd.exe PID 2924 wrote to memory of 2112 2924 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe cmd.exe PID 2924 wrote to memory of 2112 2924 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe cmd.exe PID 2924 wrote to memory of 2860 2924 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Logo1_.exe PID 2924 wrote to memory of 2860 2924 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Logo1_.exe PID 2924 wrote to memory of 2860 2924 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Logo1_.exe PID 2924 wrote to memory of 2860 2924 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Logo1_.exe PID 2860 wrote to memory of 2564 2860 Logo1_.exe net.exe PID 2860 wrote to memory of 2564 2860 Logo1_.exe net.exe PID 2860 wrote to memory of 2564 2860 Logo1_.exe net.exe PID 2860 wrote to memory of 2564 2860 Logo1_.exe net.exe PID 2564 wrote to memory of 2884 2564 net.exe net1.exe PID 2564 wrote to memory of 2884 2564 net.exe net1.exe PID 2564 wrote to memory of 2884 2564 net.exe net1.exe PID 2564 wrote to memory of 2884 2564 net.exe net1.exe PID 2112 wrote to memory of 2544 2112 cmd.exe 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe PID 2112 wrote to memory of 2544 2112 cmd.exe 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe PID 2112 wrote to memory of 2544 2112 cmd.exe 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe PID 2112 wrote to memory of 2544 2112 cmd.exe 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe PID 2544 wrote to memory of 1120 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe taskhost.exe PID 2544 wrote to memory of 1176 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Dwm.exe PID 2544 wrote to memory of 1256 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Explorer.EXE PID 2544 wrote to memory of 1804 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe DllHost.exe PID 2544 wrote to memory of 2112 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe cmd.exe PID 2544 wrote to memory of 2112 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe cmd.exe PID 2544 wrote to memory of 2860 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Logo1_.exe PID 2544 wrote to memory of 2860 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Logo1_.exe PID 2544 wrote to memory of 2528 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe conhost.exe PID 2860 wrote to memory of 1256 2860 Logo1_.exe Explorer.EXE PID 2860 wrote to memory of 1256 2860 Logo1_.exe Explorer.EXE PID 2544 wrote to memory of 1120 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe taskhost.exe PID 2544 wrote to memory of 1176 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Dwm.exe PID 2544 wrote to memory of 1256 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Explorer.EXE PID 2544 wrote to memory of 2528 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe conhost.exe PID 2544 wrote to memory of 1120 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe taskhost.exe PID 2544 wrote to memory of 1176 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Dwm.exe PID 2544 wrote to memory of 1256 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Explorer.EXE PID 2544 wrote to memory of 2528 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe conhost.exe PID 2544 wrote to memory of 1120 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe taskhost.exe PID 2544 wrote to memory of 1176 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Dwm.exe PID 2544 wrote to memory of 1256 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Explorer.EXE PID 2544 wrote to memory of 2528 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe conhost.exe PID 2544 wrote to memory of 1120 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe taskhost.exe PID 2544 wrote to memory of 1176 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Dwm.exe PID 2544 wrote to memory of 1256 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Explorer.EXE PID 2544 wrote to memory of 2528 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe conhost.exe PID 2544 wrote to memory of 1120 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe taskhost.exe PID 2544 wrote to memory of 1176 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Dwm.exe PID 2544 wrote to memory of 1256 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Explorer.EXE PID 2544 wrote to memory of 2528 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe conhost.exe PID 2544 wrote to memory of 1120 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe taskhost.exe PID 2544 wrote to memory of 1176 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Dwm.exe PID 2544 wrote to memory of 1256 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Explorer.EXE PID 2544 wrote to memory of 2528 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe conhost.exe PID 2544 wrote to memory of 1120 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe taskhost.exe PID 2544 wrote to memory of 1176 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Dwm.exe PID 2544 wrote to memory of 1256 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Explorer.EXE PID 2544 wrote to memory of 2528 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe conhost.exe PID 2544 wrote to memory of 1120 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe taskhost.exe PID 2544 wrote to memory of 1176 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Dwm.exe PID 2544 wrote to memory of 1256 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe Explorer.EXE PID 2544 wrote to memory of 2528 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe conhost.exe PID 2544 wrote to memory of 1120 2544 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe taskhost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1120
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe"C:\Users\Admin\AppData\Local\Temp\7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe"2⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\$$a1796.bat3⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe"C:\Users\Admin\AppData\Local\Temp\7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2544 -
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:2884
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1804
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "111229958124606778312375702671326777254666797337185200324245203426-1197624130"1⤵PID:2528
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exeFilesize
251KB
MD5977cf1f77316a3972f08a77ce53c3b91
SHA19f041b81a9344226baf41ced0284ec3120ccca45
SHA256291ec6a369034c1b0b53b24a6bcc7521e3aafa10dd286bf7a003a6b3c66c8511
SHA512816477692fdaebc07ce50e71bca986e2d2a2abdfa9edbfaae1dff5d7cb19256bc7408ab7bc6040f684d37ebe1b73397d118045b7f3d0d8e561b89a3b95d5b383
-
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exeFilesize
471KB
MD54cfdb20b04aa239d6f9e83084d5d0a77
SHA1f22863e04cc1fd4435f785993ede165bd8245ac6
SHA25630ed17ca6ae530e8bf002bcef6048f94dba4b3b10252308147031f5c86ace1b9
SHA51235b4c2f68a7caa45f2bb14b168947e06831f358e191478a6659b49f30ca6f538dc910fe6067448d5d8af4cb8558825d70f94d4bd67709aee414b2be37d49be86
-
C:\Users\Admin\AppData\Local\Temp\$$a1796.batFilesize
722B
MD53b901682e189df2b0fa069ba5dae24d2
SHA1cdd43f81687c2b2207a7a9f81024b9c65d6dcaa6
SHA256580379fc3e95d548888b9324b0da04057de2c2ea03f3d98435a629531874a734
SHA5126c11aee79cded39ac140b02b2036a33e39c9a3697642cad365c845b20ec745c3f23796ad39f2e6f021bc0f1575a2b88f1fe1afb94e0c0cf6e3478eb0f189158b
-
C:\Users\Admin\AppData\Local\Temp\7c1454bb85428230d10e8afc863e2207e53cf6aa9c47735dcf18b73d49244a7b.exe.exeFilesize
1.9MB
MD50249e536946ecdee7fc96462981f9051
SHA1f8d57ca34b945114ab12e9d6ab72f798ed9fe101
SHA2563953d9fb50481c4c1ac15d7032a6977551764743f84d94d10f5202be164f00f2
SHA5121893ea7fb7e60a507962ed7efb620478f734f230f1b1f8a6a8541f79dec575dff852b74363048661b9a7de3106593d190846e7edd42da9ba31125fc249497f5d
-
C:\Windows\Logo1_.exeFilesize
26KB
MD5d64fff83fde04bb05f120dc27af13d2b
SHA16637e6000271fa24db8c67a554475eba56911db9
SHA256edb19ce6117ad3b8bcfc38f2076c82e3c5e69a927a5108d442de991bce2d9d84
SHA5125b82e2895823afa819b452cd185bbc8f57b9dbf9e138fcedeeeb7da7871db38e59da651c8def70b157d36f90af8d956283373f8590bbdaaf703ea89b80230d3e
-
F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\_desktop.iniFilesize
9B
MD55e45e0c42537212b4bfef35112ec91ba
SHA110c59c091fd35facc82bbc96938f118ce5a60546
SHA2569f6b7a83161db36757e96dc40936aec1e5a9a41f9fca089f9cf5a4d695dd5ed5
SHA512ee964e08687daa53fdc8e063402791acb104bd59f5d0f8a6d11d3e889db476315641c38032ade4177cd794b060f9fc4e6fd161989e452aae828c875c747e4bfb
-
F:\xfpmij.pifFilesize
96KB
MD50506c9db9aa292baa8dd4ead893d7213
SHA151e06a0499b2a3293f7102b6e2a9c858fef32ee7
SHA2566065e6d39eeb701bd0269aaabe21e1bed8e470e1cde8178f47cf43cac02d26cc
SHA512a6d57d54887ae207eac62adb198668812448d83a604f1af12b3189bf842d8f83c5325676d803b9c819bdf2a76a9a08408745a2e8d7fdf6783b4086214fe5e219
-
memory/1120-43-0x0000000001F10000-0x0000000001F12000-memory.dmpFilesize
8KB
-
memory/2112-61-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/2112-52-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2112-138-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/2112-51-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/2112-54-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2112-55-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/2112-29-0x0000000002510000-0x00000000027F5000-memory.dmpFilesize
2.9MB
-
memory/2544-30-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2544-76-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-34-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-41-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-40-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-35-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-39-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-71-0x0000000000830000-0x0000000000832000-memory.dmpFilesize
8KB
-
memory/2544-70-0x0000000000830000-0x0000000000832000-memory.dmpFilesize
8KB
-
memory/2544-69-0x0000000000840000-0x0000000000841000-memory.dmpFilesize
4KB
-
memory/2544-31-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-33-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-38-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-37-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-75-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-42-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-77-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-79-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-80-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-81-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-83-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-85-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-87-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-144-0x0000000000830000-0x0000000000832000-memory.dmpFilesize
8KB
-
memory/2544-90-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2544-96-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-98-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-36-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2544-128-0x00000000022E0000-0x000000000336E000-memory.dmpFilesize
16.6MB
-
memory/2860-60-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/2860-139-0x00000000002E0000-0x00000000002E2000-memory.dmpFilesize
8KB
-
memory/2860-89-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2860-62-0x00000000002E0000-0x00000000002E2000-memory.dmpFilesize
8KB
-
memory/2860-58-0x00000000002E0000-0x00000000002E2000-memory.dmpFilesize
8KB
-
memory/2924-100-0x00000000001B0000-0x00000000001E4000-memory.dmpFilesize
208KB
-
memory/2924-12-0x00000000001B0000-0x00000000001E4000-memory.dmpFilesize
208KB
-
memory/2924-16-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/2924-18-0x00000000001B0000-0x00000000001E4000-memory.dmpFilesize
208KB
-
memory/2924-0-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB