Analysis
-
max time kernel
125s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 21:15
Static task
static1
Behavioral task
behavioral1
Sample
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe
Resource
win7-20240221-en
General
-
Target
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe
-
Size
4.2MB
-
MD5
4c58759c45f46521be07f90c3adaa668
-
SHA1
38ff78c6baa4df67808f9c4cda99722d9ad44c9f
-
SHA256
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe
-
SHA512
2a6125c2daabe92b3700bad985b61ee2da71e6484576196b5fbe61f5f1cbef55565db58e83c3e0546a61675791cabd241c3644d29c508e71c4132a0302b4666d
-
SSDEEP
98304:2GdVTVT9nOgmhm1qvf6ijFUsPeeD2hnYJMOgZ:lRT9nO701qvfzjSoDuYJJi
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Processes:
resource yara_rule behavioral1/memory/2684-13-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2684-14-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2684-52-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2188-111-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/1132-110-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2188-115-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit behavioral1/memory/2188-124-0x0000000010000000-0x00000000101B6000-memory.dmp purplefox_rootkit -
Gh0st RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2684-13-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2684-14-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat \Windows\SysWOW64\259428180.txt family_gh0strat behavioral1/memory/2684-52-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2188-111-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/1132-110-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2188-115-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat behavioral1/memory/2188-124-0x0000000010000000-0x00000000101B6000-memory.dmp family_gh0strat -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe -
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe -
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe -
Drops file in Drivers directory 1 IoCs
Processes:
TXPlatforn.exedescription ioc process File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe -
Sets DLL path for service in the registry 2 TTPs 1 IoCs
Processes:
svchos.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ö÷¶¯·ÀÓù·þÎñÄ£¿é\Parameters\ServiceDll = "C:\\Windows\\system32\\259428180.txt" svchos.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
TXPlatforn.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys" TXPlatforn.exe -
Executes dropped EXE 6 IoCs
Processes:
svchost.exesvchos.exeTXPlatforn.exeHD_13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exeTXPlatforn.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2684 svchost.exe 2660 svchos.exe 1132 TXPlatforn.exe 2412 HD_13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2188 TXPlatforn.exe 2000 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Loads dropped DLL 8 IoCs
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exesvchos.exesvchost.exeTXPlatforn.exeÖ÷¶¯·ÀÓù·þÎñÄ£¿é.exepid process 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2660 svchos.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2448 svchost.exe 1132 TXPlatforn.exe 2448 svchost.exe 2000 Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe -
Processes:
resource yara_rule behavioral1/memory/2172-3-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2684-10-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2684-13-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2172-9-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-15-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2684-14-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2172-20-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-30-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2684-52-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2172-47-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-37-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-64-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-100-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2188-111-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/1132-110-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2412-109-0x00000000003D0000-0x00000000003DA000-memory.dmp upx behavioral1/memory/2188-115-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2172-116-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-117-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2188-124-0x0000000010000000-0x00000000101B6000-memory.dmp upx behavioral1/memory/2172-125-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-126-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-127-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-134-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-135-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-136-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-138-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-140-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-144-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-150-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-151-0x0000000002010000-0x000000000309E000-memory.dmp upx behavioral1/memory/2172-176-0x0000000002010000-0x000000000309E000-memory.dmp upx -
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\Svc 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe -
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exedescription ioc process File opened (read-only) \??\Q: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\S: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\X: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\E: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\G: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\I: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\K: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\N: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\O: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\W: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\Y: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\Z: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\J: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\L: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\U: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\H: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\M: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\P: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\R: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\T: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened (read-only) \??\V: 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe -
Drops file in System32 directory 6 IoCs
Processes:
svchost.exesvchost.exesvchos.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe File created C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe svchost.exe File created C:\Windows\SysWOW64\259428180.txt svchos.exe File opened for modification C:\Windows\SysWOW64\ini.ini svchos.exe File created C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe svchost.exe -
Drops file in Program Files directory 9 IoCs
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exedescription ioc process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File created C:\Program Files (x86)\Google\Chrome\Application\chrome.exe 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe -
Drops file in Windows directory 1 IoCs
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exepid process 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
TXPlatforn.exepid process 2188 TXPlatforn.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exesvchost.exeTXPlatforn.exedescription pid process Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeIncBasePriorityPrivilege 2684 svchost.exe Token: SeLoadDriverPrivilege 2188 TXPlatforn.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: 33 2188 TXPlatforn.exe Token: SeIncBasePriorityPrivilege 2188 TXPlatforn.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Token: SeDebugPrivilege 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exepid process 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exesvchost.exeTXPlatforn.exesvchost.execmd.exedescription pid process target process PID 2172 wrote to memory of 2684 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe svchost.exe PID 2172 wrote to memory of 2684 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe svchost.exe PID 2172 wrote to memory of 2684 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe svchost.exe PID 2172 wrote to memory of 2684 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe svchost.exe PID 2172 wrote to memory of 2684 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe svchost.exe PID 2172 wrote to memory of 2684 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe svchost.exe PID 2172 wrote to memory of 2684 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe svchost.exe PID 2172 wrote to memory of 1124 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe taskhost.exe PID 2172 wrote to memory of 2660 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe svchos.exe PID 2172 wrote to memory of 2660 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe svchos.exe PID 2172 wrote to memory of 2660 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe svchos.exe PID 2172 wrote to memory of 2660 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe svchos.exe PID 2172 wrote to memory of 1228 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Dwm.exe PID 2172 wrote to memory of 1284 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Explorer.EXE PID 2172 wrote to memory of 1096 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe DllHost.exe PID 2684 wrote to memory of 2440 2684 svchost.exe cmd.exe PID 2684 wrote to memory of 2440 2684 svchost.exe cmd.exe PID 2684 wrote to memory of 2440 2684 svchost.exe cmd.exe PID 2684 wrote to memory of 2440 2684 svchost.exe cmd.exe PID 2172 wrote to memory of 2412 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe HD_13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe PID 2172 wrote to memory of 2412 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe HD_13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe PID 2172 wrote to memory of 2412 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe HD_13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe PID 2172 wrote to memory of 2412 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe HD_13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe PID 1132 wrote to memory of 2188 1132 TXPlatforn.exe TXPlatforn.exe PID 1132 wrote to memory of 2188 1132 TXPlatforn.exe TXPlatforn.exe PID 1132 wrote to memory of 2188 1132 TXPlatforn.exe TXPlatforn.exe PID 1132 wrote to memory of 2188 1132 TXPlatforn.exe TXPlatforn.exe PID 1132 wrote to memory of 2188 1132 TXPlatforn.exe TXPlatforn.exe PID 1132 wrote to memory of 2188 1132 TXPlatforn.exe TXPlatforn.exe PID 1132 wrote to memory of 2188 1132 TXPlatforn.exe TXPlatforn.exe PID 2448 wrote to memory of 2000 2448 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2448 wrote to memory of 2000 2448 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2448 wrote to memory of 2000 2448 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2448 wrote to memory of 2000 2448 svchost.exe Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe PID 2440 wrote to memory of 1088 2440 cmd.exe PING.EXE PID 2440 wrote to memory of 1088 2440 cmd.exe PING.EXE PID 2440 wrote to memory of 1088 2440 cmd.exe PING.EXE PID 2440 wrote to memory of 1088 2440 cmd.exe PING.EXE PID 2172 wrote to memory of 1124 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe taskhost.exe PID 2172 wrote to memory of 1228 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Dwm.exe PID 2172 wrote to memory of 1284 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Explorer.EXE PID 2172 wrote to memory of 1124 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe taskhost.exe PID 2172 wrote to memory of 1228 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Dwm.exe PID 2172 wrote to memory of 1284 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Explorer.EXE PID 2172 wrote to memory of 1124 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe taskhost.exe PID 2172 wrote to memory of 1228 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Dwm.exe PID 2172 wrote to memory of 1284 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Explorer.EXE PID 2172 wrote to memory of 1124 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe taskhost.exe PID 2172 wrote to memory of 1228 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Dwm.exe PID 2172 wrote to memory of 1284 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Explorer.EXE PID 2172 wrote to memory of 1124 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe taskhost.exe PID 2172 wrote to memory of 1228 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Dwm.exe PID 2172 wrote to memory of 1284 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Explorer.EXE PID 2172 wrote to memory of 1124 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe taskhost.exe PID 2172 wrote to memory of 1228 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Dwm.exe PID 2172 wrote to memory of 1284 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Explorer.EXE PID 2172 wrote to memory of 1124 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe taskhost.exe PID 2172 wrote to memory of 1228 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Dwm.exe PID 2172 wrote to memory of 1284 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Explorer.EXE PID 2172 wrote to memory of 1124 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe taskhost.exe PID 2172 wrote to memory of 1228 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Dwm.exe PID 2172 wrote to memory of 1284 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Explorer.EXE PID 2172 wrote to memory of 1124 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe taskhost.exe PID 2172 wrote to memory of 1228 2172 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe Dwm.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe"C:\Users\Admin\AppData\Local\Temp\13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\\svchost.exe3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\svchost.exe > nul4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeC:\Users\Admin\AppData\Local\Temp\\svchos.exe3⤵
- Sets DLL path for service in the registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
-
C:\Users\Admin\AppData\Local\Temp\HD_13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exeC:\Users\Admin\AppData\Local\Temp\HD_13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exe3⤵
- Executes dropped EXE
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -auto1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\TXPlatforn.exeC:\Windows\SysWOW64\TXPlatforn.exe -acsi2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Ö÷¶¯·ÀÓù·þÎñÄ£¿é"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeC:\Windows\system32\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exe "c:\windows\system32\259428180.txt",MainThread2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Privilege Escalation
Create or Modify System Process
1Windows Service
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
7Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HD_13e4d37a8920424e17518024eac85d976c548d6dd9f232393d30519737953dfe.exeFilesize
2.9MB
MD5b0a876816727c01d780ea494d99f34bf
SHA131ded234173563da5ebff88683beab82b551e554
SHA25666f26942c3f7d590c857aa7c6b37d45254ab40c2b2e07ef0edd98be088430588
SHA5125e6859a32a340ed5d24702393ffbdbd621cbbbb7210b550e9a2b841690e9c5d6b57c04bc7ae6f9bbb8faaf5af90400c68c4b67532f2ac20369820315b5859058
-
C:\Users\Admin\AppData\Local\Temp\HD_X.datFilesize
1.3MB
MD5caeb32bd5c59b30d4d73f00d06660ce4
SHA173baa22b1afbf6a2a1399ed796d219aff64bcf25
SHA2560a3685765937ab36541365b347506e01fa3b76a0a0437dcba19a0e927c0010c9
SHA51285b4d35d351706ad9e09fbc066c090e371938fde2b31db6737e550ef2e99da5aba9cc0a1646ee9efa293e57f8e0fba5ff2d38d2507f008c85ceb52aa676b1b05
-
C:\Users\Admin\AppData\Local\Temp\X.icoFilesize
71KB
MD5fb44f7af2882d222b600539171f54c1d
SHA10c5a1a0b1620a55a0f194464227be25a2f0347e1
SHA256f2a78e76259bc8fd4ab6af7b4e16dfb49a10643308aca3d14c09e61ac0ebd487
SHA51221e906473f64303c4c8d55213ccb84f4a803c11fb5eef34ce3194adfb391ccbcc91e7c399556c7a4e4f3d33b9b19524d4499ec771ee8e1a10df26ea7cc2dcb67
-
C:\Users\Admin\AppData\Local\Temp\svchos.exeFilesize
93KB
MD53b377ad877a942ec9f60ea285f7119a2
SHA160b23987b20d913982f723ab375eef50fafa6c70
SHA25662954fdf65e629b39a29f539619d20691332184c6b6be5a826128a8e759bfa84
SHA512af3a71f867ad9d28772c48b521097f9bf8931eb89fd2974e8de10990241419a39ddc3c0b36dd38aac4fdf14e1f0c5e228692618e93adce958d5b5dab8940e46f
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
377KB
MD5a4329177954d4104005bce3020e5ef59
SHA123c29e295e2dbb8454012d619ca3f81e4c16e85a
SHA2566156d003d54dcf2ee92f21bd6e7a6a7f91730bd2804381260bcabe465abe6ddd
SHA51281e9d456a4abfc7cd9e0943d4a0ce15523362c3179f3368381d1d7974f80a9f9113b5404b96e67e91684e0ea1895b7d0073e4c48d0bfc4fd0244b1af6acf0208
-
\Windows\SysWOW64\259428180.txtFilesize
50KB
MD57fbf45338fc63595aeaef564804689fd
SHA10a5a8ee25f18980d47322bf894e9c338e032dfc9
SHA256e3c4362b0d6e081a6281303ce9bfccd37ea53e2fa2a0ffbae24c4b0a35ad0e2f
SHA51246d474ddf99e8302b143da86c96364951ba6c074c263ddd73d71e90ac3432e37167960cfa6857526f8549364060919cfc07bbfa692d8a1fbbdfd0c9b0d110e74
-
\Windows\SysWOW64\Ö÷¶¯·ÀÓù·þÎñÄ£¿é.exeFilesize
43KB
MD551138beea3e2c21ec44d0932c71762a8
SHA18939cf35447b22dd2c6e6f443446acc1bf986d58
SHA2565ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124
SHA512794f30fe452117ff2a26dc9d7086aaf82b639c2632ac2e381a81f5239caaec7c96922ba5d2d90bfd8d74f0a6cd4f79fbda63e14c6b779e5cf6834c13e4e45e7d
-
memory/1124-19-0x0000000000410000-0x0000000000412000-memory.dmpFilesize
8KB
-
memory/1132-110-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2172-127-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-176-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-0-0x0000000000400000-0x0000000000582000-memory.dmpFilesize
1.5MB
-
memory/2172-30-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-42-0x0000000000230000-0x0000000000232000-memory.dmpFilesize
8KB
-
memory/2172-44-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/2172-46-0x0000000000230000-0x0000000000232000-memory.dmpFilesize
8KB
-
memory/2172-59-0x0000000000300000-0x0000000000301000-memory.dmpFilesize
4KB
-
memory/2172-196-0x0000000000230000-0x0000000000232000-memory.dmpFilesize
8KB
-
memory/2172-151-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-47-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-37-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-150-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-3-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-64-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-100-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-144-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-140-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-138-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-20-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-125-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-116-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-117-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-9-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-136-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-135-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-126-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-15-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2172-134-0x0000000002010000-0x000000000309E000-memory.dmpFilesize
16.6MB
-
memory/2188-115-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2188-124-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2188-111-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2412-104-0x00000000003D0000-0x00000000003DA000-memory.dmpFilesize
40KB
-
memory/2412-109-0x00000000003D0000-0x00000000003DA000-memory.dmpFilesize
40KB
-
memory/2684-13-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2684-10-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2684-52-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB
-
memory/2684-14-0x0000000010000000-0x00000000101B6000-memory.dmpFilesize
1.7MB