Analysis
-
max time kernel
1800s -
max time network
1803s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-06-2022 23:25
Static task
static1
Behavioral task
behavioral1
Sample
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe
Resource
win7-20220414-en
General
-
Target
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe
-
Size
879KB
-
MD5
d5a7988e6119ee2b3c3595c489ded95b
-
SHA1
585a3dc03f1267bfd12533bc43ea19565ccae661
-
SHA256
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219
-
SHA512
d4c9ad2e7e217b848b16860472ed9ea57cd28deb341701e1ae7e7b4418b11a4fa9ba7626723ea6c9ef6caf42e87e2ec635a142470e460eee51811d18d4f0c55e
Malware Config
Extracted
sality
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
http://www.klkjwre9fqwieluoi.info/
http://kukutrustnet777888.info/
Signatures
-
Modifies firewall policy service 2 TTPs 7 IoCs
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe:*:enabled:@shell32.dll,-1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe -
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe -
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe -
suricata: ET MALWARE Known Hostile Domain ant.trenz .pl Lookup
suricata: ET MALWARE Known Hostile Domain ant.trenz .pl Lookup
-
suricata: ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup
suricata: ET MALWARE Known Hostile Domain ilo.brenz .pl Lookup
-
suricata: ET MALWARE Win32.Sality-GR Checkin
suricata: ET MALWARE Win32.Sality-GR Checkin
-
Contacts a large (907) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Processes:
resource yara_rule behavioral2/memory/396-131-0x00000000023C0000-0x000000000344E000-memory.dmp upx behavioral2/memory/396-132-0x00000000023C0000-0x000000000344E000-memory.dmp upx behavioral2/memory/396-134-0x00000000023C0000-0x000000000344E000-memory.dmp upx -
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe -
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exedescription ioc process File opened (read-only) \??\F: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\G: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\O: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\R: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\U: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\V: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\W: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\H: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\J: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\L: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\Z: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\X: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\Y: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\S: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\E: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\I: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\K: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\M: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\N: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\P: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\Q: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened (read-only) \??\T: faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exedescription ioc process File opened for modification C:\autorun.inf faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe -
Drops file in Program Files directory 64 IoCs
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exedescription ioc process File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\msoadfsb.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SDXHelperBgt.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\VPREVIEW.EXE faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\Common.ShowHelp.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOInstaller.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE1.8.0_66\BIN\servertool.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\Wordconv.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\Common.DBConnection.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\89.0.4389.114\elevation_service.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\LIB\VISUALVM\PLATFORM\LIB\nbexec.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\JRE\BIN\pack200.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE1.8.0_66\BIN\klist.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE16\OSPPREARM.EXE faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\excelcnv.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\BIN\jstack.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\BIN\xjc.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\MSOHTMED.EXE faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\chrome.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\BIN\javapackager.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\JRE\BIN\kinit.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE1.8.0_66\BIN\javaw.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE1.8.0_66\BIN\pack200.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\BIN\jjs.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE1.8.0_66\BIN\tnameserv.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\Microsoft.Mashup.Container.NetFX40.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOHTMED.EXE faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOSYNC.EXE faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\BIN\java-rmi.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\JRE\BIN\java.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\INTEGRATION\ADDONS\OneDriveSetup.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\msoasb.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SKYPESRV\SKYPESERVER.EXE faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\BIN\javaw.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\BIN\serialver.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE1.8.0_66\BIN\jp2launcher.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\Common.DBConnection64.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\89.0.4389.114\chrome_pwa_launcher.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE1.8.0_66\BIN\policytool.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\DATABASECOMPARE.EXE faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\JRE\BIN\javaw.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE1.8.0_66\BIN\java.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\JRE\BIN\jjs.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE1.8.0_66\BIN\unpack200.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE1.8.0_66\BIN\kinit.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE1.8.0_66\BIN\rmid.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE1.8.0_66\BIN\ssvagent.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\Microsoft.Mashup.Container.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\BIN\jhat.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\BIN\jstatd.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK1.8.0_66\BIN\schemagen.exe faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe -
Drops file in Windows directory 1 IoCs
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exedescription ioc process File opened for modification C:\Windows\SYSTEM.INI faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exepid process 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe -
Suspicious behavior: MapViewOfSection 63 IoCs
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exepid process 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exedescription pid process Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe Token: SeDebugPrivilege 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exedescription pid process target process PID 396 wrote to memory of 608 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe winlogon.exe PID 396 wrote to memory of 608 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe winlogon.exe PID 396 wrote to memory of 608 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe winlogon.exe PID 396 wrote to memory of 608 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe winlogon.exe PID 396 wrote to memory of 608 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe winlogon.exe PID 396 wrote to memory of 608 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe winlogon.exe PID 396 wrote to memory of 664 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe lsass.exe PID 396 wrote to memory of 664 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe lsass.exe PID 396 wrote to memory of 664 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe lsass.exe PID 396 wrote to memory of 664 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe lsass.exe PID 396 wrote to memory of 664 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe lsass.exe PID 396 wrote to memory of 664 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe lsass.exe PID 396 wrote to memory of 772 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe fontdrvhost.exe PID 396 wrote to memory of 772 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe fontdrvhost.exe PID 396 wrote to memory of 772 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe fontdrvhost.exe PID 396 wrote to memory of 772 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe fontdrvhost.exe PID 396 wrote to memory of 772 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe fontdrvhost.exe PID 396 wrote to memory of 772 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe fontdrvhost.exe PID 396 wrote to memory of 780 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe fontdrvhost.exe PID 396 wrote to memory of 780 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe fontdrvhost.exe PID 396 wrote to memory of 780 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe fontdrvhost.exe PID 396 wrote to memory of 780 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe fontdrvhost.exe PID 396 wrote to memory of 780 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe fontdrvhost.exe PID 396 wrote to memory of 780 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe fontdrvhost.exe PID 396 wrote to memory of 792 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 792 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 792 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 792 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 792 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 792 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 900 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 900 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 900 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 900 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 900 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 900 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 948 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 948 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 948 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 948 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 948 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 948 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 1012 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe dwm.exe PID 396 wrote to memory of 1012 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe dwm.exe PID 396 wrote to memory of 1012 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe dwm.exe PID 396 wrote to memory of 1012 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe dwm.exe PID 396 wrote to memory of 1012 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe dwm.exe PID 396 wrote to memory of 1012 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe dwm.exe PID 396 wrote to memory of 440 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 440 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 440 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 440 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 440 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 440 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 692 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 692 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 692 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 692 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 692 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 692 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 864 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 864 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 864 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe PID 396 wrote to memory of 864 396 faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe svchost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:608
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:772
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:1012
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:440
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:900
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:792
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3444
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3376
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3288
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:2812
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe2⤵PID:508
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:2180
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3712
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:3524
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4644
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4328
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:3392
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4576
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}2⤵PID:3472
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:4928
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3084
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe"C:\Users\Admin\AppData\Local\Temp\faa7357fa46c320a747546a28518eb933f636872ee2451c5227e4a3ab69ec219.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:396
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2904
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2816
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2788
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2500
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2448
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2368
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2360
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2324
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2316
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:4740
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:3532
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time1⤵PID:1680
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:4720
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:1220
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4072
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2220
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2100
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2068
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:1432
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1972
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1936
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1856
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1816
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1748
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1700
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s FontCache1⤵PID:1620
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1604
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1564
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1436
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1376
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1368
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1356
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1240
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1196
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1184
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1136
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1048
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1040
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:864
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:692
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/396-130-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/396-131-0x00000000023C0000-0x000000000344E000-memory.dmpFilesize
16.6MB
-
memory/396-132-0x00000000023C0000-0x000000000344E000-memory.dmpFilesize
16.6MB
-
memory/396-133-0x0000000000400000-0x00000000004E2000-memory.dmpFilesize
904KB
-
memory/396-134-0x00000000023C0000-0x000000000344E000-memory.dmpFilesize
16.6MB