phobos | 97e4ffdb8be8d108e5c81af0d8edda6e3bed9f37e170a05221199742f4de309c

Analysis

max time kernel
264s
max time network
179s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
18-10-2022 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sql.exe
Size

55KB
MD5

95570b5156776c970510454a651729cd
SHA1

a3a4e9839328fad9687ce3381dfcb847ee577902
SHA256

97e4ffdb8be8d108e5c81af0d8edda6e3bed9f37e170a05221199742f4de309c
SHA512

d056ac67c69be744d2a8cf611384951f7c65847fb77712ceaac6e44261150013b0d340157af2ce5d7a0734afdabfdfadf759268a4067f9ab2875b9d85647858b
SSDEEP

1536:+NeRBl5PT/rx1mzwRMSTdLpJzRCcZAXNsn:+QRrmzwR5J9CHK

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, write us to the e-mail [email protected] Write this ID in the title of your message 0E56A5F3-3126 In case of no answer in 24 hours write us to this e-mail: [email protected] You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

4440 bcdedit.exe
1736 bcdedit.exe
4696 bcdedit.exe
2208 bcdedit.exe
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

4604 wbadmin.exe
4964 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exenetsh.exe

pid process

4936 netsh.exe
3876 netsh.exe
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
ransomware

Processes:

sql.exe

description ioc process

File opened for modification C:\Users\Admin\Pictures\RedoRepair.tiff sql.exe

pid	process
4440	bcdedit.exe
1736	bcdedit.exe
4696	bcdedit.exe
2208	bcdedit.exe

pid	process
4604	wbadmin.exe
4964	wbadmin.exe

pid	process
4936	netsh.exe
3876	netsh.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\RedoRepair.tiff	sql.exe

Drops startup file 3 IoCs

Processes:

sql.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\sql.exe	sql.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	sql.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

sql.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sql = "C:\\Users\\Admin\\AppData\\Local\\sql.exe"	sql.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\sql = "C:\\Users\\Admin\\AppData\\Local\\sql.exe"	sql.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

sql.exe

description	ioc	process
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	sql.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	sql.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	sql.exe
File opened for modification	C:\Program Files\desktop.ini	sql.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	sql.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	sql.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	sql.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	sql.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	sql.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	sql.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	sql.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	sql.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	sql.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	sql.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini	sql.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	sql.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu Places\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	sql.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	sql.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	sql.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	sql.exe
File opened for modification	C:\Users\Public\desktop.ini	sql.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	sql.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	sql.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	sql.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-1099808672-3828198950-1535142148-1000\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	sql.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	sql.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	sql.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	sql.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	sql.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	sql.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	sql.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	sql.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	sql.exe

Drops file in Program Files directory 64 IoCs

Processes:

sql.exe

description	ioc	process
File created	C:\Program Files\Java\jdk1.8.0_66\bin\wsgen.exe.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-xstate-l2-1-0.dll	sql.exe
File created	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-phonetic.xml	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-black\WideTile.scale-100.png	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL	sql.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN086.XML.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.3DBuilder_13.0.10349.0_x64__8wekyb3d8bbwe\Assets\manifestAssets\contrast-white\Square310x310Logo.scale-100.png	sql.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VC\msdia100.dll	sql.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml	sql.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\keystore\libmemory_keystore_plugin.dll.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\uk-ua\ui-strings.js	sql.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_ja_4.4.0.v20140623020002.jar.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_CopyDrop32x32.gif	sql.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_CopyNoDrop32x32.gif.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-oql.xml.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	sql.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\fr-ma\ui-strings.js.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll	sql.exe
File created	C:\Program Files\VideoLAN\VLC\locale\si\LC_MESSAGES\vlc.mo.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\en-us\officons.ttf	sql.exe
File created	C:\Program Files\Mozilla Firefox\api-ms-win-crt-stdio-l1-1-0.dll.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-phn.xrm-ms	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GKWord.dll.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\images\OfficeHubLogo_71x71.png	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\ThemePreview\Effects\dust.png	sql.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailAppList.targetsize-40.png	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-white\MedTile.scale-200.png	sql.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-api-progress_zh_CN.jar	sql.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACECORE.DLL.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Awards\challenge\Came_To_Play_.png	sql.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\msvcp120.dll.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected][0E56A5F3-3126].[[email protected]].eking	sql.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_nv12_plugin.dll.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\Windows Defender\fr-FR\MsMpResL.dll.mui	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Beach\beach_12d.png	sql.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\es\System.Printing.resources.dll	sql.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\compare_poster.jpg	sql.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pt-br\ui-strings.js	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Data.ConnectionUI.Dialog.dll	sql.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\GostName.XSL.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\example_icons2x.png.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-ae\ui-strings.js.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_neutral_split.scale-125_8wekyb3d8bbwe\resources.pri	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\libssl-1_1-x64.dll	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_contrast-black.png	sql.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host-remote.jar.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NL7MODELS0009.dll.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RTL\contrast-black\SmallTile.scale-125.png	sql.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-execution_ja.jar.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icucnv40.dll.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libdvbsub_plugin.dll.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\cs-cz\ui-strings.js	sql.exe
File opened for modification	C:\Program Files (x86)\Windows Defender\fr-FR\MpAsDesc.dll.mui	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\THMBNAIL.PNG	sql.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN092.XML	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7989_20x20x32.png	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_25.25.13009.0_x64__8wekyb3d8bbwe\Assets\GamesXboxHubMedTile.scale-100.png	sql.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms.id[0E56A5F3-3126].[[email protected]].eking	sql.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\large\ir_60x42.png	sql.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.7906.42257.0_x64__8wekyb3d8bbwe\images\7260_32x32x32.png	sql.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vds.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

3320 vssadmin.exe
3364 vssadmin.exe
Modifies registry class 1 IoCs

Processes:

sql.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings sql.exe

pid	process
3320	vssadmin.exe
3364	vssadmin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000_Classes\Local Settings	sql.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

sql.exe

pid	process
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe
2676	sql.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

sql.exevssvc.exeWMIC.exewbengine.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2676	sql.exe
Token: SeBackupPrivilege	3404	vssvc.exe
Token: SeRestorePrivilege	3404	vssvc.exe
Token: SeAuditPrivilege	3404	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5116	WMIC.exe
Token: SeSecurityPrivilege	5116	WMIC.exe
Token: SeTakeOwnershipPrivilege	5116	WMIC.exe
Token: SeLoadDriverPrivilege	5116	WMIC.exe
Token: SeSystemProfilePrivilege	5116	WMIC.exe
Token: SeSystemtimePrivilege	5116	WMIC.exe
Token: SeProfSingleProcessPrivilege	5116	WMIC.exe
Token: SeIncBasePriorityPrivilege	5116	WMIC.exe
Token: SeCreatePagefilePrivilege	5116	WMIC.exe
Token: SeBackupPrivilege	5116	WMIC.exe
Token: SeRestorePrivilege	5116	WMIC.exe
Token: SeShutdownPrivilege	5116	WMIC.exe
Token: SeDebugPrivilege	5116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5116	WMIC.exe
Token: SeRemoteShutdownPrivilege	5116	WMIC.exe
Token: SeUndockPrivilege	5116	WMIC.exe
Token: SeManageVolumePrivilege	5116	WMIC.exe
Token: 33	5116	WMIC.exe
Token: 34	5116	WMIC.exe
Token: 35	5116	WMIC.exe
Token: 36	5116	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5116	WMIC.exe
Token: SeSecurityPrivilege	5116	WMIC.exe
Token: SeTakeOwnershipPrivilege	5116	WMIC.exe
Token: SeLoadDriverPrivilege	5116	WMIC.exe
Token: SeSystemProfilePrivilege	5116	WMIC.exe
Token: SeSystemtimePrivilege	5116	WMIC.exe
Token: SeProfSingleProcessPrivilege	5116	WMIC.exe
Token: SeIncBasePriorityPrivilege	5116	WMIC.exe
Token: SeCreatePagefilePrivilege	5116	WMIC.exe
Token: SeBackupPrivilege	5116	WMIC.exe
Token: SeRestorePrivilege	5116	WMIC.exe
Token: SeShutdownPrivilege	5116	WMIC.exe
Token: SeDebugPrivilege	5116	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5116	WMIC.exe
Token: SeRemoteShutdownPrivilege	5116	WMIC.exe
Token: SeUndockPrivilege	5116	WMIC.exe
Token: SeManageVolumePrivilege	5116	WMIC.exe
Token: 33	5116	WMIC.exe
Token: 34	5116	WMIC.exe
Token: 35	5116	WMIC.exe
Token: 36	5116	WMIC.exe
Token: SeBackupPrivilege	700	wbengine.exe
Token: SeRestorePrivilege	700	wbengine.exe
Token: SeSecurityPrivilege	700	wbengine.exe
Token: SeIncreaseQuotaPrivilege	4048	WMIC.exe
Token: SeSecurityPrivilege	4048	WMIC.exe
Token: SeTakeOwnershipPrivilege	4048	WMIC.exe
Token: SeLoadDriverPrivilege	4048	WMIC.exe
Token: SeSystemProfilePrivilege	4048	WMIC.exe
Token: SeSystemtimePrivilege	4048	WMIC.exe
Token: SeProfSingleProcessPrivilege	4048	WMIC.exe
Token: SeIncBasePriorityPrivilege	4048	WMIC.exe
Token: SeCreatePagefilePrivilege	4048	WMIC.exe
Token: SeBackupPrivilege	4048	WMIC.exe
Token: SeRestorePrivilege	4048	WMIC.exe
Token: SeShutdownPrivilege	4048	WMIC.exe
Token: SeDebugPrivilege	4048	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4048	WMIC.exe
Token: SeRemoteShutdownPrivilege	4048	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

mshta.exe

pid process

2216 mshta.exe

pid	process
2216	mshta.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

sql.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2676 wrote to memory of 4764	2676	sql.exe	cmd.exe
PID 2676 wrote to memory of 4764	2676	sql.exe	cmd.exe
PID 2676 wrote to memory of 4304	2676	sql.exe	cmd.exe
PID 2676 wrote to memory of 4304	2676	sql.exe	cmd.exe
PID 4764 wrote to memory of 3320	4764	cmd.exe	vssadmin.exe
PID 4764 wrote to memory of 3320	4764	cmd.exe	vssadmin.exe
PID 4304 wrote to memory of 4936	4304	cmd.exe	netsh.exe
PID 4304 wrote to memory of 4936	4304	cmd.exe	netsh.exe
PID 4764 wrote to memory of 5116	4764	cmd.exe	WMIC.exe
PID 4764 wrote to memory of 5116	4764	cmd.exe	WMIC.exe
PID 4304 wrote to memory of 3876	4304	cmd.exe	netsh.exe
PID 4304 wrote to memory of 3876	4304	cmd.exe	netsh.exe
PID 4764 wrote to memory of 4440	4764	cmd.exe	bcdedit.exe
PID 4764 wrote to memory of 4440	4764	cmd.exe	bcdedit.exe
PID 4764 wrote to memory of 1736	4764	cmd.exe	bcdedit.exe
PID 4764 wrote to memory of 1736	4764	cmd.exe	bcdedit.exe
PID 4764 wrote to memory of 4604	4764	cmd.exe	wbadmin.exe
PID 4764 wrote to memory of 4604	4764	cmd.exe	wbadmin.exe
PID 2676 wrote to memory of 212	2676	sql.exe	mshta.exe
PID 2676 wrote to memory of 212	2676	sql.exe	mshta.exe
PID 2676 wrote to memory of 212	2676	sql.exe	mshta.exe
PID 2676 wrote to memory of 2776	2676	sql.exe	mshta.exe
PID 2676 wrote to memory of 2776	2676	sql.exe	mshta.exe
PID 2676 wrote to memory of 2776	2676	sql.exe	mshta.exe
PID 2676 wrote to memory of 2216	2676	sql.exe	mshta.exe
PID 2676 wrote to memory of 2216	2676	sql.exe	mshta.exe
PID 2676 wrote to memory of 2216	2676	sql.exe	mshta.exe
PID 2676 wrote to memory of 3752	2676	sql.exe	cmd.exe
PID 2676 wrote to memory of 3752	2676	sql.exe	cmd.exe
PID 3752 wrote to memory of 3364	3752	cmd.exe	vssadmin.exe
PID 3752 wrote to memory of 3364	3752	cmd.exe	vssadmin.exe
PID 3752 wrote to memory of 4048	3752	cmd.exe	WMIC.exe
PID 3752 wrote to memory of 4048	3752	cmd.exe	WMIC.exe
PID 3752 wrote to memory of 4696	3752	cmd.exe	bcdedit.exe
PID 3752 wrote to memory of 4696	3752	cmd.exe	bcdedit.exe
PID 3752 wrote to memory of 2208	3752	cmd.exe	bcdedit.exe
PID 3752 wrote to memory of 2208	3752	cmd.exe	bcdedit.exe
PID 3752 wrote to memory of 4964	3752	cmd.exe	wbadmin.exe
PID 3752 wrote to memory of 4964	3752	cmd.exe	wbadmin.exe

C:\Users\Admin\AppData\Local\Temp\sql.exe
"C:\Users\Admin\AppData\Local\Temp\sql.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\sql.exe
  "C:\Users\Admin\AppData\Local\Temp\sql.exe"
  2⤵
  PID:4068
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:4936
- - C:\Windows\system32\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    PID:3876
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3320
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4440
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1736
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:4604
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  PID:212
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  PID:2776
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  - Suspicious use of FindShellTrayWindow
  PID:2216
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3364
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4048
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4696
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled no
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2208
- - C:\Windows\system32\wbadmin.exe
    wbadmin delete catalog -quiet
    3⤵
    - Deletes backup catalog
    PID:4964

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3404

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:700

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4660

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4348

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\info.hta

Filesize
5KB

MD5
357f890cea00d8f37120f49ee77525c9

SHA1
fba08a34265dfc80be3d6602db15f2b159b2f83f

SHA256
63e7973899c9ab09a8f85a8b8184a960e989b34234561d708254c0307e92767d

SHA512
1ca31a847d15ec8f74edfd693e195dd5beb1932ae63393dfcdc237c3c6114517746aee53516bbac5570f8f6a72093df460f92fbd5559e46f0006eae9c43880ca

Download Submit
C:\info.hta

Filesize
5KB

MD5
357f890cea00d8f37120f49ee77525c9

SHA1
fba08a34265dfc80be3d6602db15f2b159b2f83f

SHA256
63e7973899c9ab09a8f85a8b8184a960e989b34234561d708254c0307e92767d

SHA512
1ca31a847d15ec8f74edfd693e195dd5beb1932ae63393dfcdc237c3c6114517746aee53516bbac5570f8f6a72093df460f92fbd5559e46f0006eae9c43880ca

Download Submit
C:\users\public\desktop\info.hta

Filesize
5KB

MD5
357f890cea00d8f37120f49ee77525c9

SHA1
fba08a34265dfc80be3d6602db15f2b159b2f83f

SHA256
63e7973899c9ab09a8f85a8b8184a960e989b34234561d708254c0307e92767d

SHA512
1ca31a847d15ec8f74edfd693e195dd5beb1932ae63393dfcdc237c3c6114517746aee53516bbac5570f8f6a72093df460f92fbd5559e46f0006eae9c43880ca

Download Submit
memory/212-222-0x0000000000000000-mapping.dmp

Download
memory/1736-208-0x0000000000000000-mapping.dmp

Download
memory/2208-497-0x0000000000000000-mapping.dmp

Download
memory/2216-266-0x0000000000000000-mapping.dmp

Download
memory/2676-136-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-143-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-124-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-126-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-125-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-127-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-128-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-129-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-130-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-131-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-132-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-133-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-135-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-134-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-137-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-138-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-139-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-122-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-140-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-141-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-142-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-123-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-144-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-145-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-146-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-148-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-149-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-147-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-150-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-151-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-116-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-117-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-121-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-119-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-120-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2676-118-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/2776-229-0x0000000000000000-mapping.dmp

Download
memory/3320-197-0x0000000000000000-mapping.dmp

Download
memory/3364-343-0x0000000000000000-mapping.dmp

Download
memory/3752-273-0x0000000000000000-mapping.dmp

Download
memory/3876-203-0x0000000000000000-mapping.dmp

Download
memory/4048-442-0x0000000000000000-mapping.dmp

Download
memory/4068-155-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-179-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-165-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-162-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-167-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-168-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-166-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-169-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-171-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-172-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-173-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-174-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-175-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-170-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-176-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-177-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-178-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-164-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-152-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-153-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-154-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-163-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-161-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-160-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-159-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-158-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-157-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4068-156-0x0000000077B40000-0x0000000077CCE000-memory.dmp

Filesize
1.6MB

Download
memory/4304-188-0x0000000000000000-mapping.dmp

Download
memory/4440-206-0x0000000000000000-mapping.dmp

Download
memory/4604-209-0x0000000000000000-mapping.dmp

Download
memory/4696-496-0x0000000000000000-mapping.dmp

Download
memory/4764-187-0x0000000000000000-mapping.dmp

Download
memory/4936-199-0x0000000000000000-mapping.dmp

Download
memory/4964-498-0x0000000000000000-mapping.dmp

Download
memory/5116-201-0x0000000000000000-mapping.dmp

Download