Overview
overview
10Static
static
10067f997e6f...40.exe
windows10-2004-x64
100c0c9a19db...c1.exe
windows10-2004-x64
101a8f35d0f2...b9.exe
windows10-2004-x64
2354403f00...3b.exe
windows10-2004-x64
240ac12f9c...0b.exe
windows10-2004-x64
10276727bfac...36.exe
windows10-2004-x64
10280a75ca5c...8e.exe
windows10-2004-x64
2e8af1ad4b...51.exe
windows10-2004-x64
1032c51906c1...ec.exe
windows10-2004-x64
3e84def5ee...96.exe
windows10-2004-x64
403b8f1ce9...40.exe
windows10-2004-x64
4731758b5f...25.exe
windows10-2004-x64
94c21b335ba...49.exe
windows10-2004-x64
104c99ac9f69...35.exe
windows10-2004-x64
4fbbd67a32...a7.exe
windows10-2004-x64
10622e2834e5...95.exe
windows10-2004-x64
106734e7474c...fd.exe
windows10-2004-x64
67a00565a4...5d.exe
windows10-2004-x64
6e228df5e4...62.exe
windows10-2004-x64
7b93299c45...03.exe
windows10-2004-x64
7c2a9bae3b...c1.exe
windows10-2004-x64
107d9c97a133...b5.exe
windows10-2004-x64
1083b294975e...74.exe
windows10-2004-x64
9b0cfabed9...8e.exe
windows10-2004-x64
10aa63528bf7...cd.exe
windows10-2004-x64
b54d6dc708...7d.exe
windows10-2004-x64
10b6b2c1f4bb...00.exe
windows10-2004-x64
10ba43b2eb48...fb.exe
windows10-2004-x64
cc43fc18d6...e8.exe
windows10-2004-x64
10d50b23e12c...af.exe
windows10-2004-x64
10ebb17d81ff...0f.exe
windows10-2004-x64
ec09cfa4a7...da.exe
windows10-2004-x64
10Resubmissions
16-03-2024 17:17
240316-vtswysfd2y 1016-03-2024 15:31
240316-syg9xafg39 1015-03-2024 08:15
240315-j5rmgsbg5z 10Analysis
-
max time kernel
608s -
max time network
615s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16-03-2024 17:17
Behavioral task
behavioral1
Sample
067f997e6fe9eac1a47d9a54d6dd22414721ad895e6352714a11779de8d66540.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
0c0c9a19db1f89d94ddcd8af54fa631798e3ccc82743faae6d9818759f2dbcc1.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral4
Sample
2354403f00f096f700e5616ed1a5ccd40fe53a1bb35a5e93e429f5f24fa4483b.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
240ac12f9c13ef1fdfbc77e16978f0423a41a3cc1c3dcb8786ba8e7672811f0b.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral6
Sample
276727bfacdeba0ba864fd6ccecab5fd0f244576dc503d7cf148a4deb90fc136.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
280a75ca5ca5dc8e106f6f6e2005fe3e23b6c35e296d5639b00b5b6daba8c38e.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
2e8af1ad4bb1e9f1bfdd3a04bf28363bbcdb3653e6aa4864f61b09c050378d51.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
32c51906c182c8c92afbc93cbe674d1b24d855f5f4f0c4c82d076691cce4c7ec.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
3e84def5eeae88ab28d21de08581e68e46fd9a94b5fee35d609d6f73a92a9e96.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
403b8f1ce98aeb6f4a7cfc23693c5a9799e0239806a4850b4eaad58ab7bedb40.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
4731758b5f792686547e861c6bd86ccf88ddb63cba6fa6b048a46cfc5f146325.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
4c21b335baf9907cfaec588f25354b804b3d59f3882d923fbaf0d929b933ef49.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral14
Sample
4c99ac9f69cf03b60583b12f94fe442da74178f53030bd2b7703b1d53da6a135.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
4fbbd67a32384a485efb0efb9e958a9f7b7a879d3945b16ccf80a8580bd935a7.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral16
Sample
622e2834e51caa303d120c7503d8fcce671226a0342d7be0f8cf546b44cee195.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
6734e7474c81f5b7b0c006a17b79f59e3281f45f03910ddeeae2ea05291655fd.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral18
Sample
67a00565a4c5fc9f08543cb10bfa3858801f87a558e21ad36d514c9bedb10e5d.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
6e228df5e458ddcd6a9b5284418b6101cb988315d3910f1b422d511135acd462.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral20
Sample
7b93299c4559e89716a9b37f4a43c1b084c610ad1d9d8e462a1383320e299503.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral22
Sample
7d9c97a133997396b0625a5d2b762fb8b333f5152d4dd893c7a463cc41372ab5.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
83b294975e094024bdeb90f5cdeb9832304cf6879a27eee5cfe08650e5731674.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral24
Sample
9b0cfabed9fbf6b05c74e5a31eb500fea0691c84fa736dd25e8e5013a35f038e.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
aa63528bf720d3f9b31e91945a576afa4c609a09c07b3bbfc29351d760a71ccd.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral26
Sample
b54d6dc708eade0818fcf91e59c7dbe37267abbe43a1672fb5f1c126e021ad7d.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
b6b2c1f4bbe4259e0279a0c3db98a69db12ab6ae0b549085c714f1497f3c8300.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral28
Sample
ba43b2eb4865f24c9e04bdd6cd885202267e831ef797df32eb602dd91ff36ffb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
cc43fc18d6d1dc662ad747652cd961152ee13dbf2cea9bf75564f3e2e8ffd2e8.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral30
Sample
d50b23e12c661bb78fa3cb317e679fabc4178600048572368bec173a520e4aaf.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
ebb17d81ffb02c01b4f49c7267246f243272ca2aecda68a44e89a33f74a47a0f.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral32
Sample
ec09cfa4a79d709daed859d1a0e131aaa994f4a7b4bed80406125db76446fbda.exe
Resource
win10v2004-20240226-en
General
-
Target
7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe
-
Size
56KB
-
MD5
e3d064afc3476b131db81cd483a5c87a
-
SHA1
600fc81eddb1a44ae97e9565cab9d22363dd3711
-
SHA256
7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1
-
SHA512
76b9dd263f9daa1ae9abb01eb8ab78f4871d49c8a4474138fee45ce791faf760608fb7f2817aae4e031c81b1563167ba3cb0efce3d25c97ac9b1bf6e79a43874
-
SSDEEP
1536:eNeRBl5PT/rx1mzwRMSTdLpJ1/4aE2i9hfVxOD+H:eQRrmzwR5JV/E2G5VYD+H
Malware Config
Extracted
C:\info.hta
class='mark'>hensaxxx12@tutanota.com</span></div>
class='mark'>hensa12@cock.li</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 2368 bcdedit.exe 3984 bcdedit.exe 2364 bcdedit.exe 4204 bcdedit.exe -
Renames multiple (503) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exewbadmin.exepid process 1660 wbadmin.exe 4368 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 952 netsh.exe 4044 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe -
Drops startup file 3 IoCs
Processes:
7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1 = "C:\\Users\\Admin\\AppData\\Local\\7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe" 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1 = "C:\\Users\\Admin\\AppData\\Local\\7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe" 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exedescription ioc process File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\Links\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Public\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Public\Music\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-557049126-2506969350-2798870634-1000\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Public\Documents\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files (x86)\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Public\Videos\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-557049126-2506969350-2798870634-1000\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe -
Drops file in Program Files directory 64 IoCs
Processes:
7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exedescription ioc process File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PIXEL\PIXEL.INF.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Java\jre-1.8\lib\meta-index.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART9.BDR 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageAppList.targetsize-24_contrast-black.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\InkObj.dll.mui 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\xerces.md 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\psmachine.dll 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-32.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-black_scale-100.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-64.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Microsoft Office\root\vreg\proof.es-es.msi.16.es-es.vreg.dat.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketchAppService\ReadMe.txt 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-72.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN058.XML 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-125_contrast-black.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_close_h2x.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Microsoft.SqlServer.Configuration.SString.dll 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-72_altform-unplated.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\libEGL.dll.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\hijrah-config-umalqura.properties.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial2-pl.xrm-ms.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.MSOUC.16.1033.hxn 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\VideoLAN\VLC\lua\playlist\rockbox_fm_presets.luac.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libspeex_resampler_plugin.dll.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-40_altform-unplated_contrast-white.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Java\jre-1.8\legal\javafx\public_suffix.md.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-48_altform-colorize.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Microsoft Office\root\Templates\1033\OriginReport.Dotx.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\libcompressor_plugin.dll 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libscale_plugin.dll 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\fr\System.Data.Services.resources.dll 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderLogoExtensions.targetsize-256.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreSmallTile.scale-200.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestResults.Tests.ps1 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\XLMACRO.CHM.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\libcaf_plugin.dll 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteNewNoteMedTile.scale-100.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorAppList.targetsize-20_altform-unplated.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-16.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Functions\Assertions\Should.Tests.ps1 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ul-oob.xrm-ms 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER.XLAM.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordcnvr.dll.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\msvcp120.dll.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\AUDIOSEARCHSAPIFE.DLL.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe.manifest.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\LiveTile\4px.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\OrientationControlInnerCircleHover.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libyuy2_i420_plugin.dll.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\plugin.js.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Microsoft Office\root\Office16\DBGCORE.DLL.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Generic-Dark.scale-250.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\StoreLogo.scale-200.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\msipc.dll.mui 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxhelper.exe.manifest.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-16_altform-unplated.png 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Private.CoreLib.dll.id[503ADD58-3435].[hensaxxx12@tutanota.com].faust 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Examples\Calculator\Add-Numbers.Tests.ps1 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vds.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 3752 vssadmin.exe 1652 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000_Classes\Local Settings 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exepid process 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe Token: SeBackupPrivilege 3056 vssvc.exe Token: SeRestorePrivilege 3056 vssvc.exe Token: SeAuditPrivilege 3056 vssvc.exe Token: SeIncreaseQuotaPrivilege 4156 WMIC.exe Token: SeSecurityPrivilege 4156 WMIC.exe Token: SeTakeOwnershipPrivilege 4156 WMIC.exe Token: SeLoadDriverPrivilege 4156 WMIC.exe Token: SeSystemProfilePrivilege 4156 WMIC.exe Token: SeSystemtimePrivilege 4156 WMIC.exe Token: SeProfSingleProcessPrivilege 4156 WMIC.exe Token: SeIncBasePriorityPrivilege 4156 WMIC.exe Token: SeCreatePagefilePrivilege 4156 WMIC.exe Token: SeBackupPrivilege 4156 WMIC.exe Token: SeRestorePrivilege 4156 WMIC.exe Token: SeShutdownPrivilege 4156 WMIC.exe Token: SeDebugPrivilege 4156 WMIC.exe Token: SeSystemEnvironmentPrivilege 4156 WMIC.exe Token: SeRemoteShutdownPrivilege 4156 WMIC.exe Token: SeUndockPrivilege 4156 WMIC.exe Token: SeManageVolumePrivilege 4156 WMIC.exe Token: 33 4156 WMIC.exe Token: 34 4156 WMIC.exe Token: 35 4156 WMIC.exe Token: 36 4156 WMIC.exe Token: SeIncreaseQuotaPrivilege 4156 WMIC.exe Token: SeSecurityPrivilege 4156 WMIC.exe Token: SeTakeOwnershipPrivilege 4156 WMIC.exe Token: SeLoadDriverPrivilege 4156 WMIC.exe Token: SeSystemProfilePrivilege 4156 WMIC.exe Token: SeSystemtimePrivilege 4156 WMIC.exe Token: SeProfSingleProcessPrivilege 4156 WMIC.exe Token: SeIncBasePriorityPrivilege 4156 WMIC.exe Token: SeCreatePagefilePrivilege 4156 WMIC.exe Token: SeBackupPrivilege 4156 WMIC.exe Token: SeRestorePrivilege 4156 WMIC.exe Token: SeShutdownPrivilege 4156 WMIC.exe Token: SeDebugPrivilege 4156 WMIC.exe Token: SeSystemEnvironmentPrivilege 4156 WMIC.exe Token: SeRemoteShutdownPrivilege 4156 WMIC.exe Token: SeUndockPrivilege 4156 WMIC.exe Token: SeManageVolumePrivilege 4156 WMIC.exe Token: 33 4156 WMIC.exe Token: 34 4156 WMIC.exe Token: 35 4156 WMIC.exe Token: 36 4156 WMIC.exe Token: SeBackupPrivilege 692 wbengine.exe Token: SeRestorePrivilege 692 wbengine.exe Token: SeSecurityPrivilege 692 wbengine.exe Token: SeIncreaseQuotaPrivilege 3276 WMIC.exe Token: SeSecurityPrivilege 3276 WMIC.exe Token: SeTakeOwnershipPrivilege 3276 WMIC.exe Token: SeLoadDriverPrivilege 3276 WMIC.exe Token: SeSystemProfilePrivilege 3276 WMIC.exe Token: SeSystemtimePrivilege 3276 WMIC.exe Token: SeProfSingleProcessPrivilege 3276 WMIC.exe Token: SeIncBasePriorityPrivilege 3276 WMIC.exe Token: SeCreatePagefilePrivilege 3276 WMIC.exe Token: SeBackupPrivilege 3276 WMIC.exe Token: SeRestorePrivilege 3276 WMIC.exe Token: SeShutdownPrivilege 3276 WMIC.exe Token: SeDebugPrivilege 3276 WMIC.exe Token: SeSystemEnvironmentPrivilege 3276 WMIC.exe Token: SeRemoteShutdownPrivilege 3276 WMIC.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.execmd.execmd.execmd.exedescription pid process target process PID 3860 wrote to memory of 1204 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe cmd.exe PID 3860 wrote to memory of 1204 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe cmd.exe PID 3860 wrote to memory of 2292 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe cmd.exe PID 3860 wrote to memory of 2292 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe cmd.exe PID 1204 wrote to memory of 952 1204 cmd.exe netsh.exe PID 1204 wrote to memory of 952 1204 cmd.exe netsh.exe PID 2292 wrote to memory of 3752 2292 cmd.exe vssadmin.exe PID 2292 wrote to memory of 3752 2292 cmd.exe vssadmin.exe PID 2292 wrote to memory of 4156 2292 cmd.exe WMIC.exe PID 2292 wrote to memory of 4156 2292 cmd.exe WMIC.exe PID 1204 wrote to memory of 4044 1204 cmd.exe netsh.exe PID 1204 wrote to memory of 4044 1204 cmd.exe netsh.exe PID 2292 wrote to memory of 2368 2292 cmd.exe bcdedit.exe PID 2292 wrote to memory of 2368 2292 cmd.exe bcdedit.exe PID 2292 wrote to memory of 3984 2292 cmd.exe bcdedit.exe PID 2292 wrote to memory of 3984 2292 cmd.exe bcdedit.exe PID 2292 wrote to memory of 1660 2292 cmd.exe wbadmin.exe PID 2292 wrote to memory of 1660 2292 cmd.exe wbadmin.exe PID 3860 wrote to memory of 220 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe mshta.exe PID 3860 wrote to memory of 220 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe mshta.exe PID 3860 wrote to memory of 220 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe mshta.exe PID 3860 wrote to memory of 2740 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe mshta.exe PID 3860 wrote to memory of 2740 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe mshta.exe PID 3860 wrote to memory of 2740 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe mshta.exe PID 3860 wrote to memory of 1964 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe mshta.exe PID 3860 wrote to memory of 1964 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe mshta.exe PID 3860 wrote to memory of 1964 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe mshta.exe PID 3860 wrote to memory of 4972 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe mshta.exe PID 3860 wrote to memory of 4972 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe mshta.exe PID 3860 wrote to memory of 4972 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe mshta.exe PID 3860 wrote to memory of 2808 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe cmd.exe PID 3860 wrote to memory of 2808 3860 7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe cmd.exe PID 2808 wrote to memory of 1652 2808 cmd.exe vssadmin.exe PID 2808 wrote to memory of 1652 2808 cmd.exe vssadmin.exe PID 2808 wrote to memory of 3276 2808 cmd.exe WMIC.exe PID 2808 wrote to memory of 3276 2808 cmd.exe WMIC.exe PID 2808 wrote to memory of 2364 2808 cmd.exe bcdedit.exe PID 2808 wrote to memory of 2364 2808 cmd.exe bcdedit.exe PID 2808 wrote to memory of 4204 2808 cmd.exe bcdedit.exe PID 2808 wrote to memory of 4204 2808 cmd.exe bcdedit.exe PID 2808 wrote to memory of 4368 2808 cmd.exe wbadmin.exe PID 2808 wrote to memory of 4368 2808 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe"C:\Users\Admin\AppData\Local\Temp\7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe"C:\Users\Admin\AppData\Local\Temp\7c2a9bae3bbdc9e38516754d76a192d6a3ce37849c06a8a8d3b06fb7f75916c1.exe"2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off3⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable3⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}2⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
3File Deletion
3Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.id[503ADD58-3435].[hensaxxx12@tutanota.com].faustFilesize
2.9MB
MD5bc8c48a547ea3e6fbb1719a71c72e3ae
SHA1b1fb3ebe8a3b06162b86cd7b973868ef9b7c3fa9
SHA2567800bd6c4f9ba72ca55775fad7fa17ba949be513fb66ebe0c5a17d77f644b141
SHA5125adf0c332de7631d51a39e448d3a8e8581e6ae605b403aa5ad369f93af67765cdd679479d49d0f8bfd6553315cabb86854390f864c524c7584b63122ed1fbdac
-
C:\info.htaFilesize
5KB
MD5486fa8fdfe530b3877b461b1c57447f7
SHA111374c60baaa5f51e3314edd7d48252280922b9a
SHA256cf6d77455168351df0f9fb436f0e295356302809a627c26a5b94574198d31e86
SHA51221837b94803b51d43ca5779c651cd81a64ab50fed8b4200397b67c0dce2f556dcf507bf96e31ff4cad871407453e22e862449ffa0016e9ec73aa01552aa37b1c
-
memory/4288-12061-0x0000019210980000-0x0000019210990000-memory.dmpFilesize
64KB
-
memory/4288-12077-0x0000019210A80000-0x0000019210A90000-memory.dmpFilesize
64KB
-
memory/4288-12096-0x0000019218CB0000-0x0000019218CB1000-memory.dmpFilesize
4KB
-
memory/4288-12098-0x0000019218DF0000-0x0000019218DF1000-memory.dmpFilesize
4KB
-
memory/4288-12100-0x0000019218DF0000-0x0000019218DF1000-memory.dmpFilesize
4KB
-
memory/4288-12101-0x0000019218E00000-0x0000019218E01000-memory.dmpFilesize
4KB
-
memory/4288-12102-0x0000019218E00000-0x0000019218E01000-memory.dmpFilesize
4KB
-
memory/4288-12103-0x0000019218E00000-0x0000019218E01000-memory.dmpFilesize
4KB
-
memory/4288-12104-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12105-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12106-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12107-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12108-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12109-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12110-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12111-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12112-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12113-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12114-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12115-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12116-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12117-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12118-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12119-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12120-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12121-0x0000019218E20000-0x0000019218E21000-memory.dmpFilesize
4KB
-
memory/4288-12122-0x0000019218E30000-0x0000019218E31000-memory.dmpFilesize
4KB
-
memory/4288-12123-0x0000019218E30000-0x0000019218E31000-memory.dmpFilesize
4KB
-
memory/4288-12124-0x0000019218F40000-0x0000019218F41000-memory.dmpFilesize
4KB
-
memory/4288-12125-0x0000019218E90000-0x0000019218E91000-memory.dmpFilesize
4KB
-
memory/4288-12126-0x0000019218E90000-0x0000019218E91000-memory.dmpFilesize
4KB