Analysis
-
max time kernel
209s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2024 10:36
Static task
static1
Behavioral task
behavioral1
Sample
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
Resource
win10v2004-20240226-en
General
-
Target
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe
-
Size
629KB
-
MD5
8d43df6614a9f5a25e0c2fc3358623a9
-
SHA1
a0e1da71ca2eedad16782d8fa895ba0545307b9a
-
SHA256
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f
-
SHA512
51060e121416bc91219fb11e0c2aad33b6e10531bc55fd333b9c4810050bff072fd146dc935029cae568bde53a4a38a9eb5eb0b3d47409e1043c5664b6daa030
-
SSDEEP
12288:P4w3Gugeukge5Mv0A4bYut9JFhMP9ctfNjZIU4m8ULUgLC1m4D6UrPg1hB6+kbT2:3rIYYut9JFhMP9ctfNjZIU4m8ULUgLC5
Malware Config
Extracted
C:\info.hta
class='mark'>[email protected]</span></div>
http://www.w3.org/TR/html4/strict.dtd'>
Signatures
-
Phobos
Phobos ransomware appeared at the beginning of 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
Processes:
bcdedit.exebcdedit.exebcdedit.exebcdedit.exepid process 5264 bcdedit.exe 5476 bcdedit.exe 3656 bcdedit.exe 5636 bcdedit.exe -
Renames multiple (503) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Processes:
wbadmin.exewbadmin.exepid process 5904 wbadmin.exe 2004 wbadmin.exe -
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 3952 netsh.exe 3284 netsh.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe -
Drops startup file 3 IoCs
Processes:
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exedescription ioc process File created \??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f = "C:\\Users\\Admin\\AppData\\Local\\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe" bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f = "C:\\Users\\Admin\\AppData\\Local\\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe" bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe -
Drops desktop.ini file(s) 64 IoCs
Processes:
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exedescription ioc process File opened for modification C:\Users\Admin\Links\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Public\Videos\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Public\Music\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\Music\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\Searches\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Public\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Public\Downloads\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\Documents\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-399997616-3400990511-967324271-1000\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files (x86)\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\Videos\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Public\Documents\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Public\Libraries\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Public\Desktop\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-399997616-3400990511-967324271-1000\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Users\Public\Pictures\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\desktop.ini bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exebce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exedescription pid process target process PID 4196 set thread context of 2184 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 set thread context of 5124 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe -
Drops file in Program Files directory 64 IoCs
Processes:
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exedescription ioc process File created C:\Program Files (x86)\Google\Update\1.3.36.151\goopdateres_fil.dll.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\vi.pak.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Lumia.MagicEdit\Pages\ThreeWayBlendPage.xbf bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\uk-ua\ui-strings.js bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogoSmall.contrast-black_scale-140.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_rgb_sse2_plugin.dll.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Sticker_Eye.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.7_1.7.25531.0_x64__8wekyb3d8bbwe\AppxManifest.xml bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\iadata\BlockPair.bin bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\BuildInfo.xml bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\Java\jre-1.8\lib\management\jmxremote.access.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\wxpr.dll bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraMedTile.scale-125.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_reportabuse-default_18.svg.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\bg_patterns_header.png.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\selector.js bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\nl-nl\ui-strings.js bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunjce_provider.jar.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluNoInternetConnection_120x80.svg bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_pdf_18.svg.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ExcelServices.dll bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\msedgeupdateres_eu.dll bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\freebxml.md bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-white_targetsize-32_altform-unplated.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psm1 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-16.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\ExchangeWideTile.scale-200.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-ul-oob.xrm-ms.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\sqmapi.dll bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\CoreEngine\Data\BrushProfile\BrushBump64.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-96.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.17\msedgeupdateres_gu.dll.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hant\PresentationUI.resources.dll.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNotebookLargeTile.scale-200.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\hu-hu\ui-strings.js.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\ui-strings.js bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\jfxswt.jar bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-200.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\progress.gif bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SplashScreen.scale-200_contrast-white.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\Microsoft Office\root\Office16\ExcelFloatieTextModel.bin.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBCTRAC.DLL bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\contrast-black\StoreLogo.scale-100_contrast-black.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sl-si\ui-strings.js.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SpreadsheetIQ.Diagram.dll bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ro-ro\ui-strings.js bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\System\concrt140.dll bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\ext\access-bridge-64.jar bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\it-IT\mshwLatin.dll.mui bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\S-1-5-21-399997616-3400990511-967324271-1000-MergedResources-0.pri bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\msedge.exe.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\Microsoft.VisualBasic.Forms.resources.dll bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\LargeTile.scale-125_contrast-black.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\159.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_contrast-white.png bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\cmm\GRAY.pf.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL.id[4B1FC73D-3483].[[email protected]].8base bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vds.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe -
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 2016 vssadmin.exe 3532 vssadmin.exe -
Modifies registry class 1 IoCs
Processes:
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exebce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exebce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exepid process 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exebce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exebce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exevssvc.exeWMIC.exewbengine.exeWMIC.exedescription pid process Token: SeDebugPrivilege 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe Token: SeDebugPrivilege 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe Token: SeDebugPrivilege 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe Token: SeBackupPrivilege 4284 vssvc.exe Token: SeRestorePrivilege 4284 vssvc.exe Token: SeAuditPrivilege 4284 vssvc.exe Token: SeIncreaseQuotaPrivilege 4528 WMIC.exe Token: SeSecurityPrivilege 4528 WMIC.exe Token: SeTakeOwnershipPrivilege 4528 WMIC.exe Token: SeLoadDriverPrivilege 4528 WMIC.exe Token: SeSystemProfilePrivilege 4528 WMIC.exe Token: SeSystemtimePrivilege 4528 WMIC.exe Token: SeProfSingleProcessPrivilege 4528 WMIC.exe Token: SeIncBasePriorityPrivilege 4528 WMIC.exe Token: SeCreatePagefilePrivilege 4528 WMIC.exe Token: SeBackupPrivilege 4528 WMIC.exe Token: SeRestorePrivilege 4528 WMIC.exe Token: SeShutdownPrivilege 4528 WMIC.exe Token: SeDebugPrivilege 4528 WMIC.exe Token: SeSystemEnvironmentPrivilege 4528 WMIC.exe Token: SeRemoteShutdownPrivilege 4528 WMIC.exe Token: SeUndockPrivilege 4528 WMIC.exe Token: SeManageVolumePrivilege 4528 WMIC.exe Token: 33 4528 WMIC.exe Token: 34 4528 WMIC.exe Token: 35 4528 WMIC.exe Token: 36 4528 WMIC.exe Token: SeIncreaseQuotaPrivilege 4528 WMIC.exe Token: SeSecurityPrivilege 4528 WMIC.exe Token: SeTakeOwnershipPrivilege 4528 WMIC.exe Token: SeLoadDriverPrivilege 4528 WMIC.exe Token: SeSystemProfilePrivilege 4528 WMIC.exe Token: SeSystemtimePrivilege 4528 WMIC.exe Token: SeProfSingleProcessPrivilege 4528 WMIC.exe Token: SeIncBasePriorityPrivilege 4528 WMIC.exe Token: SeCreatePagefilePrivilege 4528 WMIC.exe Token: SeBackupPrivilege 4528 WMIC.exe Token: SeRestorePrivilege 4528 WMIC.exe Token: SeShutdownPrivilege 4528 WMIC.exe Token: SeDebugPrivilege 4528 WMIC.exe Token: SeSystemEnvironmentPrivilege 4528 WMIC.exe Token: SeRemoteShutdownPrivilege 4528 WMIC.exe Token: SeUndockPrivilege 4528 WMIC.exe Token: SeManageVolumePrivilege 4528 WMIC.exe Token: 33 4528 WMIC.exe Token: 34 4528 WMIC.exe Token: 35 4528 WMIC.exe Token: 36 4528 WMIC.exe Token: SeBackupPrivilege 2100 wbengine.exe Token: SeRestorePrivilege 2100 wbengine.exe Token: SeSecurityPrivilege 2100 wbengine.exe Token: SeIncreaseQuotaPrivilege 5640 WMIC.exe Token: SeSecurityPrivilege 5640 WMIC.exe Token: SeTakeOwnershipPrivilege 5640 WMIC.exe Token: SeLoadDriverPrivilege 5640 WMIC.exe Token: SeSystemProfilePrivilege 5640 WMIC.exe Token: SeSystemtimePrivilege 5640 WMIC.exe Token: SeProfSingleProcessPrivilege 5640 WMIC.exe Token: SeIncBasePriorityPrivilege 5640 WMIC.exe Token: SeCreatePagefilePrivilege 5640 WMIC.exe Token: SeBackupPrivilege 5640 WMIC.exe Token: SeRestorePrivilege 5640 WMIC.exe Token: SeShutdownPrivilege 5640 WMIC.exe Token: SeDebugPrivilege 5640 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exebce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exebce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.execmd.execmd.execmd.exedescription pid process target process PID 4196 wrote to memory of 2184 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 4196 wrote to memory of 2184 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 4196 wrote to memory of 2184 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 4196 wrote to memory of 2184 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 4196 wrote to memory of 2184 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 4196 wrote to memory of 2184 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 4196 wrote to memory of 2184 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 4196 wrote to memory of 2184 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 4196 wrote to memory of 2184 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 4196 wrote to memory of 2184 4196 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5012 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5012 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5012 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5124 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5124 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5124 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5124 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5124 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5124 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5124 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5124 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5124 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2988 wrote to memory of 5124 2988 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe PID 2184 wrote to memory of 5460 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe cmd.exe PID 2184 wrote to memory of 5460 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe cmd.exe PID 2184 wrote to memory of 3068 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe cmd.exe PID 2184 wrote to memory of 3068 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe cmd.exe PID 3068 wrote to memory of 3952 3068 cmd.exe netsh.exe PID 5460 wrote to memory of 2016 5460 cmd.exe vssadmin.exe PID 3068 wrote to memory of 3952 3068 cmd.exe netsh.exe PID 5460 wrote to memory of 2016 5460 cmd.exe vssadmin.exe PID 3068 wrote to memory of 3284 3068 cmd.exe netsh.exe PID 3068 wrote to memory of 3284 3068 cmd.exe netsh.exe PID 5460 wrote to memory of 4528 5460 cmd.exe WMIC.exe PID 5460 wrote to memory of 4528 5460 cmd.exe WMIC.exe PID 5460 wrote to memory of 5264 5460 cmd.exe bcdedit.exe PID 5460 wrote to memory of 5264 5460 cmd.exe bcdedit.exe PID 5460 wrote to memory of 5476 5460 cmd.exe bcdedit.exe PID 5460 wrote to memory of 5476 5460 cmd.exe bcdedit.exe PID 5460 wrote to memory of 5904 5460 cmd.exe wbadmin.exe PID 5460 wrote to memory of 5904 5460 cmd.exe wbadmin.exe PID 2184 wrote to memory of 3068 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe mshta.exe PID 2184 wrote to memory of 3068 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe mshta.exe PID 2184 wrote to memory of 3068 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe mshta.exe PID 2184 wrote to memory of 3768 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe mshta.exe PID 2184 wrote to memory of 3768 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe mshta.exe PID 2184 wrote to memory of 3768 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe mshta.exe PID 2184 wrote to memory of 6056 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe mshta.exe PID 2184 wrote to memory of 6056 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe mshta.exe PID 2184 wrote to memory of 6056 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe mshta.exe PID 2184 wrote to memory of 5072 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe mshta.exe PID 2184 wrote to memory of 5072 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe mshta.exe PID 2184 wrote to memory of 5072 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe mshta.exe PID 2184 wrote to memory of 2096 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe cmd.exe PID 2184 wrote to memory of 2096 2184 bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe cmd.exe PID 2096 wrote to memory of 3532 2096 cmd.exe vssadmin.exe PID 2096 wrote to memory of 3532 2096 cmd.exe vssadmin.exe PID 2096 wrote to memory of 5640 2096 cmd.exe WMIC.exe PID 2096 wrote to memory of 5640 2096 cmd.exe WMIC.exe PID 2096 wrote to memory of 3656 2096 cmd.exe bcdedit.exe PID 2096 wrote to memory of 3656 2096 cmd.exe bcdedit.exe PID 2096 wrote to memory of 5636 2096 cmd.exe bcdedit.exe PID 2096 wrote to memory of 5636 2096 cmd.exe bcdedit.exe PID 2096 wrote to memory of 2004 2096 cmd.exe wbadmin.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe"C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exeC:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe2⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe"C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exeC:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe4⤵
-
C:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exeC:\Users\Admin\AppData\Local\Temp\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe4⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall set currentprofile state off4⤵
- Modifies Windows Firewall
-
C:\Windows\system32\netsh.exenetsh firewall set opmode mode=disable4⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet4⤵
- Deletes backup catalog
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\c6c5d55b2fb14c15a882aac133df8042 /t 5344 /p 60561⤵
-
C:\Windows\SysWOW64\werfault.exewerfault.exe /h /shared Global\9f923e0d9d3c46e4bf9b6dc865d352a8 /t 1676 /p 50721⤵
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Indicator Removal
3File Deletion
3Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[4B1FC73D-3483].[[email protected]].8baseFilesize
3.2MB
MD5f5c466fa28f98a140701c76a0b8046a6
SHA149c5ff0c7a5f3a02809a372b273ef1ea4aa7b141
SHA2567764c279e756545af39664a2d830edee42281a43b8c9fa2fa565a1a985ca0587
SHA512e42b2c3c468f1085ea699b203dd9c173a6753950c4bb60dff66db62ef8d9507c099013ea1dcd583f858594d3015d3ba84eca371d28fb55dd3e02b5c20acc0697
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\bce05faf83af5453ac53fce0f7cf2792d35021a949b58a29cc483072672b550f.exe.logFilesize
927B
MD54a911455784f74e368a4c2c7876d76f4
SHA1a1700a0849ffb4f26671eb76da2489946b821c34
SHA256264098e15b5b33d425f3b76e45b7976b58f917048125041135f7e60d8151108c
SHA5124617591400409e1930195795a55e20d5f063042bb3e9fd1955099066e507b6ac8a1e3ae54cc42418e2639149b31bf7e58cd5743670d9030a15e29f14d813815d
-
C:\info.htaFilesize
5KB
MD5cc0aed41c309b4809c890fef364a64fa
SHA197342ddeababc4486cd02ff6c3ba3c02d15cdcdb
SHA2569a27eb5a0ca739270d87398d9e44a09a68b2f4128befe96d104e08c48cc7c8f3
SHA5123d3b7c04bdd25105115eca82eadc5e2d539b0c3cbecd7909a13c6381ee2f4161b8f730e81075f0e6afa63afbf2fee6c203b20463fda429c97f1b8cdfe9cd9b82
-
memory/2184-334-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-241-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-181-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-12028-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-7-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-10-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-9413-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-12-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-1966-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-214-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-1410-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-1392-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-252-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-365-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-31-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-33-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-35-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-53-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-38-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-37-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-64-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-170-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-366-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-1633-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-273-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-188-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-243-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-41-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-272-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-271-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-269-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-275-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2184-251-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2988-19-0x0000000074720000-0x0000000074ED0000-memory.dmpFilesize
7.7MB
-
memory/2988-16-0x00000000054F0000-0x0000000005500000-memory.dmpFilesize
64KB
-
memory/2988-14-0x0000000074720000-0x0000000074ED0000-memory.dmpFilesize
7.7MB
-
memory/2988-15-0x0000000002E70000-0x0000000002EB6000-memory.dmpFilesize
280KB
-
memory/4196-3-0x0000000004FD0000-0x0000000004FE0000-memory.dmpFilesize
64KB
-
memory/4196-0-0x0000000000360000-0x0000000000404000-memory.dmpFilesize
656KB
-
memory/4196-2-0x0000000004EB0000-0x0000000004EF6000-memory.dmpFilesize
280KB
-
memory/4196-1-0x0000000074680000-0x0000000074E30000-memory.dmpFilesize
7.7MB
-
memory/4196-4-0x0000000004EF0000-0x0000000004F24000-memory.dmpFilesize
208KB
-
memory/4196-11-0x0000000074680000-0x0000000074E30000-memory.dmpFilesize
7.7MB
-
memory/4196-6-0x0000000005690000-0x0000000005C34000-memory.dmpFilesize
5.6MB
-
memory/4196-5-0x0000000004F30000-0x0000000004F7C000-memory.dmpFilesize
304KB
-
memory/5124-21-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/5772-12051-0x000001816DF70000-0x000001816DF80000-memory.dmpFilesize
64KB