4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475

Analysis

max time kernel
187s
max time network
34s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 17:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Size

45KB
MD5

0a55a7fb53951bd641630925954bec57
SHA1

a78a373a36add2a44d47aea4659eed74aa67f0b1
SHA256

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475
SHA512

571fd59005f7e5668d440f02a1f04b600e65be5c9e23bc2d5bb659475fa5526f0927e5a86cb10f6391f55b00295eed43f438c6abbba12f4d6bf6204abef0e8cd
SSDEEP

768:E1AuwHyeFo6NPIFAoslbf8eRYLGXdoIFbb5omuKWcbsvwnoT9D88888888888JXD:EOxyeFo6NPCAosxYyXdF5oy3VoKD

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

SVCHOST.EXE4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exeCTFMON.EXESPOOLSV.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\recycled\\SVCHOST.exe,"	SPOOLSV.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\""	SPOOLSV.EXE

Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

CTFMON.EXESPOOLSV.EXESVCHOST.EXE4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	CTFMON.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SPOOLSV.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	SVCHOST.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

SVCHOST.EXE4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exeCTFMON.EXESPOOLSV.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SVCHOST.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	CTFMON.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	SPOOLSV.EXE

Executes dropped EXE 12 IoCs

Processes:

SVCHOST.EXESVCHOST.EXESPOOLSV.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXECTFMON.EXESPOOLSV.EXECTFMON.EXE

pid	process
1048	SVCHOST.EXE
1556	SVCHOST.EXE
1848	SPOOLSV.EXE
1044	SVCHOST.EXE
1536	SPOOLSV.EXE
1860	CTFMON.EXE
1260	SVCHOST.EXE
2040	SPOOLSV.EXE
1820	CTFMON.EXE
904	CTFMON.EXE
984	SPOOLSV.EXE
1380	CTFMON.EXE

Loads dropped DLL 15 IoCs

Processes:

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exeSVCHOST.EXESPOOLSV.EXECTFMON.EXE

pid	process
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1048	SVCHOST.EXE
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

description ioc process

File opened for modification C:\Recycled\desktop.ini 4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

description	ioc	process
File opened for modification	C:\Recycled\desktop.ini	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

SVCHOST.EXESPOOLSV.EXECTFMON.EXE4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

description	ioc	process
File opened (read-only)	\??\Y:	SVCHOST.EXE
File opened (read-only)	\??\Z:	SVCHOST.EXE
File opened (read-only)	\??\Q:	SPOOLSV.EXE
File opened (read-only)	\??\Z:	SPOOLSV.EXE
File opened (read-only)	\??\S:	CTFMON.EXE
File opened (read-only)	\??\V:	CTFMON.EXE
File opened (read-only)	\??\X:	CTFMON.EXE
File opened (read-only)	\??\H:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\O:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\M:	SVCHOST.EXE
File opened (read-only)	\??\O:	SVCHOST.EXE
File opened (read-only)	\??\S:	SVCHOST.EXE
File opened (read-only)	\??\Y:	CTFMON.EXE
File opened (read-only)	\??\G:	CTFMON.EXE
File opened (read-only)	\??\F:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\M:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\U:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\T:	SVCHOST.EXE
File opened (read-only)	\??\J:	SPOOLSV.EXE
File opened (read-only)	\??\K:	SPOOLSV.EXE
File opened (read-only)	\??\U:	SPOOLSV.EXE
File opened (read-only)	\??\I:	CTFMON.EXE
File opened (read-only)	\??\U:	CTFMON.EXE
File opened (read-only)	\??\L:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\Q:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\G:	SVCHOST.EXE
File opened (read-only)	\??\Q:	SVCHOST.EXE
File opened (read-only)	\??\F:	SPOOLSV.EXE
File opened (read-only)	\??\L:	SPOOLSV.EXE
File opened (read-only)	\??\T:	SPOOLSV.EXE
File opened (read-only)	\??\W:	CTFMON.EXE
File opened (read-only)	\??\X:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\Z:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\F:	SVCHOST.EXE
File opened (read-only)	\??\G:	SPOOLSV.EXE
File opened (read-only)	\??\I:	SPOOLSV.EXE
File opened (read-only)	\??\X:	SPOOLSV.EXE
File opened (read-only)	\??\Y:	SPOOLSV.EXE
File opened (read-only)	\??\N:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\Y:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\T:	CTFMON.EXE
File opened (read-only)	\??\E:	SVCHOST.EXE
File opened (read-only)	\??\P:	SVCHOST.EXE
File opened (read-only)	\??\V:	SVCHOST.EXE
File opened (read-only)	\??\M:	CTFMON.EXE
File opened (read-only)	\??\N:	CTFMON.EXE
File opened (read-only)	\??\P:	CTFMON.EXE
File opened (read-only)	\??\W:	SPOOLSV.EXE
File opened (read-only)	\??\G:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\W:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\H:	SVCHOST.EXE
File opened (read-only)	\??\I:	SVCHOST.EXE
File opened (read-only)	\??\N:	SVCHOST.EXE
File opened (read-only)	\??\O:	SPOOLSV.EXE
File opened (read-only)	\??\V:	SPOOLSV.EXE
File opened (read-only)	\??\F:	CTFMON.EXE
File opened (read-only)	\??\E:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\S:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\M:	SPOOLSV.EXE
File opened (read-only)	\??\O:	CTFMON.EXE
File opened (read-only)	\??\Q:	CTFMON.EXE
File opened (read-only)	\??\P:	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened (read-only)	\??\U:	SVCHOST.EXE
File opened (read-only)	\??\H:	SPOOLSV.EXE

Drops file in Windows directory 2 IoCs

Processes:

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exeWINWORD.EXE

description	ioc	process
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

WINWORD.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE

Modifies registry class 64 IoCs

Processes:

WINWORD.EXE4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exeSPOOLSV.EXESVCHOST.EXECTFMON.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SPOOLSV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG\COMMAND	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	SVCHOST.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\	CTFMON.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size"	SVCHOST.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SVCHOST.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size"	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe"	SPOOLSV.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document"	SPOOLSV.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

WINWORD.EXE

pid process

524 WINWORD.EXE

pid	process
524	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

CTFMON.EXESPOOLSV.EXESVCHOST.EXE4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

pid	process
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1848	SPOOLSV.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1048	SVCHOST.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
1860	CTFMON.EXE
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe

Suspicious use of SetWindowsHookEx 15 IoCs

Processes:

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exeSVCHOST.EXESVCHOST.EXESPOOLSV.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXECTFMON.EXESPOOLSV.EXECTFMON.EXEWINWORD.EXE

pid	process
964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
1048	SVCHOST.EXE
1556	SVCHOST.EXE
1848	SPOOLSV.EXE
1044	SVCHOST.EXE
1536	SPOOLSV.EXE
1860	CTFMON.EXE
1260	SVCHOST.EXE
2040	SPOOLSV.EXE
1820	CTFMON.EXE
904	CTFMON.EXE
984	SPOOLSV.EXE
1380	CTFMON.EXE
524	WINWORD.EXE
524	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exeSVCHOST.EXESPOOLSV.EXECTFMON.EXEuserinit.exeWINWORD.EXE

description	pid	process	target process
PID 964 wrote to memory of 1048	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SVCHOST.EXE
PID 964 wrote to memory of 1048	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SVCHOST.EXE
PID 964 wrote to memory of 1048	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SVCHOST.EXE
PID 964 wrote to memory of 1048	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SVCHOST.EXE
PID 1048 wrote to memory of 1556	1048	SVCHOST.EXE	SVCHOST.EXE
PID 1048 wrote to memory of 1556	1048	SVCHOST.EXE	SVCHOST.EXE
PID 1048 wrote to memory of 1556	1048	SVCHOST.EXE	SVCHOST.EXE
PID 1048 wrote to memory of 1556	1048	SVCHOST.EXE	SVCHOST.EXE
PID 1048 wrote to memory of 1848	1048	SVCHOST.EXE	SPOOLSV.EXE
PID 1048 wrote to memory of 1848	1048	SVCHOST.EXE	SPOOLSV.EXE
PID 1048 wrote to memory of 1848	1048	SVCHOST.EXE	SPOOLSV.EXE
PID 1048 wrote to memory of 1848	1048	SVCHOST.EXE	SPOOLSV.EXE
PID 1848 wrote to memory of 1044	1848	SPOOLSV.EXE	SVCHOST.EXE
PID 1848 wrote to memory of 1044	1848	SPOOLSV.EXE	SVCHOST.EXE
PID 1848 wrote to memory of 1044	1848	SPOOLSV.EXE	SVCHOST.EXE
PID 1848 wrote to memory of 1044	1848	SPOOLSV.EXE	SVCHOST.EXE
PID 1848 wrote to memory of 1536	1848	SPOOLSV.EXE	SPOOLSV.EXE
PID 1848 wrote to memory of 1536	1848	SPOOLSV.EXE	SPOOLSV.EXE
PID 1848 wrote to memory of 1536	1848	SPOOLSV.EXE	SPOOLSV.EXE
PID 1848 wrote to memory of 1536	1848	SPOOLSV.EXE	SPOOLSV.EXE
PID 1848 wrote to memory of 1860	1848	SPOOLSV.EXE	CTFMON.EXE
PID 1848 wrote to memory of 1860	1848	SPOOLSV.EXE	CTFMON.EXE
PID 1848 wrote to memory of 1860	1848	SPOOLSV.EXE	CTFMON.EXE
PID 1848 wrote to memory of 1860	1848	SPOOLSV.EXE	CTFMON.EXE
PID 1860 wrote to memory of 1260	1860	CTFMON.EXE	SVCHOST.EXE
PID 1860 wrote to memory of 1260	1860	CTFMON.EXE	SVCHOST.EXE
PID 1860 wrote to memory of 1260	1860	CTFMON.EXE	SVCHOST.EXE
PID 1860 wrote to memory of 1260	1860	CTFMON.EXE	SVCHOST.EXE
PID 1860 wrote to memory of 2040	1860	CTFMON.EXE	SPOOLSV.EXE
PID 1860 wrote to memory of 2040	1860	CTFMON.EXE	SPOOLSV.EXE
PID 1860 wrote to memory of 2040	1860	CTFMON.EXE	SPOOLSV.EXE
PID 1860 wrote to memory of 2040	1860	CTFMON.EXE	SPOOLSV.EXE
PID 1860 wrote to memory of 1820	1860	CTFMON.EXE	CTFMON.EXE
PID 1860 wrote to memory of 1820	1860	CTFMON.EXE	CTFMON.EXE
PID 1860 wrote to memory of 1820	1860	CTFMON.EXE	CTFMON.EXE
PID 1860 wrote to memory of 1820	1860	CTFMON.EXE	CTFMON.EXE
PID 1048 wrote to memory of 904	1048	SVCHOST.EXE	CTFMON.EXE
PID 1048 wrote to memory of 904	1048	SVCHOST.EXE	CTFMON.EXE
PID 1048 wrote to memory of 904	1048	SVCHOST.EXE	CTFMON.EXE
PID 1048 wrote to memory of 904	1048	SVCHOST.EXE	CTFMON.EXE
PID 964 wrote to memory of 984	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SPOOLSV.EXE
PID 964 wrote to memory of 984	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SPOOLSV.EXE
PID 964 wrote to memory of 984	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SPOOLSV.EXE
PID 964 wrote to memory of 984	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	SPOOLSV.EXE
PID 964 wrote to memory of 1380	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	CTFMON.EXE
PID 964 wrote to memory of 1380	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	CTFMON.EXE
PID 964 wrote to memory of 1380	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	CTFMON.EXE
PID 964 wrote to memory of 1380	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	CTFMON.EXE
PID 1048 wrote to memory of 1976	1048	SVCHOST.EXE	userinit.exe
PID 1048 wrote to memory of 1976	1048	SVCHOST.EXE	userinit.exe
PID 1048 wrote to memory of 1976	1048	SVCHOST.EXE	userinit.exe
PID 1048 wrote to memory of 1976	1048	SVCHOST.EXE	userinit.exe
PID 1976 wrote to memory of 1496	1976	userinit.exe	Explorer.exe
PID 1976 wrote to memory of 1496	1976	userinit.exe	Explorer.exe
PID 1976 wrote to memory of 1496	1976	userinit.exe	Explorer.exe
PID 1976 wrote to memory of 1496	1976	userinit.exe	Explorer.exe
PID 964 wrote to memory of 524	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	WINWORD.EXE
PID 964 wrote to memory of 524	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	WINWORD.EXE
PID 964 wrote to memory of 524	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	WINWORD.EXE
PID 964 wrote to memory of 524	964	4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe	WINWORD.EXE
PID 524 wrote to memory of 1752	524	WINWORD.EXE	splwow64.exe
PID 524 wrote to memory of 1752	524	WINWORD.EXE	splwow64.exe
PID 524 wrote to memory of 1752	524	WINWORD.EXE	splwow64.exe
PID 524 wrote to memory of 1752	524	WINWORD.EXE	splwow64.exe

C:\Users\Admin\AppData\Local\Temp\4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe
"C:\Users\Admin\AppData\Local\Temp\4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1048

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1556

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1044

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1536

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1860

C:\recycled\SVCHOST.EXE
C:\recycled\SVCHOST.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1260

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2040

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1820

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:904

C:\Windows\SysWOW64\userinit.exe
C:\Windows\system32\userinit.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\Explorer.exe
Explorer.exe "C:\recycled\SVCHOST.exe"
4⤵
PID:1496

C:\recycled\SPOOLSV.EXE
C:\recycled\SPOOLSV.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:984

C:\recycled\CTFMON.EXE
C:\recycled\CTFMON.EXE :agent
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1380

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\4704beb76220f05db53d767ef764256d6ff0831e47b382523aff135e18906475.doc"
2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:524

C:\Windows\splwow64.exe
C:\Windows\splwow64.exe 12288
3⤵
PID:1752

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recycled\CTFMON.EXE

Filesize
45KB

MD5
695b992d485e5c4bbde744ecaddff1af

SHA1
5079bd4582cbc51cccc35d22eb757a410dfb9add

SHA256
eef99ffcecf47fac9b8ba8044f64a17c569e7841ef93c08bc990243828e3bd5e

SHA512
5ec71332177ce3a18d78a9321e6a0ddb60cd4b41695a316ed148aaa138dee9c183bb8f076ff7c93ca83b0c0c3d2a91d25a8cb082f0cfab0ed931af4080b7126a

Download Submit
C:\Recycled\CTFMON.EXE

Filesize
45KB

MD5
695b992d485e5c4bbde744ecaddff1af

SHA1
5079bd4582cbc51cccc35d22eb757a410dfb9add

SHA256
eef99ffcecf47fac9b8ba8044f64a17c569e7841ef93c08bc990243828e3bd5e

SHA512
5ec71332177ce3a18d78a9321e6a0ddb60cd4b41695a316ed148aaa138dee9c183bb8f076ff7c93ca83b0c0c3d2a91d25a8cb082f0cfab0ed931af4080b7126a

Download Submit
C:\Recycled\CTFMON.EXE

Filesize
45KB

MD5
695b992d485e5c4bbde744ecaddff1af

SHA1
5079bd4582cbc51cccc35d22eb757a410dfb9add

SHA256
eef99ffcecf47fac9b8ba8044f64a17c569e7841ef93c08bc990243828e3bd5e

SHA512
5ec71332177ce3a18d78a9321e6a0ddb60cd4b41695a316ed148aaa138dee9c183bb8f076ff7c93ca83b0c0c3d2a91d25a8cb082f0cfab0ed931af4080b7126a

Download Submit
C:\Recycled\CTFMON.EXE

Filesize
45KB

MD5
695b992d485e5c4bbde744ecaddff1af

SHA1
5079bd4582cbc51cccc35d22eb757a410dfb9add

SHA256
eef99ffcecf47fac9b8ba8044f64a17c569e7841ef93c08bc990243828e3bd5e

SHA512
5ec71332177ce3a18d78a9321e6a0ddb60cd4b41695a316ed148aaa138dee9c183bb8f076ff7c93ca83b0c0c3d2a91d25a8cb082f0cfab0ed931af4080b7126a

Download Submit
C:\Recycled\SPOOLSV.EXE

Filesize
45KB

MD5
56ec09eb1d6435406cbb20370be3bab3

SHA1
e73de823ac06261851f9c8208e7c73374d5bfdc9

SHA256
ad0a2f948357d823f252ebcc8899a2dc70df97818f3a6079434a7e76f81bc6d4

SHA512
2e90c8d0894db8e4a75796ff81878e7fd25bb782ddc30451e3493bb089aa94008784c672b7ea092cdf28b65b4b9fe51b34e8e277e5dbac7a4b1b5acc307766a5

Download Submit
C:\Recycled\SPOOLSV.EXE

Filesize
45KB

MD5
56ec09eb1d6435406cbb20370be3bab3

SHA1
e73de823ac06261851f9c8208e7c73374d5bfdc9

SHA256
ad0a2f948357d823f252ebcc8899a2dc70df97818f3a6079434a7e76f81bc6d4

SHA512
2e90c8d0894db8e4a75796ff81878e7fd25bb782ddc30451e3493bb089aa94008784c672b7ea092cdf28b65b4b9fe51b34e8e277e5dbac7a4b1b5acc307766a5

Download Submit
C:\Recycled\SPOOLSV.EXE

Filesize
45KB

MD5
56ec09eb1d6435406cbb20370be3bab3

SHA1
e73de823ac06261851f9c8208e7c73374d5bfdc9

SHA256
ad0a2f948357d823f252ebcc8899a2dc70df97818f3a6079434a7e76f81bc6d4

SHA512
2e90c8d0894db8e4a75796ff81878e7fd25bb782ddc30451e3493bb089aa94008784c672b7ea092cdf28b65b4b9fe51b34e8e277e5dbac7a4b1b5acc307766a5

Download Submit
C:\Recycled\SPOOLSV.EXE

Filesize
45KB

MD5
56ec09eb1d6435406cbb20370be3bab3

SHA1
e73de823ac06261851f9c8208e7c73374d5bfdc9

SHA256
ad0a2f948357d823f252ebcc8899a2dc70df97818f3a6079434a7e76f81bc6d4

SHA512
2e90c8d0894db8e4a75796ff81878e7fd25bb782ddc30451e3493bb089aa94008784c672b7ea092cdf28b65b4b9fe51b34e8e277e5dbac7a4b1b5acc307766a5

Download Submit
C:\Recycled\SVCHOST.EXE

Filesize
45KB

MD5
4e4061cdbb8fffa966f6c989fce347ac

SHA1
e0dae69000286013fa9ea124103056de4d280b81

SHA256
005df68bc48286f656667462d3b53f228aff8c89d49ddd7114d230310cb4ef19

SHA512
74c81b8eb59d4395ba9a71b29e4be5930aa154fac4719e0dbcd9c732ad4803544991aa7a64e3a496621d163af161796b2b7280d7fa5139929f4d55e8459fc51e

Download Submit
C:\Recycled\SVCHOST.EXE

Filesize
45KB

MD5
4e4061cdbb8fffa966f6c989fce347ac

SHA1
e0dae69000286013fa9ea124103056de4d280b81

SHA256
005df68bc48286f656667462d3b53f228aff8c89d49ddd7114d230310cb4ef19

SHA512
74c81b8eb59d4395ba9a71b29e4be5930aa154fac4719e0dbcd9c732ad4803544991aa7a64e3a496621d163af161796b2b7280d7fa5139929f4d55e8459fc51e

Download Submit
C:\Recycled\SVCHOST.EXE

Filesize
45KB

MD5
4e4061cdbb8fffa966f6c989fce347ac

SHA1
e0dae69000286013fa9ea124103056de4d280b81

SHA256
005df68bc48286f656667462d3b53f228aff8c89d49ddd7114d230310cb4ef19

SHA512
74c81b8eb59d4395ba9a71b29e4be5930aa154fac4719e0dbcd9c732ad4803544991aa7a64e3a496621d163af161796b2b7280d7fa5139929f4d55e8459fc51e

Download Submit
C:\Recycled\SVCHOST.EXE

Filesize
45KB

MD5
4e4061cdbb8fffa966f6c989fce347ac

SHA1
e0dae69000286013fa9ea124103056de4d280b81

SHA256
005df68bc48286f656667462d3b53f228aff8c89d49ddd7114d230310cb4ef19

SHA512
74c81b8eb59d4395ba9a71b29e4be5930aa154fac4719e0dbcd9c732ad4803544991aa7a64e3a496621d163af161796b2b7280d7fa5139929f4d55e8459fc51e

Download Submit
C:\Recycled\desktop.ini

Filesize
65B

MD5
ad0b0b4416f06af436328a3c12dc491b

SHA1
743c7ad130780de78ccbf75aa6f84298720ad3fa

SHA256
23521de51ca1db2bc7b18e41de7693542235284667bf85f6c31902547a947416

SHA512
884cd0cae3b31a594f387dae94fc1e0aacb4fd833f8a3368bdec7de0f9f3dc44337c7318895d9549aad579f95de71ff45e1618e75065a04c7894ad1d0d0eac56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt

Filesize
1KB

MD5
0269b6347e473980c5378044ac67aa1f

SHA1
c3334de50e320ad8bce8398acff95c363d039245

SHA256
68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2

SHA512
e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt

Filesize
1KB

MD5
0269b6347e473980c5378044ac67aa1f

SHA1
c3334de50e320ad8bce8398acff95c363d039245

SHA256
68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2

SHA512
e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Flu Burung.txt

Filesize
1KB

MD5
0269b6347e473980c5378044ac67aa1f

SHA1
c3334de50e320ad8bce8398acff95c363d039245

SHA256
68f5bd85c17975419bb4eacf615286d749bcb951e487813361837580b39ffee2

SHA512
e5c525fe688ecd3926ae634a61dc48c4837d7e56aae00b22e4f7d824df804cb536f6df077d5f6c67f63f73832ba00249ed3a75ed40ec9db6e026041b28404d7b

Download Submit
C:\recycled\CTFMON.EXE

Filesize
45KB

MD5
695b992d485e5c4bbde744ecaddff1af

SHA1
5079bd4582cbc51cccc35d22eb757a410dfb9add

SHA256
eef99ffcecf47fac9b8ba8044f64a17c569e7841ef93c08bc990243828e3bd5e

SHA512
5ec71332177ce3a18d78a9321e6a0ddb60cd4b41695a316ed148aaa138dee9c183bb8f076ff7c93ca83b0c0c3d2a91d25a8cb082f0cfab0ed931af4080b7126a

Download Submit
C:\recycled\SPOOLSV.EXE

Filesize
45KB

MD5
56ec09eb1d6435406cbb20370be3bab3

SHA1
e73de823ac06261851f9c8208e7c73374d5bfdc9

SHA256
ad0a2f948357d823f252ebcc8899a2dc70df97818f3a6079434a7e76f81bc6d4

SHA512
2e90c8d0894db8e4a75796ff81878e7fd25bb782ddc30451e3493bb089aa94008784c672b7ea092cdf28b65b4b9fe51b34e8e277e5dbac7a4b1b5acc307766a5

Download Submit
C:\recycled\SVCHOST.exe

Filesize
45KB

MD5
4e4061cdbb8fffa966f6c989fce347ac

SHA1
e0dae69000286013fa9ea124103056de4d280b81

SHA256
005df68bc48286f656667462d3b53f228aff8c89d49ddd7114d230310cb4ef19

SHA512
74c81b8eb59d4395ba9a71b29e4be5930aa154fac4719e0dbcd9c732ad4803544991aa7a64e3a496621d163af161796b2b7280d7fa5139929f4d55e8459fc51e

Download Submit
\Recycled\CTFMON.EXE

Filesize
45KB

MD5
695b992d485e5c4bbde744ecaddff1af

SHA1
5079bd4582cbc51cccc35d22eb757a410dfb9add

SHA256
eef99ffcecf47fac9b8ba8044f64a17c569e7841ef93c08bc990243828e3bd5e

SHA512
5ec71332177ce3a18d78a9321e6a0ddb60cd4b41695a316ed148aaa138dee9c183bb8f076ff7c93ca83b0c0c3d2a91d25a8cb082f0cfab0ed931af4080b7126a

Download Submit
\Recycled\CTFMON.EXE

Filesize
45KB

MD5
695b992d485e5c4bbde744ecaddff1af

SHA1
5079bd4582cbc51cccc35d22eb757a410dfb9add

SHA256
eef99ffcecf47fac9b8ba8044f64a17c569e7841ef93c08bc990243828e3bd5e

SHA512
5ec71332177ce3a18d78a9321e6a0ddb60cd4b41695a316ed148aaa138dee9c183bb8f076ff7c93ca83b0c0c3d2a91d25a8cb082f0cfab0ed931af4080b7126a

Download Submit
\Recycled\CTFMON.EXE

Filesize
45KB

MD5
695b992d485e5c4bbde744ecaddff1af

SHA1
5079bd4582cbc51cccc35d22eb757a410dfb9add

SHA256
eef99ffcecf47fac9b8ba8044f64a17c569e7841ef93c08bc990243828e3bd5e

SHA512
5ec71332177ce3a18d78a9321e6a0ddb60cd4b41695a316ed148aaa138dee9c183bb8f076ff7c93ca83b0c0c3d2a91d25a8cb082f0cfab0ed931af4080b7126a

Download Submit
\Recycled\CTFMON.EXE

Filesize
45KB

MD5
695b992d485e5c4bbde744ecaddff1af

SHA1
5079bd4582cbc51cccc35d22eb757a410dfb9add

SHA256
eef99ffcecf47fac9b8ba8044f64a17c569e7841ef93c08bc990243828e3bd5e

SHA512
5ec71332177ce3a18d78a9321e6a0ddb60cd4b41695a316ed148aaa138dee9c183bb8f076ff7c93ca83b0c0c3d2a91d25a8cb082f0cfab0ed931af4080b7126a

Download Submit
\Recycled\SPOOLSV.EXE

Filesize
45KB

MD5
56ec09eb1d6435406cbb20370be3bab3

SHA1
e73de823ac06261851f9c8208e7c73374d5bfdc9

SHA256
ad0a2f948357d823f252ebcc8899a2dc70df97818f3a6079434a7e76f81bc6d4

SHA512
2e90c8d0894db8e4a75796ff81878e7fd25bb782ddc30451e3493bb089aa94008784c672b7ea092cdf28b65b4b9fe51b34e8e277e5dbac7a4b1b5acc307766a5

Download Submit
\Recycled\SPOOLSV.EXE

Filesize
45KB

MD5
56ec09eb1d6435406cbb20370be3bab3

SHA1
e73de823ac06261851f9c8208e7c73374d5bfdc9

SHA256
ad0a2f948357d823f252ebcc8899a2dc70df97818f3a6079434a7e76f81bc6d4

SHA512
2e90c8d0894db8e4a75796ff81878e7fd25bb782ddc30451e3493bb089aa94008784c672b7ea092cdf28b65b4b9fe51b34e8e277e5dbac7a4b1b5acc307766a5

Download Submit
\Recycled\SPOOLSV.EXE

Filesize
45KB

MD5
56ec09eb1d6435406cbb20370be3bab3

SHA1
e73de823ac06261851f9c8208e7c73374d5bfdc9

SHA256
ad0a2f948357d823f252ebcc8899a2dc70df97818f3a6079434a7e76f81bc6d4

SHA512
2e90c8d0894db8e4a75796ff81878e7fd25bb782ddc30451e3493bb089aa94008784c672b7ea092cdf28b65b4b9fe51b34e8e277e5dbac7a4b1b5acc307766a5

Download Submit
\Recycled\SPOOLSV.EXE

Filesize
45KB

MD5
56ec09eb1d6435406cbb20370be3bab3

SHA1
e73de823ac06261851f9c8208e7c73374d5bfdc9

SHA256
ad0a2f948357d823f252ebcc8899a2dc70df97818f3a6079434a7e76f81bc6d4

SHA512
2e90c8d0894db8e4a75796ff81878e7fd25bb782ddc30451e3493bb089aa94008784c672b7ea092cdf28b65b4b9fe51b34e8e277e5dbac7a4b1b5acc307766a5

Download Submit
\Recycled\SPOOLSV.EXE

Filesize
45KB

MD5
56ec09eb1d6435406cbb20370be3bab3

SHA1
e73de823ac06261851f9c8208e7c73374d5bfdc9

SHA256
ad0a2f948357d823f252ebcc8899a2dc70df97818f3a6079434a7e76f81bc6d4

SHA512
2e90c8d0894db8e4a75796ff81878e7fd25bb782ddc30451e3493bb089aa94008784c672b7ea092cdf28b65b4b9fe51b34e8e277e5dbac7a4b1b5acc307766a5

Download Submit
\Recycled\SPOOLSV.EXE

Filesize
45KB

MD5
56ec09eb1d6435406cbb20370be3bab3

SHA1
e73de823ac06261851f9c8208e7c73374d5bfdc9

SHA256
ad0a2f948357d823f252ebcc8899a2dc70df97818f3a6079434a7e76f81bc6d4

SHA512
2e90c8d0894db8e4a75796ff81878e7fd25bb782ddc30451e3493bb089aa94008784c672b7ea092cdf28b65b4b9fe51b34e8e277e5dbac7a4b1b5acc307766a5

Download Submit
\Recycled\SPOOLSV.EXE

Filesize
45KB

MD5
56ec09eb1d6435406cbb20370be3bab3

SHA1
e73de823ac06261851f9c8208e7c73374d5bfdc9

SHA256
ad0a2f948357d823f252ebcc8899a2dc70df97818f3a6079434a7e76f81bc6d4

SHA512
2e90c8d0894db8e4a75796ff81878e7fd25bb782ddc30451e3493bb089aa94008784c672b7ea092cdf28b65b4b9fe51b34e8e277e5dbac7a4b1b5acc307766a5

Download Submit
\Recycled\SVCHOST.EXE

Filesize
45KB

MD5
4e4061cdbb8fffa966f6c989fce347ac

SHA1
e0dae69000286013fa9ea124103056de4d280b81

SHA256
005df68bc48286f656667462d3b53f228aff8c89d49ddd7114d230310cb4ef19

SHA512
74c81b8eb59d4395ba9a71b29e4be5930aa154fac4719e0dbcd9c732ad4803544991aa7a64e3a496621d163af161796b2b7280d7fa5139929f4d55e8459fc51e

Download Submit
\Recycled\SVCHOST.EXE

Filesize
45KB

MD5
4e4061cdbb8fffa966f6c989fce347ac

SHA1
e0dae69000286013fa9ea124103056de4d280b81

SHA256
005df68bc48286f656667462d3b53f228aff8c89d49ddd7114d230310cb4ef19

SHA512
74c81b8eb59d4395ba9a71b29e4be5930aa154fac4719e0dbcd9c732ad4803544991aa7a64e3a496621d163af161796b2b7280d7fa5139929f4d55e8459fc51e

Download Submit
\Recycled\SVCHOST.EXE

Filesize
45KB

MD5
4e4061cdbb8fffa966f6c989fce347ac

SHA1
e0dae69000286013fa9ea124103056de4d280b81

SHA256
005df68bc48286f656667462d3b53f228aff8c89d49ddd7114d230310cb4ef19

SHA512
74c81b8eb59d4395ba9a71b29e4be5930aa154fac4719e0dbcd9c732ad4803544991aa7a64e3a496621d163af161796b2b7280d7fa5139929f4d55e8459fc51e

Download Submit
\Recycled\SVCHOST.EXE

Filesize
45KB

MD5
4e4061cdbb8fffa966f6c989fce347ac

SHA1
e0dae69000286013fa9ea124103056de4d280b81

SHA256
005df68bc48286f656667462d3b53f228aff8c89d49ddd7114d230310cb4ef19

SHA512
74c81b8eb59d4395ba9a71b29e4be5930aa154fac4719e0dbcd9c732ad4803544991aa7a64e3a496621d163af161796b2b7280d7fa5139929f4d55e8459fc51e

Download Submit
memory/524-159-0x000000007156D000-0x0000000071578000-memory.dmp

Filesize
44KB

Download
memory/524-157-0x000000007156D000-0x0000000071578000-memory.dmp

Filesize
44KB

Download
memory/524-155-0x0000000070581000-0x0000000070583000-memory.dmp

Filesize
8KB

Download
memory/524-152-0x0000000000000000-mapping.dmp

Download
memory/524-154-0x0000000072B01000-0x0000000072B04000-memory.dmp

Filesize
12KB

Download
memory/524-156-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/528-151-0x000007FEFC011000-0x000007FEFC013000-memory.dmp

Filesize
8KB

Download
memory/904-124-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/904-120-0x0000000000000000-mapping.dmp

Download
memory/964-132-0x0000000000360000-0x000000000037A000-memory.dmp

Filesize
104KB

Download
memory/964-54-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/964-149-0x0000000000360000-0x000000000037A000-memory.dmp

Filesize
104KB

Download
memory/964-153-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/964-131-0x0000000002600000-0x000000000261A000-memory.dmp

Filesize
104KB

Download
memory/964-57-0x0000000075E61000-0x0000000075E63000-memory.dmp

Filesize
8KB

Download
memory/984-127-0x0000000000000000-mapping.dmp

Download
memory/984-135-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1044-87-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1044-82-0x0000000000000000-mapping.dmp

Download
memory/1048-139-0x0000000001E70000-0x0000000001E8A000-memory.dmp

Filesize
104KB

Download
memory/1048-137-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1048-162-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1048-138-0x0000000001E70000-0x0000000001E8A000-memory.dmp

Filesize
104KB

Download
memory/1048-60-0x0000000000000000-mapping.dmp

Download
memory/1260-103-0x0000000000000000-mapping.dmp

Download
memory/1380-134-0x0000000000000000-mapping.dmp

Download
memory/1380-145-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1496-148-0x00000000749B1000-0x00000000749B3000-memory.dmp

Filesize
8KB

Download
memory/1496-146-0x0000000000000000-mapping.dmp

Download
memory/1536-88-0x0000000000000000-mapping.dmp

Download
memory/1536-92-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1556-67-0x0000000000000000-mapping.dmp

Download
memory/1556-71-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1752-160-0x0000000000000000-mapping.dmp

Download
memory/1820-113-0x0000000000000000-mapping.dmp

Download
memory/1820-118-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1848-75-0x0000000000000000-mapping.dmp

Download
memory/1848-140-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1860-96-0x0000000000000000-mapping.dmp

Download
memory/1860-163-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1860-141-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/1976-144-0x0000000000000000-mapping.dmp

Download
memory/2040-114-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2040-109-0x0000000000000000-mapping.dmp

Download