Analysis
-
max time kernel
155s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 23:03
Behavioral task
behavioral1
Sample
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe
Resource
win7-20220812-en
General
-
Target
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe
-
Size
255KB
-
MD5
cd742cdb95eedee3e635cda77709c40c
-
SHA1
330e49f4db8a90733a28a77597efe1baff38ba37
-
SHA256
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d
-
SHA512
06ec4ee70d7333811d73ed9116c6517f207428884e2a54a9f9684c6cb45afd89681beff07f754099ca2e6a7e898b92040fc03d13b7e625056d575f62114f71ed
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJn:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI0
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
cyhqunddob.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cyhqunddob.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
cyhqunddob.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cyhqunddob.exe -
Processes:
cyhqunddob.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cyhqunddob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cyhqunddob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cyhqunddob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cyhqunddob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cyhqunddob.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
cyhqunddob.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cyhqunddob.exe -
Executes dropped EXE 5 IoCs
Processes:
cyhqunddob.exevdhtoipsvcflrpb.exextnwpyno.exekpkazgrlartff.exextnwpyno.exepid process 1956 cyhqunddob.exe 4900 vdhtoipsvcflrpb.exe 1304 xtnwpyno.exe 1028 kpkazgrlartff.exe 4964 xtnwpyno.exe -
Processes:
resource yara_rule C:\Windows\SysWOW64\cyhqunddob.exe upx C:\Windows\SysWOW64\cyhqunddob.exe upx C:\Windows\SysWOW64\vdhtoipsvcflrpb.exe upx C:\Windows\SysWOW64\xtnwpyno.exe upx C:\Windows\SysWOW64\xtnwpyno.exe upx C:\Windows\SysWOW64\vdhtoipsvcflrpb.exe upx behavioral2/memory/1956-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1700-142-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\kpkazgrlartff.exe upx C:\Windows\SysWOW64\kpkazgrlartff.exe upx behavioral2/memory/4900-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1304-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1028-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1700-149-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1956-150-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4900-151-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1304-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1028-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1700-155-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\xtnwpyno.exe upx behavioral2/memory/4964-158-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe upx behavioral2/memory/4964-170-0x0000000000400000-0x00000000004A0000-memory.dmp upx \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe upx \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
cyhqunddob.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cyhqunddob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cyhqunddob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cyhqunddob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cyhqunddob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" cyhqunddob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cyhqunddob.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
vdhtoipsvcflrpb.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run vdhtoipsvcflrpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dnhgajmn = "cyhqunddob.exe" vdhtoipsvcflrpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wxcndbno = "vdhtoipsvcflrpb.exe" vdhtoipsvcflrpb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "kpkazgrlartff.exe" vdhtoipsvcflrpb.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
xtnwpyno.execyhqunddob.exextnwpyno.exedescription ioc process File opened (read-only) \??\r: xtnwpyno.exe File opened (read-only) \??\g: cyhqunddob.exe File opened (read-only) \??\u: cyhqunddob.exe File opened (read-only) \??\v: cyhqunddob.exe File opened (read-only) \??\b: xtnwpyno.exe File opened (read-only) \??\j: cyhqunddob.exe File opened (read-only) \??\a: xtnwpyno.exe File opened (read-only) \??\g: xtnwpyno.exe File opened (read-only) \??\i: xtnwpyno.exe File opened (read-only) \??\l: xtnwpyno.exe File opened (read-only) \??\g: xtnwpyno.exe File opened (read-only) \??\n: xtnwpyno.exe File opened (read-only) \??\y: xtnwpyno.exe File opened (read-only) \??\o: cyhqunddob.exe File opened (read-only) \??\z: cyhqunddob.exe File opened (read-only) \??\f: xtnwpyno.exe File opened (read-only) \??\t: cyhqunddob.exe File opened (read-only) \??\x: cyhqunddob.exe File opened (read-only) \??\m: xtnwpyno.exe File opened (read-only) \??\a: xtnwpyno.exe File opened (read-only) \??\j: xtnwpyno.exe File opened (read-only) \??\k: xtnwpyno.exe File opened (read-only) \??\w: xtnwpyno.exe File opened (read-only) \??\h: cyhqunddob.exe File opened (read-only) \??\s: cyhqunddob.exe File opened (read-only) \??\o: xtnwpyno.exe File opened (read-only) \??\z: xtnwpyno.exe File opened (read-only) \??\b: cyhqunddob.exe File opened (read-only) \??\f: cyhqunddob.exe File opened (read-only) \??\y: cyhqunddob.exe File opened (read-only) \??\s: xtnwpyno.exe File opened (read-only) \??\f: xtnwpyno.exe File opened (read-only) \??\m: xtnwpyno.exe File opened (read-only) \??\t: xtnwpyno.exe File opened (read-only) \??\k: xtnwpyno.exe File opened (read-only) \??\h: xtnwpyno.exe File opened (read-only) \??\m: cyhqunddob.exe File opened (read-only) \??\e: cyhqunddob.exe File opened (read-only) \??\e: xtnwpyno.exe File opened (read-only) \??\x: xtnwpyno.exe File opened (read-only) \??\x: xtnwpyno.exe File opened (read-only) \??\k: cyhqunddob.exe File opened (read-only) \??\l: cyhqunddob.exe File opened (read-only) \??\p: cyhqunddob.exe File opened (read-only) \??\w: cyhqunddob.exe File opened (read-only) \??\v: xtnwpyno.exe File opened (read-only) \??\y: xtnwpyno.exe File opened (read-only) \??\q: cyhqunddob.exe File opened (read-only) \??\v: xtnwpyno.exe File opened (read-only) \??\q: xtnwpyno.exe File opened (read-only) \??\l: xtnwpyno.exe File opened (read-only) \??\s: xtnwpyno.exe File opened (read-only) \??\z: xtnwpyno.exe File opened (read-only) \??\a: cyhqunddob.exe File opened (read-only) \??\n: cyhqunddob.exe File opened (read-only) \??\r: cyhqunddob.exe File opened (read-only) \??\b: xtnwpyno.exe File opened (read-only) \??\n: xtnwpyno.exe File opened (read-only) \??\r: xtnwpyno.exe File opened (read-only) \??\p: xtnwpyno.exe File opened (read-only) \??\h: xtnwpyno.exe File opened (read-only) \??\t: xtnwpyno.exe File opened (read-only) \??\w: xtnwpyno.exe File opened (read-only) \??\e: xtnwpyno.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
cyhqunddob.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" cyhqunddob.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" cyhqunddob.exe -
AutoIT Executable 13 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/1956-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1700-142-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4900-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1304-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1028-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1700-149-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1956-150-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4900-151-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1304-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1028-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1700-155-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4964-158-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4964-170-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 12 IoCs
Processes:
xtnwpyno.exe61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.execyhqunddob.exextnwpyno.exedescription ioc process File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe xtnwpyno.exe File opened for modification C:\Windows\SysWOW64\vdhtoipsvcflrpb.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll cyhqunddob.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe xtnwpyno.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe xtnwpyno.exe File opened for modification C:\Windows\SysWOW64\xtnwpyno.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File created C:\Windows\SysWOW64\kpkazgrlartff.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File opened for modification C:\Windows\SysWOW64\kpkazgrlartff.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File created C:\Windows\SysWOW64\cyhqunddob.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File opened for modification C:\Windows\SysWOW64\cyhqunddob.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File created C:\Windows\SysWOW64\vdhtoipsvcflrpb.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File created C:\Windows\SysWOW64\xtnwpyno.exe 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe -
Drops file in Program Files directory 14 IoCs
Processes:
xtnwpyno.exextnwpyno.exedescription ioc process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xtnwpyno.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xtnwpyno.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xtnwpyno.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal xtnwpyno.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xtnwpyno.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xtnwpyno.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xtnwpyno.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xtnwpyno.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe xtnwpyno.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal xtnwpyno.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xtnwpyno.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe xtnwpyno.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal xtnwpyno.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal xtnwpyno.exe -
Drops file in Windows directory 3 IoCs
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exeWINWORD.EXEdescription ioc process File opened for modification C:\Windows\mydoc.rtf 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
Processes:
cyhqunddob.exe61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh cyhqunddob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" cyhqunddob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" cyhqunddob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33402D089C2182276D4276A570222CDA7D8164DB" 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193EC77915E1DAB5B8C07CE6ED9034C6" 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat cyhqunddob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EC3B02E47E0389E52CEB9A2329BD7C9" 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFAFCFE482B85699032D7207E97BDE1E133584566436341D7E9" 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" cyhqunddob.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf cyhqunddob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" cyhqunddob.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" cyhqunddob.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc cyhqunddob.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" cyhqunddob.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs cyhqunddob.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg cyhqunddob.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BCAFAB0F965F2E2837F3B31819B3E92B389028C4315034CE2CC459908A8" 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7F56BC2FE6C21DFD208D0A48A749164" 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 5096 WINWORD.EXE 5096 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.execyhqunddob.exevdhtoipsvcflrpb.exextnwpyno.exekpkazgrlartff.exepid process 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1956 cyhqunddob.exe 1956 cyhqunddob.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe 1956 cyhqunddob.exe 4900 vdhtoipsvcflrpb.exe 1956 cyhqunddob.exe 1956 cyhqunddob.exe 1956 cyhqunddob.exe 1956 cyhqunddob.exe 1956 cyhqunddob.exe 1956 cyhqunddob.exe 1956 cyhqunddob.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe 1304 xtnwpyno.exe 1304 xtnwpyno.exe 1304 xtnwpyno.exe 1304 xtnwpyno.exe 1304 xtnwpyno.exe 1304 xtnwpyno.exe 1304 xtnwpyno.exe 1304 xtnwpyno.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.execyhqunddob.exevdhtoipsvcflrpb.exextnwpyno.exekpkazgrlartff.exextnwpyno.exepid process 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1956 cyhqunddob.exe 1956 cyhqunddob.exe 1956 cyhqunddob.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe 1304 xtnwpyno.exe 1304 xtnwpyno.exe 1304 xtnwpyno.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 4964 xtnwpyno.exe 4964 xtnwpyno.exe 4964 xtnwpyno.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.execyhqunddob.exevdhtoipsvcflrpb.exextnwpyno.exekpkazgrlartff.exextnwpyno.exepid process 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe 1956 cyhqunddob.exe 1956 cyhqunddob.exe 1956 cyhqunddob.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe 4900 vdhtoipsvcflrpb.exe 1304 xtnwpyno.exe 1304 xtnwpyno.exe 1304 xtnwpyno.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 1028 kpkazgrlartff.exe 4964 xtnwpyno.exe 4964 xtnwpyno.exe 4964 xtnwpyno.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 5096 WINWORD.EXE 5096 WINWORD.EXE 5096 WINWORD.EXE 5096 WINWORD.EXE 5096 WINWORD.EXE 5096 WINWORD.EXE 5096 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.execyhqunddob.exedescription pid process target process PID 1700 wrote to memory of 1956 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe cyhqunddob.exe PID 1700 wrote to memory of 1956 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe cyhqunddob.exe PID 1700 wrote to memory of 1956 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe cyhqunddob.exe PID 1700 wrote to memory of 4900 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe vdhtoipsvcflrpb.exe PID 1700 wrote to memory of 4900 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe vdhtoipsvcflrpb.exe PID 1700 wrote to memory of 4900 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe vdhtoipsvcflrpb.exe PID 1700 wrote to memory of 1304 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe xtnwpyno.exe PID 1700 wrote to memory of 1304 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe xtnwpyno.exe PID 1700 wrote to memory of 1304 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe xtnwpyno.exe PID 1700 wrote to memory of 1028 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe kpkazgrlartff.exe PID 1700 wrote to memory of 1028 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe kpkazgrlartff.exe PID 1700 wrote to memory of 1028 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe kpkazgrlartff.exe PID 1700 wrote to memory of 5096 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe WINWORD.EXE PID 1700 wrote to memory of 5096 1700 61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe WINWORD.EXE PID 1956 wrote to memory of 4964 1956 cyhqunddob.exe xtnwpyno.exe PID 1956 wrote to memory of 4964 1956 cyhqunddob.exe xtnwpyno.exe PID 1956 wrote to memory of 4964 1956 cyhqunddob.exe xtnwpyno.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe"C:\Users\Admin\AppData\Local\Temp\61a97e8fec20a33d2c9f5b8bd11bf0c698117054ca1d4f2f70b05855bcbdb55d.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\SysWOW64\vdhtoipsvcflrpb.exevdhtoipsvcflrpb.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4900 -
C:\Windows\SysWOW64\kpkazgrlartff.exekpkazgrlartff.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1028 -
C:\Windows\SysWOW64\xtnwpyno.exextnwpyno.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1304 -
C:\Windows\SysWOW64\cyhqunddob.execyhqunddob.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\SysWOW64\xtnwpyno.exeC:\Windows\system32\xtnwpyno.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4964 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:5096
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exeFilesize
255KB
MD54227b1d26a873fd9392b5c151be0fc90
SHA15456be3ce0b7a9608912ae19e27a71b5b0cbbc0b
SHA256b4a6cd6a98ae01f7c80c49a7cd693a7312fe2a340509e68458ebf54569428ec3
SHA512953f13aea8bc746e36d41c98be3d868e52ca8890c14fc934f9c8e40b7f338e431aad72989c89c4e700f0ccb896e479cbb9fd7fe1da3038e420d6999fcabc6058
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
255KB
MD50689f06b8ecd49f5f9bbd032a8c790dd
SHA1417d821ea75c3b42b94eb25471e893e70269d3f1
SHA2567282019854bfdbffc1cfacebabcc5ea14c329786bc1c0692c152eb240cb834ed
SHA5120c0da4ab9abf5e80a041fb8e124b9c3b9856733670446b02238a6828f67db98b7b1db0a520042a92edce009651fb0bb50bbed24dff1f6e8783c17079aacaaab8
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
255KB
MD50689f06b8ecd49f5f9bbd032a8c790dd
SHA1417d821ea75c3b42b94eb25471e893e70269d3f1
SHA2567282019854bfdbffc1cfacebabcc5ea14c329786bc1c0692c152eb240cb834ed
SHA5120c0da4ab9abf5e80a041fb8e124b9c3b9856733670446b02238a6828f67db98b7b1db0a520042a92edce009651fb0bb50bbed24dff1f6e8783c17079aacaaab8
-
C:\Windows\SysWOW64\cyhqunddob.exeFilesize
255KB
MD522a2b2d06c5bf66a99599cf676776d2a
SHA145d2891a779b71cf7816df9c22d676853a24a11e
SHA25622f0badb4785ad986b8db0f3a754a5d1a4ed20c534ec89b5240af6fcc51439df
SHA512ce5455fb32f242ce88678998d867ffc8b464caf518885c61750648b542f4042c7c7ed5099f19ac3b8ce9479f5bae1420716208b4db68fbe3e2b1d9be4224d864
-
C:\Windows\SysWOW64\cyhqunddob.exeFilesize
255KB
MD522a2b2d06c5bf66a99599cf676776d2a
SHA145d2891a779b71cf7816df9c22d676853a24a11e
SHA25622f0badb4785ad986b8db0f3a754a5d1a4ed20c534ec89b5240af6fcc51439df
SHA512ce5455fb32f242ce88678998d867ffc8b464caf518885c61750648b542f4042c7c7ed5099f19ac3b8ce9479f5bae1420716208b4db68fbe3e2b1d9be4224d864
-
C:\Windows\SysWOW64\kpkazgrlartff.exeFilesize
255KB
MD5dac4d15ce9d4506a44c8e9f7bb2b5f3c
SHA1bf64d3a9d338020e2defcaca5189122f3e59affe
SHA256791278ffd083ddb732ceeb28c64090e5b1b64c8977ef651b030f6d5cae7f8ed0
SHA5125c0fa6b079020ac2743e62926a69a5ee2f0196f0ed9be0ece44e3a724f5d821376e9d88dded4c0a61956dd6312b47ac03a83e5ca07882d22672ac07cc518c28d
-
C:\Windows\SysWOW64\kpkazgrlartff.exeFilesize
255KB
MD5dac4d15ce9d4506a44c8e9f7bb2b5f3c
SHA1bf64d3a9d338020e2defcaca5189122f3e59affe
SHA256791278ffd083ddb732ceeb28c64090e5b1b64c8977ef651b030f6d5cae7f8ed0
SHA5125c0fa6b079020ac2743e62926a69a5ee2f0196f0ed9be0ece44e3a724f5d821376e9d88dded4c0a61956dd6312b47ac03a83e5ca07882d22672ac07cc518c28d
-
C:\Windows\SysWOW64\vdhtoipsvcflrpb.exeFilesize
255KB
MD51f6f7a765543dc3f420808d7fed50a0a
SHA1fec69c27d759d6b32904d7c2d16a9c2f734fea16
SHA2561af28daeb438370a00c8356702b0aa3d671aba88e6437980292eb645ef0b1cc1
SHA512a36c46788e1a884628ba240e2c4dbd93ee42caa4b8997c1af04d30d31d6d6a59658876d536e86d61a7791b5641ae7e6d637807b5f5ffdb9e4954d0ac8b1977a4
-
C:\Windows\SysWOW64\vdhtoipsvcflrpb.exeFilesize
255KB
MD51f6f7a765543dc3f420808d7fed50a0a
SHA1fec69c27d759d6b32904d7c2d16a9c2f734fea16
SHA2561af28daeb438370a00c8356702b0aa3d671aba88e6437980292eb645ef0b1cc1
SHA512a36c46788e1a884628ba240e2c4dbd93ee42caa4b8997c1af04d30d31d6d6a59658876d536e86d61a7791b5641ae7e6d637807b5f5ffdb9e4954d0ac8b1977a4
-
C:\Windows\SysWOW64\xtnwpyno.exeFilesize
255KB
MD5f035a76644f22da309e59b0dd671a6eb
SHA1bbf0dcf4932b69af5883dbc0efbf81bfa66d4b9a
SHA256e5a0a1e4097fc0fb21458983419d472c11deb9f91ce46320646b7aedaa406902
SHA512b9c0694a752184fdcc4ad94ddfcc95fab9fa8656d8303eef689565cb1144b6e05a75354653edaa1b0486d07a33be5d6562ac50d72e64ea95102350dedce5a7c8
-
C:\Windows\SysWOW64\xtnwpyno.exeFilesize
255KB
MD5f035a76644f22da309e59b0dd671a6eb
SHA1bbf0dcf4932b69af5883dbc0efbf81bfa66d4b9a
SHA256e5a0a1e4097fc0fb21458983419d472c11deb9f91ce46320646b7aedaa406902
SHA512b9c0694a752184fdcc4ad94ddfcc95fab9fa8656d8303eef689565cb1144b6e05a75354653edaa1b0486d07a33be5d6562ac50d72e64ea95102350dedce5a7c8
-
C:\Windows\SysWOW64\xtnwpyno.exeFilesize
255KB
MD5f035a76644f22da309e59b0dd671a6eb
SHA1bbf0dcf4932b69af5883dbc0efbf81bfa66d4b9a
SHA256e5a0a1e4097fc0fb21458983419d472c11deb9f91ce46320646b7aedaa406902
SHA512b9c0694a752184fdcc4ad94ddfcc95fab9fa8656d8303eef689565cb1144b6e05a75354653edaa1b0486d07a33be5d6562ac50d72e64ea95102350dedce5a7c8
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exeFilesize
255KB
MD5ea4b3ab91bab06489c0a4193b0b37f41
SHA169b4f7fde78c165121182d122af520189ded3e93
SHA2569d95d14b7baf695fdaa862144d4fa9301201f22717d851cccfbfd17c8de33d57
SHA512bdd73acd8ae3073e37b399c2a6f66f34f50d448638662291751b11232de2ecef014a1a1dd5171ad76a94961c5b7585742d0bdb5736586b736cd8e213a66e0980
-
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exeFilesize
255KB
MD5d8ac5f63037661ddbf1040e662ef27b2
SHA126711e47215e16f7bec564df9e60bdecd586e807
SHA25666fab0a15ca71deeba3905209e428289b118b68e521bb5bc6abbd627eed54d21
SHA5121ef5f690407606d4f209c2f19498cd3168d7648d5ac76ab1f450ff85a8f259ed49bc174284152837b4cd6cfe9e6b04a742f1b8100ef9a8be3122205338c66bf5
-
memory/1028-141-0x0000000000000000-mapping.dmp
-
memory/1028-148-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1028-153-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1304-138-0x0000000000000000-mapping.dmp
-
memory/1304-147-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1304-152-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1700-149-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1700-142-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1700-155-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1956-132-0x0000000000000000-mapping.dmp
-
memory/1956-150-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1956-145-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4900-151-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4900-146-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4900-135-0x0000000000000000-mapping.dmp
-
memory/4964-156-0x0000000000000000-mapping.dmp
-
memory/4964-158-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4964-170-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/5096-154-0x0000000000000000-mapping.dmp
-
memory/5096-166-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmpFilesize
64KB
-
memory/5096-167-0x00007FFEC40F0000-0x00007FFEC4100000-memory.dmpFilesize
64KB
-
memory/5096-168-0x00007FFEC40F0000-0x00007FFEC4100000-memory.dmpFilesize
64KB
-
memory/5096-165-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmpFilesize
64KB
-
memory/5096-164-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmpFilesize
64KB
-
memory/5096-163-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmpFilesize
64KB
-
memory/5096-162-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmpFilesize
64KB
-
memory/5096-174-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmpFilesize
64KB
-
memory/5096-175-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmpFilesize
64KB
-
memory/5096-176-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmpFilesize
64KB
-
memory/5096-177-0x00007FFEC6450000-0x00007FFEC6460000-memory.dmpFilesize
64KB