Analysis
-
max time kernel
178s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 06:53
Behavioral task
behavioral1
Sample
da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe
Resource
win10v2004-20221111-en
General
-
Target
da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe
-
Size
42KB
-
MD5
a74fe7c347e88d87ab704086bc6cba7e
-
SHA1
555cd82d2d7c2852c495cea5107fe3c363724783
-
SHA256
da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655
-
SHA512
9740ec82128b0002e0a6d4439f7d41e671dd934f501bf09a12c6ed55618b815364ad17751084ec656c528743e8615af85021c859440eff35205a36092f75554c
-
SSDEEP
768:gyz0/XBwayCUOwV3TNZHdrPeqzEWvpbPwSMX6+w6pqZxLdeVgol9D8888888888q:hzOCay4wV339rPjzbpLwRJ9pSdoIT
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 8 IoCs
Processes:
da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exeCTFMON.EXESPOOLSV.EXESVCHOST.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" CTFMON.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" CTFMON.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\recycled\\SVCHOST.exe\"" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\Fonts\\\u00a0Explorer.exe\"" da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 4 IoCs
Processes:
CTFMON.EXESPOOLSV.EXESVCHOST.EXEda9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" CTFMON.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SPOOLSV.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" SVCHOST.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 4 IoCs
Processes:
da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exeCTFMON.EXESPOOLSV.EXESVCHOST.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" CTFMON.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SPOOLSV.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" SVCHOST.EXE -
Processes:
resource yara_rule \Recycled\SVCHOST.EXE aspack_v212_v242 C:\Recycled\SVCHOST.EXE aspack_v212_v242 \Recycled\SVCHOST.EXE aspack_v212_v242 C:\recycled\SVCHOST.exe aspack_v212_v242 C:\Windows\Fonts\ Explorer.exe aspack_v212_v242 C:\Recycled\SVCHOST.EXE aspack_v212_v242 C:\recycled\SPOOLSV.EXE aspack_v212_v242 \Recycled\SPOOLSV.EXE aspack_v212_v242 \Recycled\SPOOLSV.EXE aspack_v212_v242 C:\Recycled\SPOOLSV.EXE aspack_v212_v242 C:\Windows\Fonts\ Explorer.exe aspack_v212_v242 \Recycled\SVCHOST.EXE aspack_v212_v242 C:\Recycled\SVCHOST.EXE aspack_v212_v242 \Recycled\SPOOLSV.EXE aspack_v212_v242 C:\Recycled\SPOOLSV.EXE aspack_v212_v242 C:\Recycled\CTFMON.EXE aspack_v212_v242 \Recycled\CTFMON.EXE aspack_v212_v242 C:\recycled\CTFMON.EXE aspack_v212_v242 \Recycled\CTFMON.EXE aspack_v212_v242 C:\Windows\Fonts\ Explorer.exe aspack_v212_v242 C:\Recycled\SVCHOST.EXE aspack_v212_v242 \Recycled\SVCHOST.EXE aspack_v212_v242 \Recycled\SPOOLSV.EXE aspack_v212_v242 \Recycled\SPOOLSV.EXE aspack_v212_v242 C:\Recycled\SPOOLSV.EXE aspack_v212_v242 C:\Recycled\CTFMON.EXE aspack_v212_v242 C:\Recycled\CTFMON.EXE aspack_v212_v242 \Recycled\CTFMON.EXE aspack_v212_v242 \Recycled\SPOOLSV.EXE aspack_v212_v242 \Recycled\SPOOLSV.EXE aspack_v212_v242 C:\Recycled\SPOOLSV.EXE aspack_v212_v242 \Recycled\CTFMON.EXE aspack_v212_v242 C:\Recycled\CTFMON.EXE aspack_v212_v242 -
Executes dropped EXE 12 IoCs
Processes:
SVCHOST.EXESVCHOST.EXESPOOLSV.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXECTFMON.EXESPOOLSV.EXECTFMON.EXEpid process 580 SVCHOST.EXE 1496 SVCHOST.EXE 1300 SPOOLSV.EXE 1268 SVCHOST.EXE 1384 SPOOLSV.EXE 292 CTFMON.EXE 1452 SVCHOST.EXE 1668 SPOOLSV.EXE 1660 CTFMON.EXE 1392 CTFMON.EXE 316 SPOOLSV.EXE 1864 CTFMON.EXE -
Loads dropped DLL 15 IoCs
Processes:
da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exeSVCHOST.EXESPOOLSV.EXECTFMON.EXEpid process 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 580 SVCHOST.EXE 580 SVCHOST.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 580 SVCHOST.EXE 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exedescription ioc process File opened for modification C:\Recycled\desktop.ini da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
SVCHOST.EXESPOOLSV.EXECTFMON.EXEda9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exedescription ioc process File opened (read-only) \??\Y: SVCHOST.EXE File opened (read-only) \??\K: SPOOLSV.EXE File opened (read-only) \??\O: SPOOLSV.EXE File opened (read-only) \??\G: CTFMON.EXE File opened (read-only) \??\Q: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\U: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\E: SVCHOST.EXE File opened (read-only) \??\Q: SVCHOST.EXE File opened (read-only) \??\T: CTFMON.EXE File opened (read-only) \??\X: SPOOLSV.EXE File opened (read-only) \??\O: CTFMON.EXE File opened (read-only) \??\R: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\X: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\F: SVCHOST.EXE File opened (read-only) \??\I: SPOOLSV.EXE File opened (read-only) \??\X: CTFMON.EXE File opened (read-only) \??\N: SVCHOST.EXE File opened (read-only) \??\W: SVCHOST.EXE File opened (read-only) \??\P: CTFMON.EXE File opened (read-only) \??\W: CTFMON.EXE File opened (read-only) \??\Y: CTFMON.EXE File opened (read-only) \??\H: SVCHOST.EXE File opened (read-only) \??\Z: SVCHOST.EXE File opened (read-only) \??\F: SPOOLSV.EXE File opened (read-only) \??\Q: CTFMON.EXE File opened (read-only) \??\I: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\U: SVCHOST.EXE File opened (read-only) \??\Y: SPOOLSV.EXE File opened (read-only) \??\H: CTFMON.EXE File opened (read-only) \??\I: SVCHOST.EXE File opened (read-only) \??\T: SVCHOST.EXE File opened (read-only) \??\G: SPOOLSV.EXE File opened (read-only) \??\V: SPOOLSV.EXE File opened (read-only) \??\E: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\O: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\Y: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\G: SVCHOST.EXE File opened (read-only) \??\K: SVCHOST.EXE File opened (read-only) \??\P: SVCHOST.EXE File opened (read-only) \??\U: SPOOLSV.EXE File opened (read-only) \??\N: CTFMON.EXE File opened (read-only) \??\S: SPOOLSV.EXE File opened (read-only) \??\M: CTFMON.EXE File opened (read-only) \??\S: CTFMON.EXE File opened (read-only) \??\O: SVCHOST.EXE File opened (read-only) \??\S: SVCHOST.EXE File opened (read-only) \??\J: SPOOLSV.EXE File opened (read-only) \??\N: SPOOLSV.EXE File opened (read-only) \??\N: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\M: SVCHOST.EXE File opened (read-only) \??\P: SPOOLSV.EXE File opened (read-only) \??\Z: SPOOLSV.EXE File opened (read-only) \??\L: CTFMON.EXE File opened (read-only) \??\K: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\M: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\P: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\L: SPOOLSV.EXE File opened (read-only) \??\G: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\X: SVCHOST.EXE File opened (read-only) \??\F: CTFMON.EXE File opened (read-only) \??\R: CTFMON.EXE File opened (read-only) \??\H: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\T: da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened (read-only) \??\R: SPOOLSV.EXE -
Drops file in Windows directory 6 IoCs
Processes:
CTFMON.EXEWINWORD.EXEda9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exeSVCHOST.EXESPOOLSV.EXEdescription ioc process File opened for modification C:\Windows\Fonts\ Explorer.exe CTFMON.EXE File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\docicon.exe da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe File opened for modification C:\Windows\Fonts\ Explorer.exe SVCHOST.EXE File opened for modification C:\Windows\Fonts\ Explorer.exe SPOOLSV.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exeWINWORD.EXESPOOLSV.EXESVCHOST.EXECTFMON.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\SHELL\CONFIG\COMMAND da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SPOOLSV.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\TileInfo = "prop:Type;Size" SVCHOST.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" CTFMON.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SPOOLSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.8\DefaultIcon\ = "C:\\Windows\\Installer\\{90140000-0011-0000-0000-0000000FF1CE}\\docicon.exe" SVCHOST.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\QuickTip = "prop:Type;Size" da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "Microsoft Word 97 - 2003 Document" CTFMON.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" SPOOLSV.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\InfoTip = "prop:Type;Write;Size" da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 896 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
CTFMON.EXESPOOLSV.EXESVCHOST.EXEda9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exepid process 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 292 CTFMON.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 292 CTFMON.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 1300 SPOOLSV.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 580 SVCHOST.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 580 SVCHOST.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE 292 CTFMON.EXE -
Suspicious use of SetWindowsHookEx 15 IoCs
Processes:
da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exeSVCHOST.EXESVCHOST.EXESPOOLSV.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXESVCHOST.EXESPOOLSV.EXECTFMON.EXECTFMON.EXESPOOLSV.EXECTFMON.EXEWINWORD.EXEpid process 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe 580 SVCHOST.EXE 1496 SVCHOST.EXE 1300 SPOOLSV.EXE 1268 SVCHOST.EXE 1384 SPOOLSV.EXE 292 CTFMON.EXE 1452 SVCHOST.EXE 1668 SPOOLSV.EXE 1660 CTFMON.EXE 1392 CTFMON.EXE 316 SPOOLSV.EXE 1864 CTFMON.EXE 896 WINWORD.EXE 896 WINWORD.EXE -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exeSVCHOST.EXESPOOLSV.EXECTFMON.EXEWINWORD.EXEdescription pid process target process PID 1616 wrote to memory of 580 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe SVCHOST.EXE PID 1616 wrote to memory of 580 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe SVCHOST.EXE PID 1616 wrote to memory of 580 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe SVCHOST.EXE PID 1616 wrote to memory of 580 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe SVCHOST.EXE PID 580 wrote to memory of 1496 580 SVCHOST.EXE SVCHOST.EXE PID 580 wrote to memory of 1496 580 SVCHOST.EXE SVCHOST.EXE PID 580 wrote to memory of 1496 580 SVCHOST.EXE SVCHOST.EXE PID 580 wrote to memory of 1496 580 SVCHOST.EXE SVCHOST.EXE PID 580 wrote to memory of 1300 580 SVCHOST.EXE SPOOLSV.EXE PID 580 wrote to memory of 1300 580 SVCHOST.EXE SPOOLSV.EXE PID 580 wrote to memory of 1300 580 SVCHOST.EXE SPOOLSV.EXE PID 580 wrote to memory of 1300 580 SVCHOST.EXE SPOOLSV.EXE PID 1300 wrote to memory of 1268 1300 SPOOLSV.EXE SVCHOST.EXE PID 1300 wrote to memory of 1268 1300 SPOOLSV.EXE SVCHOST.EXE PID 1300 wrote to memory of 1268 1300 SPOOLSV.EXE SVCHOST.EXE PID 1300 wrote to memory of 1268 1300 SPOOLSV.EXE SVCHOST.EXE PID 1300 wrote to memory of 1384 1300 SPOOLSV.EXE SPOOLSV.EXE PID 1300 wrote to memory of 1384 1300 SPOOLSV.EXE SPOOLSV.EXE PID 1300 wrote to memory of 1384 1300 SPOOLSV.EXE SPOOLSV.EXE PID 1300 wrote to memory of 1384 1300 SPOOLSV.EXE SPOOLSV.EXE PID 1300 wrote to memory of 292 1300 SPOOLSV.EXE CTFMON.EXE PID 1300 wrote to memory of 292 1300 SPOOLSV.EXE CTFMON.EXE PID 1300 wrote to memory of 292 1300 SPOOLSV.EXE CTFMON.EXE PID 1300 wrote to memory of 292 1300 SPOOLSV.EXE CTFMON.EXE PID 292 wrote to memory of 1452 292 CTFMON.EXE SVCHOST.EXE PID 292 wrote to memory of 1452 292 CTFMON.EXE SVCHOST.EXE PID 292 wrote to memory of 1452 292 CTFMON.EXE SVCHOST.EXE PID 292 wrote to memory of 1452 292 CTFMON.EXE SVCHOST.EXE PID 292 wrote to memory of 1668 292 CTFMON.EXE SPOOLSV.EXE PID 292 wrote to memory of 1668 292 CTFMON.EXE SPOOLSV.EXE PID 292 wrote to memory of 1668 292 CTFMON.EXE SPOOLSV.EXE PID 292 wrote to memory of 1668 292 CTFMON.EXE SPOOLSV.EXE PID 292 wrote to memory of 1660 292 CTFMON.EXE CTFMON.EXE PID 292 wrote to memory of 1660 292 CTFMON.EXE CTFMON.EXE PID 292 wrote to memory of 1660 292 CTFMON.EXE CTFMON.EXE PID 292 wrote to memory of 1660 292 CTFMON.EXE CTFMON.EXE PID 580 wrote to memory of 1392 580 SVCHOST.EXE CTFMON.EXE PID 580 wrote to memory of 1392 580 SVCHOST.EXE CTFMON.EXE PID 580 wrote to memory of 1392 580 SVCHOST.EXE CTFMON.EXE PID 580 wrote to memory of 1392 580 SVCHOST.EXE CTFMON.EXE PID 1616 wrote to memory of 316 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe SPOOLSV.EXE PID 1616 wrote to memory of 316 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe SPOOLSV.EXE PID 1616 wrote to memory of 316 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe SPOOLSV.EXE PID 1616 wrote to memory of 316 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe SPOOLSV.EXE PID 1616 wrote to memory of 1864 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe CTFMON.EXE PID 1616 wrote to memory of 1864 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe CTFMON.EXE PID 1616 wrote to memory of 1864 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe CTFMON.EXE PID 1616 wrote to memory of 1864 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe CTFMON.EXE PID 1616 wrote to memory of 896 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe WINWORD.EXE PID 1616 wrote to memory of 896 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe WINWORD.EXE PID 1616 wrote to memory of 896 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe WINWORD.EXE PID 1616 wrote to memory of 896 1616 da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe WINWORD.EXE PID 896 wrote to memory of 1400 896 WINWORD.EXE splwow64.exe PID 896 wrote to memory of 1400 896 WINWORD.EXE splwow64.exe PID 896 wrote to memory of 1400 896 WINWORD.EXE splwow64.exe PID 896 wrote to memory of 1400 896 WINWORD.EXE splwow64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe"C:\Users\Admin\AppData\Local\Temp\da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent2⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent3⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\recycled\CTFMON.EXEC:\recycled\CTFMON.EXE :agent4⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\recycled\SVCHOST.EXEC:\recycled\SVCHOST.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\recycled\CTFMON.EXEC:\recycled\CTFMON.EXE :agent5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\recycled\CTFMON.EXEC:\recycled\CTFMON.EXE :agent3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\recycled\SPOOLSV.EXEC:\recycled\SPOOLSV.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\recycled\CTFMON.EXEC:\recycled\CTFMON.EXE :agent2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\da9891077bbcb9a1ceb6f0454196cceb1176e2b02375fd2f08290f5ba1df4655.doc"2⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122883⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Recycled\CTFMON.EXEFilesize
42KB
MD584569c212444f381f9c6a8d714d798f5
SHA161ffed8a3c0fd5a710bdcdd79fb06087fcd8f467
SHA2561641a0ce63fd0e8876b55d418c760f75e73fbfed028d03d7fb2ab11c01a630ea
SHA5121bc338c29917a6882c06ec2da096b76ddbc5914f2a7fffa4e0adaf29aa25e646ef7075ed9f3716621359e5d14581ac92fdc94c58721a49bcc355a544a081b36c
-
C:\Recycled\CTFMON.EXEFilesize
42KB
MD584569c212444f381f9c6a8d714d798f5
SHA161ffed8a3c0fd5a710bdcdd79fb06087fcd8f467
SHA2561641a0ce63fd0e8876b55d418c760f75e73fbfed028d03d7fb2ab11c01a630ea
SHA5121bc338c29917a6882c06ec2da096b76ddbc5914f2a7fffa4e0adaf29aa25e646ef7075ed9f3716621359e5d14581ac92fdc94c58721a49bcc355a544a081b36c
-
C:\Recycled\CTFMON.EXEFilesize
42KB
MD584569c212444f381f9c6a8d714d798f5
SHA161ffed8a3c0fd5a710bdcdd79fb06087fcd8f467
SHA2561641a0ce63fd0e8876b55d418c760f75e73fbfed028d03d7fb2ab11c01a630ea
SHA5121bc338c29917a6882c06ec2da096b76ddbc5914f2a7fffa4e0adaf29aa25e646ef7075ed9f3716621359e5d14581ac92fdc94c58721a49bcc355a544a081b36c
-
C:\Recycled\CTFMON.EXEFilesize
42KB
MD584569c212444f381f9c6a8d714d798f5
SHA161ffed8a3c0fd5a710bdcdd79fb06087fcd8f467
SHA2561641a0ce63fd0e8876b55d418c760f75e73fbfed028d03d7fb2ab11c01a630ea
SHA5121bc338c29917a6882c06ec2da096b76ddbc5914f2a7fffa4e0adaf29aa25e646ef7075ed9f3716621359e5d14581ac92fdc94c58721a49bcc355a544a081b36c
-
C:\Recycled\SPOOLSV.EXEFilesize
42KB
MD50e62ed232fe155c6a03347f099c8d78c
SHA13f9f83ff47a81587e962017f692452384849b7e7
SHA2560dc0da79f83ec17a1b23dd4357a6e930ef36dc038ed618b0a3a852876229896e
SHA5128f26c458e50de115cd3038c9c046e6687c3f43ff7285bed5435bb114c20c04e2de74b6d25657a89fefe11a5b50cbd2b586a5263453fe2f48f020e1954e38e169
-
C:\Recycled\SPOOLSV.EXEFilesize
42KB
MD50e62ed232fe155c6a03347f099c8d78c
SHA13f9f83ff47a81587e962017f692452384849b7e7
SHA2560dc0da79f83ec17a1b23dd4357a6e930ef36dc038ed618b0a3a852876229896e
SHA5128f26c458e50de115cd3038c9c046e6687c3f43ff7285bed5435bb114c20c04e2de74b6d25657a89fefe11a5b50cbd2b586a5263453fe2f48f020e1954e38e169
-
C:\Recycled\SPOOLSV.EXEFilesize
42KB
MD50e62ed232fe155c6a03347f099c8d78c
SHA13f9f83ff47a81587e962017f692452384849b7e7
SHA2560dc0da79f83ec17a1b23dd4357a6e930ef36dc038ed618b0a3a852876229896e
SHA5128f26c458e50de115cd3038c9c046e6687c3f43ff7285bed5435bb114c20c04e2de74b6d25657a89fefe11a5b50cbd2b586a5263453fe2f48f020e1954e38e169
-
C:\Recycled\SPOOLSV.EXEFilesize
42KB
MD50e62ed232fe155c6a03347f099c8d78c
SHA13f9f83ff47a81587e962017f692452384849b7e7
SHA2560dc0da79f83ec17a1b23dd4357a6e930ef36dc038ed618b0a3a852876229896e
SHA5128f26c458e50de115cd3038c9c046e6687c3f43ff7285bed5435bb114c20c04e2de74b6d25657a89fefe11a5b50cbd2b586a5263453fe2f48f020e1954e38e169
-
C:\Recycled\SVCHOST.EXEFilesize
42KB
MD593e690dfc38872c80490ab4cb81c035f
SHA167a27c49eb7506238fe157b940fc47b3520e3aaf
SHA25618a76d76e895a8751ae8a8d93ab8372a28e2de5cbce45b68933d14933028d84e
SHA5121fbe318d7dc31de35e2bad4da621ce562d1fe9c1ae7669a873b6f9e63f4945e5c1257e4615d650c76ae9983e8c7bc40d454180a02adffe48b20ac444a9e8a7db
-
C:\Recycled\SVCHOST.EXEFilesize
42KB
MD593e690dfc38872c80490ab4cb81c035f
SHA167a27c49eb7506238fe157b940fc47b3520e3aaf
SHA25618a76d76e895a8751ae8a8d93ab8372a28e2de5cbce45b68933d14933028d84e
SHA5121fbe318d7dc31de35e2bad4da621ce562d1fe9c1ae7669a873b6f9e63f4945e5c1257e4615d650c76ae9983e8c7bc40d454180a02adffe48b20ac444a9e8a7db
-
C:\Recycled\SVCHOST.EXEFilesize
42KB
MD593e690dfc38872c80490ab4cb81c035f
SHA167a27c49eb7506238fe157b940fc47b3520e3aaf
SHA25618a76d76e895a8751ae8a8d93ab8372a28e2de5cbce45b68933d14933028d84e
SHA5121fbe318d7dc31de35e2bad4da621ce562d1fe9c1ae7669a873b6f9e63f4945e5c1257e4615d650c76ae9983e8c7bc40d454180a02adffe48b20ac444a9e8a7db
-
C:\Recycled\SVCHOST.EXEFilesize
42KB
MD593e690dfc38872c80490ab4cb81c035f
SHA167a27c49eb7506238fe157b940fc47b3520e3aaf
SHA25618a76d76e895a8751ae8a8d93ab8372a28e2de5cbce45b68933d14933028d84e
SHA5121fbe318d7dc31de35e2bad4da621ce562d1fe9c1ae7669a873b6f9e63f4945e5c1257e4615d650c76ae9983e8c7bc40d454180a02adffe48b20ac444a9e8a7db
-
C:\Users\Admin\AppData\Local\Temp\Flu Burung.txtFilesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
C:\Users\Admin\AppData\Local\Temp\Flu Burung.txtFilesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
C:\Users\Admin\AppData\Local\Temp\Flu Burung.txtFilesize
2KB
MD51a1dce35d60d2c70ca8894954fd5d384
SHA158547dd65d506c892290755010d0232da34ee000
SHA2562661c05273f33efa4b7faa6ed8a6f7e69a13ad86077f69ee285ece9cba57e44c
SHA5124abe37613145fabeb44ea4c28ecc827c8a0eb2b003e86ae7aef9be5687711fa7a294f17567ea0a70a6f14ab3cbe7886c83763a7c49278097fd53f0d11fd8154e
-
C:\Windows\Fonts\ Explorer.exeFilesize
42KB
MD53704648a267a5224ea866d7cd507a7c9
SHA101522bc7dd69a6fc8e20a681d29e5d0a5ae198ea
SHA256c6072aa096ad75ee1f1727fa0a3c24eb6711cd4b97d95fbdf9fe2786f113df7e
SHA5124a4b6d6206bde71a2fbc2c7228496fe8880b6418bd662816c967239015067508b3b49641d6ce35708cb3fa319edfff67fa46a4873b83a7f05a43fb230ac59d60
-
C:\Windows\Fonts\ Explorer.exeFilesize
42KB
MD583c56b99d031e32f8b3b2086ffd4fa5a
SHA1f23b21ab3dfb7ec94f3132407fc3b626f9b34a45
SHA256786ea584adfbf920897ce61bf7e8aad297009445bc79c96942884e27735123a7
SHA5122b78bf6d91dab661c7ef4931a0f87c2f4cde4ab89995f688b6feb71398bba590c3462528638ab3a30f1ff79681094781bbe88fabd51f84dcbbb0f8762b37f392
-
C:\Windows\Fonts\ Explorer.exeFilesize
42KB
MD5e6d973886e1e1ea0996c52e5da7203df
SHA1066dbc34feab3003bbf29a03734f80a94a8b679d
SHA25650a98e496fe683615f52ef703ceda98b78619d9d1aee2337f821bb806526deee
SHA512b6c89dd3ab0ec2dcaf9cf34ab56c01386b66046119826b15f7d54f9c658dad4e978f695157a429e7b8d98b3cf74a325e6da86aeff073f3cbf4983307af63619e
-
C:\recycled\CTFMON.EXEFilesize
42KB
MD584569c212444f381f9c6a8d714d798f5
SHA161ffed8a3c0fd5a710bdcdd79fb06087fcd8f467
SHA2561641a0ce63fd0e8876b55d418c760f75e73fbfed028d03d7fb2ab11c01a630ea
SHA5121bc338c29917a6882c06ec2da096b76ddbc5914f2a7fffa4e0adaf29aa25e646ef7075ed9f3716621359e5d14581ac92fdc94c58721a49bcc355a544a081b36c
-
C:\recycled\SPOOLSV.EXEFilesize
42KB
MD50e62ed232fe155c6a03347f099c8d78c
SHA13f9f83ff47a81587e962017f692452384849b7e7
SHA2560dc0da79f83ec17a1b23dd4357a6e930ef36dc038ed618b0a3a852876229896e
SHA5128f26c458e50de115cd3038c9c046e6687c3f43ff7285bed5435bb114c20c04e2de74b6d25657a89fefe11a5b50cbd2b586a5263453fe2f48f020e1954e38e169
-
C:\recycled\SVCHOST.exeFilesize
42KB
MD593e690dfc38872c80490ab4cb81c035f
SHA167a27c49eb7506238fe157b940fc47b3520e3aaf
SHA25618a76d76e895a8751ae8a8d93ab8372a28e2de5cbce45b68933d14933028d84e
SHA5121fbe318d7dc31de35e2bad4da621ce562d1fe9c1ae7669a873b6f9e63f4945e5c1257e4615d650c76ae9983e8c7bc40d454180a02adffe48b20ac444a9e8a7db
-
\Recycled\CTFMON.EXEFilesize
42KB
MD584569c212444f381f9c6a8d714d798f5
SHA161ffed8a3c0fd5a710bdcdd79fb06087fcd8f467
SHA2561641a0ce63fd0e8876b55d418c760f75e73fbfed028d03d7fb2ab11c01a630ea
SHA5121bc338c29917a6882c06ec2da096b76ddbc5914f2a7fffa4e0adaf29aa25e646ef7075ed9f3716621359e5d14581ac92fdc94c58721a49bcc355a544a081b36c
-
\Recycled\CTFMON.EXEFilesize
42KB
MD584569c212444f381f9c6a8d714d798f5
SHA161ffed8a3c0fd5a710bdcdd79fb06087fcd8f467
SHA2561641a0ce63fd0e8876b55d418c760f75e73fbfed028d03d7fb2ab11c01a630ea
SHA5121bc338c29917a6882c06ec2da096b76ddbc5914f2a7fffa4e0adaf29aa25e646ef7075ed9f3716621359e5d14581ac92fdc94c58721a49bcc355a544a081b36c
-
\Recycled\CTFMON.EXEFilesize
42KB
MD584569c212444f381f9c6a8d714d798f5
SHA161ffed8a3c0fd5a710bdcdd79fb06087fcd8f467
SHA2561641a0ce63fd0e8876b55d418c760f75e73fbfed028d03d7fb2ab11c01a630ea
SHA5121bc338c29917a6882c06ec2da096b76ddbc5914f2a7fffa4e0adaf29aa25e646ef7075ed9f3716621359e5d14581ac92fdc94c58721a49bcc355a544a081b36c
-
\Recycled\CTFMON.EXEFilesize
42KB
MD584569c212444f381f9c6a8d714d798f5
SHA161ffed8a3c0fd5a710bdcdd79fb06087fcd8f467
SHA2561641a0ce63fd0e8876b55d418c760f75e73fbfed028d03d7fb2ab11c01a630ea
SHA5121bc338c29917a6882c06ec2da096b76ddbc5914f2a7fffa4e0adaf29aa25e646ef7075ed9f3716621359e5d14581ac92fdc94c58721a49bcc355a544a081b36c
-
\Recycled\SPOOLSV.EXEFilesize
42KB
MD50e62ed232fe155c6a03347f099c8d78c
SHA13f9f83ff47a81587e962017f692452384849b7e7
SHA2560dc0da79f83ec17a1b23dd4357a6e930ef36dc038ed618b0a3a852876229896e
SHA5128f26c458e50de115cd3038c9c046e6687c3f43ff7285bed5435bb114c20c04e2de74b6d25657a89fefe11a5b50cbd2b586a5263453fe2f48f020e1954e38e169
-
\Recycled\SPOOLSV.EXEFilesize
42KB
MD50e62ed232fe155c6a03347f099c8d78c
SHA13f9f83ff47a81587e962017f692452384849b7e7
SHA2560dc0da79f83ec17a1b23dd4357a6e930ef36dc038ed618b0a3a852876229896e
SHA5128f26c458e50de115cd3038c9c046e6687c3f43ff7285bed5435bb114c20c04e2de74b6d25657a89fefe11a5b50cbd2b586a5263453fe2f48f020e1954e38e169
-
\Recycled\SPOOLSV.EXEFilesize
42KB
MD50e62ed232fe155c6a03347f099c8d78c
SHA13f9f83ff47a81587e962017f692452384849b7e7
SHA2560dc0da79f83ec17a1b23dd4357a6e930ef36dc038ed618b0a3a852876229896e
SHA5128f26c458e50de115cd3038c9c046e6687c3f43ff7285bed5435bb114c20c04e2de74b6d25657a89fefe11a5b50cbd2b586a5263453fe2f48f020e1954e38e169
-
\Recycled\SPOOLSV.EXEFilesize
42KB
MD50e62ed232fe155c6a03347f099c8d78c
SHA13f9f83ff47a81587e962017f692452384849b7e7
SHA2560dc0da79f83ec17a1b23dd4357a6e930ef36dc038ed618b0a3a852876229896e
SHA5128f26c458e50de115cd3038c9c046e6687c3f43ff7285bed5435bb114c20c04e2de74b6d25657a89fefe11a5b50cbd2b586a5263453fe2f48f020e1954e38e169
-
\Recycled\SPOOLSV.EXEFilesize
42KB
MD50e62ed232fe155c6a03347f099c8d78c
SHA13f9f83ff47a81587e962017f692452384849b7e7
SHA2560dc0da79f83ec17a1b23dd4357a6e930ef36dc038ed618b0a3a852876229896e
SHA5128f26c458e50de115cd3038c9c046e6687c3f43ff7285bed5435bb114c20c04e2de74b6d25657a89fefe11a5b50cbd2b586a5263453fe2f48f020e1954e38e169
-
\Recycled\SPOOLSV.EXEFilesize
42KB
MD50e62ed232fe155c6a03347f099c8d78c
SHA13f9f83ff47a81587e962017f692452384849b7e7
SHA2560dc0da79f83ec17a1b23dd4357a6e930ef36dc038ed618b0a3a852876229896e
SHA5128f26c458e50de115cd3038c9c046e6687c3f43ff7285bed5435bb114c20c04e2de74b6d25657a89fefe11a5b50cbd2b586a5263453fe2f48f020e1954e38e169
-
\Recycled\SPOOLSV.EXEFilesize
42KB
MD50e62ed232fe155c6a03347f099c8d78c
SHA13f9f83ff47a81587e962017f692452384849b7e7
SHA2560dc0da79f83ec17a1b23dd4357a6e930ef36dc038ed618b0a3a852876229896e
SHA5128f26c458e50de115cd3038c9c046e6687c3f43ff7285bed5435bb114c20c04e2de74b6d25657a89fefe11a5b50cbd2b586a5263453fe2f48f020e1954e38e169
-
\Recycled\SVCHOST.EXEFilesize
42KB
MD593e690dfc38872c80490ab4cb81c035f
SHA167a27c49eb7506238fe157b940fc47b3520e3aaf
SHA25618a76d76e895a8751ae8a8d93ab8372a28e2de5cbce45b68933d14933028d84e
SHA5121fbe318d7dc31de35e2bad4da621ce562d1fe9c1ae7669a873b6f9e63f4945e5c1257e4615d650c76ae9983e8c7bc40d454180a02adffe48b20ac444a9e8a7db
-
\Recycled\SVCHOST.EXEFilesize
42KB
MD593e690dfc38872c80490ab4cb81c035f
SHA167a27c49eb7506238fe157b940fc47b3520e3aaf
SHA25618a76d76e895a8751ae8a8d93ab8372a28e2de5cbce45b68933d14933028d84e
SHA5121fbe318d7dc31de35e2bad4da621ce562d1fe9c1ae7669a873b6f9e63f4945e5c1257e4615d650c76ae9983e8c7bc40d454180a02adffe48b20ac444a9e8a7db
-
\Recycled\SVCHOST.EXEFilesize
42KB
MD593e690dfc38872c80490ab4cb81c035f
SHA167a27c49eb7506238fe157b940fc47b3520e3aaf
SHA25618a76d76e895a8751ae8a8d93ab8372a28e2de5cbce45b68933d14933028d84e
SHA5121fbe318d7dc31de35e2bad4da621ce562d1fe9c1ae7669a873b6f9e63f4945e5c1257e4615d650c76ae9983e8c7bc40d454180a02adffe48b20ac444a9e8a7db
-
\Recycled\SVCHOST.EXEFilesize
42KB
MD593e690dfc38872c80490ab4cb81c035f
SHA167a27c49eb7506238fe157b940fc47b3520e3aaf
SHA25618a76d76e895a8751ae8a8d93ab8372a28e2de5cbce45b68933d14933028d84e
SHA5121fbe318d7dc31de35e2bad4da621ce562d1fe9c1ae7669a873b6f9e63f4945e5c1257e4615d650c76ae9983e8c7bc40d454180a02adffe48b20ac444a9e8a7db
-
memory/292-127-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/292-101-0x0000000000000000-mapping.dmp
-
memory/316-141-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/316-137-0x0000000000000000-mapping.dmp
-
memory/580-79-0x0000000000540000-0x000000000055A000-memory.dmpFilesize
104KB
-
memory/580-78-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/580-60-0x0000000000000000-mapping.dmp
-
memory/580-125-0x0000000000540000-0x000000000055A000-memory.dmpFilesize
104KB
-
memory/896-154-0x0000000070C2D000-0x0000000070C38000-memory.dmpFilesize
44KB
-
memory/896-150-0x00000000721C1000-0x00000000721C4000-memory.dmpFilesize
12KB
-
memory/896-148-0x0000000000000000-mapping.dmp
-
memory/896-151-0x000000006FC41000-0x000000006FC43000-memory.dmpFilesize
8KB
-
memory/896-152-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/896-155-0x0000000070C2D000-0x0000000070C38000-memory.dmpFilesize
44KB
-
memory/1268-87-0x0000000000000000-mapping.dmp
-
memory/1268-91-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1300-77-0x0000000000000000-mapping.dmp
-
memory/1300-126-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1384-93-0x0000000000000000-mapping.dmp
-
memory/1384-97-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1392-134-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1392-130-0x0000000000000000-mapping.dmp
-
memory/1400-156-0x0000000000000000-mapping.dmp
-
memory/1400-157-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmpFilesize
8KB
-
memory/1452-109-0x0000000000000000-mapping.dmp
-
memory/1452-113-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1496-74-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1496-68-0x0000000000000000-mapping.dmp
-
memory/1616-57-0x0000000075701000-0x0000000075703000-memory.dmpFilesize
8KB
-
memory/1616-75-0x0000000002380000-0x000000000239A000-memory.dmpFilesize
104KB
-
memory/1616-149-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1616-55-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1660-121-0x0000000000000000-mapping.dmp
-
memory/1660-128-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1668-116-0x0000000000000000-mapping.dmp
-
memory/1668-120-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1864-147-0x0000000000400000-0x000000000041A000-memory.dmpFilesize
104KB
-
memory/1864-143-0x0000000000000000-mapping.dmp